net/wireless/nl80211.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * This is the new netlink-based wireless configuration interface.
   4  *
   5  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   6  * Copyright 2013-2014  Intel Mobile Communications GmbH
   7  * Copyright 2015-2017  Intel Deutschland GmbH
   8  * Copyright (C) 2018-2020 Intel Corporation
   9  */
  10
  11 #include <linux/if.h>
  12 #include <linux/module.h>
  13 #include <linux/err.h>
  14 #include <linux/slab.h>
  15 #include <linux/list.h>
  16 #include <linux/if_ether.h>
  17 #include <linux/ieee80211.h>
  18 #include <linux/nl80211.h>
  19 #include <linux/rtnetlink.h>
  20 #include <linux/netlink.h>
  21 #include <linux/nospec.h>
  22 #include <linux/etherdevice.h>
  23 #include <linux/if_vlan.h>
  24 #include <net/net_namespace.h>
  25 #include <net/genetlink.h>
  26 #include <net/cfg80211.h>
  27 #include <net/sock.h>
  28 #include <net/inet_connection_sock.h>
  29 #include "core.h"
  30 #include "nl80211.h"
  31 #include "reg.h"
  32 #include "rdev-ops.h"
  33
  34 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  35                                    struct genl_info *info,
  36                                    struct cfg80211_crypto_settings *settings,
  37                                    int cipher_limit);
  38
  39 /* the netlink family */
  40 static struct genl_family nl80211_fam;
  41
  42 /* multicast groups */
  43 enum nl80211_multicast_groups {
  44         NL80211_MCGRP_CONFIG,
  45         NL80211_MCGRP_SCAN,
  46         NL80211_MCGRP_REGULATORY,
  47         NL80211_MCGRP_MLME,
  48         NL80211_MCGRP_VENDOR,
  49         NL80211_MCGRP_NAN,
  50         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  51 };
  52
  53 static const struct genl_multicast_group nl80211_mcgrps[] = {
  54         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  55         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  56         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  57         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  58         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  59         [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
  60 #ifdef CONFIG_NL80211_TESTMODE
  61         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  62 #endif
  63 };
  64
  65 /* returns ERR_PTR values */
  66 static struct wireless_dev *
  67 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  68 {
  69         struct cfg80211_registered_device *rdev;
  70         struct wireless_dev *result = NULL;
  71         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  72         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  73         u64 wdev_id;
  74         int wiphy_idx = -1;
  75         int ifidx = -1;
  76
  77         ASSERT_RTNL();
  78
  79         if (!have_ifidx && !have_wdev_id)
  80                 return ERR_PTR(-EINVAL);
  81
  82         if (have_ifidx)
  83                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  84         if (have_wdev_id) {
  85                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  86                 wiphy_idx = wdev_id >> 32;
  87         }
  88
  89         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  90                 struct wireless_dev *wdev;
  91
  92                 if (wiphy_net(&rdev->wiphy) != netns)
  93                         continue;
  94
  95                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  96                         continue;
  97
  98                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
  99                         if (have_ifidx && wdev->netdev &&
 100                             wdev->netdev->ifindex == ifidx) {
 101                                 result = wdev;
 102                                 break;
 103                         }
 104                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 105                                 result = wdev;
 106                                 break;
 107                         }
 108                 }
 109
 110                 if (result)
 111                         break;
 112         }
 113
 114         if (result)
 115                 return result;
 116         return ERR_PTR(-ENODEV);
 117 }
 118
 119 static struct cfg80211_registered_device *
 120 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 121 {
 122         struct cfg80211_registered_device *rdev = NULL, *tmp;
 123         struct net_device *netdev;
 124
 125         ASSERT_RTNL();
 126
 127         if (!attrs[NL80211_ATTR_WIPHY] &&
 128             !attrs[NL80211_ATTR_IFINDEX] &&
 129             !attrs[NL80211_ATTR_WDEV])
 130                 return ERR_PTR(-EINVAL);
 131
 132         if (attrs[NL80211_ATTR_WIPHY])
 133                 rdev = cfg80211_rdev_by_wiphy_idx(
 134                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 135
 136         if (attrs[NL80211_ATTR_WDEV]) {
 137                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 138                 struct wireless_dev *wdev;
 139                 bool found = false;
 140
 141                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 142                 if (tmp) {
 143                         /* make sure wdev exists */
 144                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 145                                 if (wdev->identifier != (u32)wdev_id)
 146                                         continue;
 147                                 found = true;
 148                                 break;
 149                         }
 150
 151                         if (!found)
 152                                 tmp = NULL;
 153
 154                         if (rdev && tmp != rdev)
 155                                 return ERR_PTR(-EINVAL);
 156                         rdev = tmp;
 157                 }
 158         }
 159
 160         if (attrs[NL80211_ATTR_IFINDEX]) {
 161                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 162
 163                 netdev = __dev_get_by_index(netns, ifindex);
 164                 if (netdev) {
 165                         if (netdev->ieee80211_ptr)
 166                                 tmp = wiphy_to_rdev(
 167                                         netdev->ieee80211_ptr->wiphy);
 168                         else
 169                                 tmp = NULL;
 170
 171                         /* not wireless device -- return error */
 172                         if (!tmp)
 173                                 return ERR_PTR(-EINVAL);
 174
 175                         /* mismatch -- return error */
 176                         if (rdev && tmp != rdev)
 177                                 return ERR_PTR(-EINVAL);
 178
 179                         rdev = tmp;
 180                 }
 181         }
 182
 183         if (!rdev)
 184                 return ERR_PTR(-ENODEV);
 185
 186         if (netns != wiphy_net(&rdev->wiphy))
 187                 return ERR_PTR(-ENODEV);
 188
 189         return rdev;
 190 }
 191
 192 /*
 193  * This function returns a pointer to the driver
 194  * that the genl_info item that is passed refers to.
 195  *
 196  * The result of this can be a PTR_ERR and hence must
 197  * be checked with IS_ERR() for errors.
 198  */
 199 static struct cfg80211_registered_device *
 200 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 201 {
 202         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 203 }
 204
 205 static int validate_beacon_head(const struct nlattr *attr,
 206                                 struct netlink_ext_ack *extack)
 207 {
 208         const u8 *data = nla_data(attr);
 209         unsigned int len = nla_len(attr);
 210         const struct element *elem;
 211         const struct ieee80211_mgmt *mgmt = (void *)data;
 212         bool s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control);
 213         unsigned int fixedlen, hdrlen;
 214
 215         if (s1g_bcn) {
 216                 fixedlen = offsetof(struct ieee80211_ext,
 217                                     u.s1g_beacon.variable);
 218                 hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon);
 219         } else {
 220                 fixedlen = offsetof(struct ieee80211_mgmt,
 221                                     u.beacon.variable);
 222                 hdrlen = offsetof(struct ieee80211_mgmt, u.beacon);
 223         }
 224
 225         if (len < fixedlen)
 226                 goto err;
 227
 228         if (ieee80211_hdrlen(mgmt->frame_control) != hdrlen)
 229                 goto err;
 230
 231         data += fixedlen;
 232         len -= fixedlen;
 233
 234         for_each_element(elem, data, len) {
 235                 /* nothing */
 236         }
 237
 238         if (for_each_element_completed(elem, data, len))
 239                 return 0;
 240
 241 err:
 242         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head");
 243         return -EINVAL;
 244 }
 245
 246 static int validate_ie_attr(const struct nlattr *attr,
 247                             struct netlink_ext_ack *extack)
 248 {
 249         const u8 *data = nla_data(attr);
 250         unsigned int len = nla_len(attr);
 251         const struct element *elem;
 252
 253         for_each_element(elem, data, len) {
 254                 /* nothing */
 255         }
 256
 257         if (for_each_element_completed(elem, data, len))
 258                 return 0;
 259
 260         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
 261         return -EINVAL;
 262 }
 263
 264 /* policy for the attributes */
 265 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR];
 266
 267 static const struct nla_policy
 268 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
 269         [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
 270         [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
 271                                         .len = U8_MAX },
 272         [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
 273                                              .len = U8_MAX },
 274 };
 275
 276 static const struct nla_policy
 277 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
 278         [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
 279         [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
 280         [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
 281                 NLA_POLICY_MAX(NLA_U8, 15),
 282         [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
 283         [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
 284                 NLA_POLICY_MAX(NLA_U8, 15),
 285         [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] =
 286                 NLA_POLICY_MAX(NLA_U8, 31),
 287         [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
 288         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
 289         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
 290         [NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },
 291         [NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },
 292 };
 293
 294 static const struct nla_policy
 295 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
 296         [NL80211_PMSR_TYPE_FTM] =
 297                 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
 298 };
 299
 300 static const struct nla_policy
 301 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
 302         [NL80211_PMSR_REQ_ATTR_DATA] =
 303                 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
 304         [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
 305 };
 306
 307 static const struct nla_policy
 308 nl80211_psmr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
 309         [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
 310         [NL80211_PMSR_PEER_ATTR_CHAN] = NLA_POLICY_NESTED(nl80211_policy),
 311         [NL80211_PMSR_PEER_ATTR_REQ] =
 312                 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
 313         [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
 314 };
 315
 316 static const struct nla_policy
 317 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
 318         [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
 319         [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
 320         [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
 321         [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
 322         [NL80211_PMSR_ATTR_PEERS] =
 323                 NLA_POLICY_NESTED_ARRAY(nl80211_psmr_peer_attr_policy),
 324 };
 325
 326 static const struct nla_policy
 327 he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = {
 328         [NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] =
 329                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 330         [NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] =
 331                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 332         [NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET] =
 333                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 334         [NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP] =
 335                 NLA_POLICY_EXACT_LEN(8),
 336         [NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP] =
 337                 NLA_POLICY_EXACT_LEN(8),
 338         [NL80211_HE_OBSS_PD_ATTR_SR_CTRL] = { .type = NLA_U8 },
 339 };
 340
 341 static const struct nla_policy
 342 he_bss_color_policy[NL80211_HE_BSS_COLOR_ATTR_MAX + 1] = {
 343         [NL80211_HE_BSS_COLOR_ATTR_COLOR] = NLA_POLICY_RANGE(NLA_U8, 1, 63),
 344         [NL80211_HE_BSS_COLOR_ATTR_DISABLED] = { .type = NLA_FLAG },
 345         [NL80211_HE_BSS_COLOR_ATTR_PARTIAL] = { .type = NLA_FLAG },
 346 };
 347
 348 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
 349         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
 350                                     .len = NL80211_MAX_SUPP_RATES },
 351         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
 352                                 .len = NL80211_MAX_SUPP_HT_RATES },
 353         [NL80211_TXRATE_VHT] = NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_txrate_vht)),
 354         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
 355         [NL80211_TXRATE_HE] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_he)),
 356         [NL80211_TXRATE_HE_GI] =  NLA_POLICY_RANGE(NLA_U8,
 357                                                    NL80211_RATE_INFO_HE_GI_0_8,
 358                                                    NL80211_RATE_INFO_HE_GI_3_2),
 359         [NL80211_TXRATE_HE_LTF] = NLA_POLICY_RANGE(NLA_U8,
 360                                                    NL80211_RATE_INFO_HE_1XLTF,
 361                                                    NL80211_RATE_INFO_HE_4XLTF),
 362 };
 363
 364 static const struct nla_policy
 365 nl80211_tid_config_attr_policy[NL80211_TID_CONFIG_ATTR_MAX + 1] = {
 366         [NL80211_TID_CONFIG_ATTR_VIF_SUPP] = { .type = NLA_U64 },
 367         [NL80211_TID_CONFIG_ATTR_PEER_SUPP] = { .type = NLA_U64 },
 368         [NL80211_TID_CONFIG_ATTR_OVERRIDE] = { .type = NLA_FLAG },
 369         [NL80211_TID_CONFIG_ATTR_TIDS] = NLA_POLICY_RANGE(NLA_U16, 1, 0xff),
 370         [NL80211_TID_CONFIG_ATTR_NOACK] =
 371                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 372         [NL80211_TID_CONFIG_ATTR_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 373         [NL80211_TID_CONFIG_ATTR_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 374         [NL80211_TID_CONFIG_ATTR_AMPDU_CTRL] =
 375                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 376         [NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL] =
 377                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 378         [NL80211_TID_CONFIG_ATTR_AMSDU_CTRL] =
 379                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 380         [NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE] =
 381                         NLA_POLICY_MAX(NLA_U8, NL80211_TX_RATE_FIXED),
 382         [NL80211_TID_CONFIG_ATTR_TX_RATE] =
 383                         NLA_POLICY_NESTED(nl80211_txattr_policy),
 384 };
 385
 386 static const struct nla_policy
 387 nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = {
 388         [NL80211_FILS_DISCOVERY_ATTR_INT_MIN] = NLA_POLICY_MAX(NLA_U32, 10000),
 389         [NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000),
 390         NLA_POLICY_RANGE(NLA_BINARY,
 391                          NL80211_FILS_DISCOVERY_TMPL_MIN_LEN,
 392                          IEEE80211_MAX_DATA_LEN),
 393 };
 394
 395 static const struct nla_policy
 396 nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1] = {
 397         [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] = NLA_POLICY_MAX(NLA_U32, 20),
 398         [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL] = { .type = NLA_BINARY,
 399                                                        .len = IEEE80211_MAX_DATA_LEN }
 400 };
 401
 402 static const struct nla_policy
 403 sar_specs_policy[NL80211_SAR_ATTR_SPECS_MAX + 1] = {
 404         [NL80211_SAR_ATTR_SPECS_POWER] = { .type = NLA_S32 },
 405         [NL80211_SAR_ATTR_SPECS_RANGE_INDEX] = {.type = NLA_U32 },
 406 };
 407
 408 static const struct nla_policy
 409 sar_policy[NL80211_SAR_ATTR_MAX + 1] = {
 410         [NL80211_SAR_ATTR_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_SAR_TYPE),
 411         [NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy),
 412 };
 413
 414 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 415         [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
 416         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 417         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 418                                       .len = 20-1 },
 419         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 420
 421         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 422         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 423         [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8,
 424                                                 NL80211_EDMG_CHANNELS_MIN,
 425                                                 NL80211_EDMG_CHANNELS_MAX),
 426         [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8,
 427                                                 NL80211_EDMG_BW_CONFIG_MIN,
 428                                                 NL80211_EDMG_BW_CONFIG_MAX),
 429
 430         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 431         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 432         [NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
 433         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 434
 435         [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 436         [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 437         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 438         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 439         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 440         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 441
 442         [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
 443         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 444         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 445
 446         [NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 447         [NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 448
 449         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 450         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 451                                     .len = WLAN_MAX_KEY_LEN },
 452         [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7),
 453         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 454         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 455         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 456         [NL80211_ATTR_KEY_TYPE] =
 457                 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
 458
 459         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 460         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 461         [NL80211_ATTR_BEACON_HEAD] =
 462                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
 463                                        IEEE80211_MAX_DATA_LEN),
 464         [NL80211_ATTR_BEACON_TAIL] =
 465                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 466                                        IEEE80211_MAX_DATA_LEN),
 467         [NL80211_ATTR_STA_AID] =
 468                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 469         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 470         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 471         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 472                                                .len = NL80211_MAX_SUPP_RATES },
 473         [NL80211_ATTR_STA_PLINK_ACTION] =
 474                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
 475         [NL80211_ATTR_STA_TX_POWER_SETTING] =
 476                 NLA_POLICY_RANGE(NLA_U8,
 477                                  NL80211_TX_POWER_AUTOMATIC,
 478                                  NL80211_TX_POWER_FIXED),
 479         [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 },
 480         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 481         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 482         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 483                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 484         [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT,
 485
 486         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 487         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 488
 489         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 490         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 491         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 492         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 493                                            .len = NL80211_MAX_SUPP_RATES },
 494         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 495
 496         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 497         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 498
 499         [NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN),
 500
 501         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 502         [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
 503                                                    validate_ie_attr,
 504                                                    IEEE80211_MAX_DATA_LEN),
 505         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 506         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 507
 508         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 509                                 .len = IEEE80211_MAX_SSID_LEN },
 510         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 511         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 512         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 513         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 514         [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
 515                                                   NL80211_MFP_NO,
 516                                                   NL80211_MFP_OPTIONAL),
 517         [NL80211_ATTR_STA_FLAGS2] = {
 518                 .len = sizeof(struct nl80211_sta_flag_update),
 519         },
 520         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 521         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 522         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 523         [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
 524         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 525         [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 },
 526         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 527         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 528         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 529         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 530         [NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN),
 531         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 532         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 533         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 534         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 535                                  .len = IEEE80211_MAX_DATA_LEN },
 536         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 537         [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
 538                                                    NL80211_PS_DISABLED,
 539                                                    NL80211_PS_ENABLED),
 540         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 541         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 542         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 543         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 544         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 545         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 546         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 547         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 548         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 549         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 550         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 551         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 552         [NL80211_ATTR_STA_PLINK_STATE] =
 553                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
 554         [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 },
 555         [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG },
 556         [NL80211_ATTR_MESH_PEER_AID] =
 557                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 558         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 559         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 560         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 561         [NL80211_ATTR_HIDDEN_SSID] =
 562                 NLA_POLICY_RANGE(NLA_U32,
 563                                  NL80211_HIDDEN_SSID_NOT_IN_USE,
 564                                  NL80211_HIDDEN_SSID_ZERO_CONTENTS),
 565         [NL80211_ATTR_IE_PROBE_RESP] =
 566                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 567                                        IEEE80211_MAX_DATA_LEN),
 568         [NL80211_ATTR_IE_ASSOC_RESP] =
 569                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 570                                        IEEE80211_MAX_DATA_LEN),
 571         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 572         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 573         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 574         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 575         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 576         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 577         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 578         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 579         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 580         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 581         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 582                                       .len = IEEE80211_MAX_DATA_LEN },
 583         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 584         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 585         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 586                 .len = NL80211_HT_CAPABILITY_LEN
 587         },
 588         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 589         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 590         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 591         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 592         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 593
 594         /* need to include at least Auth Transaction and Status Code */
 595         [NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4),
 596
 597         [NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN),
 598         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 599         [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
 600         [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
 601         [NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
 602                 NLA_POLICY_RANGE(NLA_U32,
 603                                  NL80211_MESH_POWER_UNKNOWN + 1,
 604                                  NL80211_MESH_POWER_MAX),
 605         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 606         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 607         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 608         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 609         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 610         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 611         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 612                 .len = NL80211_VHT_CAPABILITY_LEN,
 613         },
 614         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 615         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 616                                   .len = IEEE80211_MAX_DATA_LEN },
 617         [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 },
 618         [NL80211_ATTR_MAX_CRIT_PROT_DURATION] =
 619                 NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION),
 620         [NL80211_ATTR_PEER_AID] =
 621                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 622         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 623         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 624         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 625         [NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY },
 626         [NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY },
 627         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2),
 628         /*
 629          * The value of the Length field of the Supported Operating
 630          * Classes element is between 2 and 253.
 631          */
 632         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] =
 633                 NLA_POLICY_RANGE(NLA_BINARY, 2, 253),
 634         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 635         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 636         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 637         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 638         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 639         [NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY,
 640                                                   IEEE80211_QOS_MAP_LEN_MIN,
 641                                                   IEEE80211_QOS_MAP_LEN_MAX),
 642         [NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 643         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 644         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 645         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 646         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 647         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 648         [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
 649         [NL80211_ATTR_USER_PRIO] =
 650                 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
 651         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 652         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 653         [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 },
 654         [NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 655         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 656         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 657         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 658         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 659         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 660         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 661         [NL80211_ATTR_STA_SUPPORT_P2P_PS] =
 662                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
 663         [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 664                 .len = VHT_MUMIMO_GROUPS_DATA_LEN
 665         },
 666         [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 667         [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
 668         [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
 669         [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 670         [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
 671                                     .len = FILS_MAX_KEK_LEN },
 672         [NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN),
 673         [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
 674         [NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 675         [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
 676         [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
 677                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 678         },
 679         [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
 680         [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
 681                                              .len = FILS_ERP_MAX_USERNAME_LEN },
 682         [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
 683                                           .len = FILS_ERP_MAX_REALM_LEN },
 684         [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
 685         [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
 686                                         .len = FILS_ERP_MAX_RRK_LEN },
 687         [NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2),
 688         [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
 689         [NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN),
 690         [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
 691         [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
 692
 693         [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
 694         [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
 695         [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
 696         [NL80211_ATTR_HE_CAPABILITY] =
 697                 NLA_POLICY_RANGE(NLA_BINARY,
 698                                  NL80211_HE_MIN_CAPABILITY_LEN,
 699                                  NL80211_HE_MAX_CAPABILITY_LEN),
 700         [NL80211_ATTR_FTM_RESPONDER] =
 701                 NLA_POLICY_NESTED(nl80211_ftm_responder_policy),
 702         [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
 703         [NL80211_ATTR_PEER_MEASUREMENTS] =
 704                 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
 705         [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
 706         [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY,
 707                                         .len = SAE_PASSWORD_MAX_LEN },
 708         [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG },
 709         [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy),
 710         [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2),
 711         [NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy),
 712         [NL80211_ATTR_TID_CONFIG] =
 713                 NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy),
 714         [NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG },
 715         [NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1),
 716         [NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100),
 717         [NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG },
 718         [NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
 719         [NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED },
 720         [NL80211_ATTR_HE_6GHZ_CAPABILITY] =
 721                 NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)),
 722         [NL80211_ATTR_FILS_DISCOVERY] =
 723                 NLA_POLICY_NESTED(nl80211_fils_discovery_policy),
 724         [NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] =
 725                 NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy),
 726         [NL80211_ATTR_S1G_CAPABILITY] =
 727                 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
 728         [NL80211_ATTR_S1G_CAPABILITY_MASK] =
 729                 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
 730         [NL80211_ATTR_SAE_PWE] =
 731                 NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK,
 732                                  NL80211_SAE_PWE_BOTH),
 733         [NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
 734         [NL80211_ATTR_SAR_SPEC] = NLA_POLICY_NESTED(sar_policy),
 735 };
 736
 737 /* policy for the key attributes */
 738 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 739         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 740         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 741         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 742         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 743         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 744         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 745         [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
 746         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 747         [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
 748 };
 749
 750 /* policy for the key default flags */
 751 static const struct nla_policy
 752 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 753         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 754         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 755 };
 756
 757 #ifdef CONFIG_PM
 758 /* policy for WoWLAN attributes */
 759 static const struct nla_policy
 760 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 761         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 762         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 763         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 764         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 765         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 766         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 767         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 768         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 769         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 770         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 771 };
 772
 773 static const struct nla_policy
 774 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 775         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 776         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 777         [NL80211_WOWLAN_TCP_DST_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 778         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 779         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 780         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
 781         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 782                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 783         },
 784         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 785                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 786         },
 787         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 788         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
 789         [NL80211_WOWLAN_TCP_WAKE_MASK] = NLA_POLICY_MIN_LEN(1),
 790 };
 791 #endif /* CONFIG_PM */
 792
 793 /* policy for coalesce rule attributes */
 794 static const struct nla_policy
 795 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 796         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 797         [NL80211_ATTR_COALESCE_RULE_CONDITION] =
 798                 NLA_POLICY_RANGE(NLA_U32,
 799                                  NL80211_COALESCE_CONDITION_MATCH,
 800                                  NL80211_COALESCE_CONDITION_NO_MATCH),
 801         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 802 };
 803
 804 /* policy for GTK rekey offload attributes */
 805 static const struct nla_policy
 806 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 807         [NL80211_REKEY_DATA_KEK] = {
 808                 .type = NLA_BINARY,
 809                 .len = NL80211_KEK_EXT_LEN
 810         },
 811         [NL80211_REKEY_DATA_KCK] = {
 812                 .type = NLA_BINARY,
 813                 .len = NL80211_KCK_EXT_LEN
 814         },
 815         [NL80211_REKEY_DATA_REPLAY_CTR] = NLA_POLICY_EXACT_LEN(NL80211_REPLAY_CTR_LEN),
 816         [NL80211_REKEY_DATA_AKM] = { .type = NLA_U32 },
 817 };
 818
 819 static const struct nla_policy
 820 nl80211_match_band_rssi_policy[NUM_NL80211_BANDS] = {
 821         [NL80211_BAND_2GHZ] = { .type = NLA_S32 },
 822         [NL80211_BAND_5GHZ] = { .type = NLA_S32 },
 823         [NL80211_BAND_6GHZ] = { .type = NLA_S32 },
 824         [NL80211_BAND_60GHZ] = { .type = NLA_S32 },
 825 };
 826
 827 static const struct nla_policy
 828 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 829         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 830                                                  .len = IEEE80211_MAX_SSID_LEN },
 831         [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 832         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 833         [NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI] =
 834                 NLA_POLICY_NESTED(nl80211_match_band_rssi_policy),
 835 };
 836
 837 static const struct nla_policy
 838 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 839         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 840         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 841 };
 842
 843 static const struct nla_policy
 844 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 845         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 846         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 847         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 848                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 849         },
 850 };
 851
 852 /* policy for NAN function attributes */
 853 static const struct nla_policy
 854 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 855         [NL80211_NAN_FUNC_TYPE] =
 856                 NLA_POLICY_MAX(NLA_U8, NL80211_NAN_FUNC_MAX_TYPE),
 857         [NL80211_NAN_FUNC_SERVICE_ID] = {
 858                                     .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 859         [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 860         [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 861         [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 862         [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 863         [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 864         [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 865         [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 866         [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 867         [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 868                         .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 869         [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 870         [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 871         [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 872         [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 873         [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 874 };
 875
 876 /* policy for Service Response Filter attributes */
 877 static const struct nla_policy
 878 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 879         [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 880         [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 881                                  .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 882         [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 883         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 884 };
 885
 886 /* policy for packet pattern attributes */
 887 static const struct nla_policy
 888 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
 889         [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
 890         [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
 891         [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
 892 };
 893
 894 int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
 895                               struct cfg80211_registered_device **rdev,
 896                               struct wireless_dev **wdev)
 897 {
 898         int err;
 899
 900         if (!cb->args[0]) {
 901                 struct nlattr **attrbuf;
 902
 903                 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
 904                                   GFP_KERNEL);
 905                 if (!attrbuf)
 906                         return -ENOMEM;
 907
 908                 err = nlmsg_parse_deprecated(cb->nlh,
 909                                              GENL_HDRLEN + nl80211_fam.hdrsize,
 910                                              attrbuf, nl80211_fam.maxattr,
 911                                              nl80211_policy, NULL);
 912                 if (err) {
 913                         kfree(attrbuf);
 914                         return err;
 915                 }
 916
 917                 *wdev = __cfg80211_wdev_from_attrs(sock_net(cb->skb->sk),
 918                                                    attrbuf);
 919                 kfree(attrbuf);
 920                 if (IS_ERR(*wdev))
 921                         return PTR_ERR(*wdev);
 922                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 923                 /* 0 is the first index - add 1 to parse only once */
 924                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 925                 cb->args[1] = (*wdev)->identifier;
 926         } else {
 927                 /* subtract the 1 again here */
 928                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 929                 struct wireless_dev *tmp;
 930
 931                 if (!wiphy)
 932                         return -ENODEV;
 933                 *rdev = wiphy_to_rdev(wiphy);
 934                 *wdev = NULL;
 935
 936                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
 937                         if (tmp->identifier == cb->args[1]) {
 938                                 *wdev = tmp;
 939                                 break;
 940                         }
 941                 }
 942
 943                 if (!*wdev)
 944                         return -ENODEV;
 945         }
 946
 947         return 0;
 948 }
 949
 950 /* message building helper */
 951 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 952                      int flags, u8 cmd)
 953 {
 954         /* since there is no private header just add the generic one */
 955         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 956 }
 957
 958 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
 959                                      const struct ieee80211_reg_rule *rule)
 960 {
 961         int j;
 962         struct nlattr *nl_wmm_rules =
 963                 nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM);
 964
 965         if (!nl_wmm_rules)
 966                 goto nla_put_failure;
 967
 968         for (j = 0; j < IEEE80211_NUM_ACS; j++) {
 969                 struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j);
 970
 971                 if (!nl_wmm_rule)
 972                         goto nla_put_failure;
 973
 974                 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
 975                                 rule->wmm_rule.client[j].cw_min) ||
 976                     nla_put_u16(msg, NL80211_WMMR_CW_MAX,
 977                                 rule->wmm_rule.client[j].cw_max) ||
 978                     nla_put_u8(msg, NL80211_WMMR_AIFSN,
 979                                rule->wmm_rule.client[j].aifsn) ||
 980                     nla_put_u16(msg, NL80211_WMMR_TXOP,
 981                                 rule->wmm_rule.client[j].cot))
 982                         goto nla_put_failure;
 983
 984                 nla_nest_end(msg, nl_wmm_rule);
 985         }
 986         nla_nest_end(msg, nl_wmm_rules);
 987
 988         return 0;
 989
 990 nla_put_failure:
 991         return -ENOBUFS;
 992 }
 993
 994 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
 995                                    struct ieee80211_channel *chan,
 996                                    bool large)
 997 {
 998         /* Some channels must be completely excluded from the
 999          * list to protect old user-space tools from breaking
1000          */
1001         if (!large && chan->flags &
1002             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
1003                 return 0;
1004         if (!large && chan->freq_offset)
1005                 return 0;
1006
1007         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
1008                         chan->center_freq))
1009                 goto nla_put_failure;
1010
1011         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_OFFSET, chan->freq_offset))
1012                 goto nla_put_failure;
1013
1014         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
1015             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
1016                 goto nla_put_failure;
1017         if (chan->flags & IEEE80211_CHAN_NO_IR) {
1018                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
1019                         goto nla_put_failure;
1020                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
1021                         goto nla_put_failure;
1022         }
1023         if (chan->flags & IEEE80211_CHAN_RADAR) {
1024                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
1025                         goto nla_put_failure;
1026                 if (large) {
1027                         u32 time;
1028
1029                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
1030
1031                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
1032                                         chan->dfs_state))
1033                                 goto nla_put_failure;
1034                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
1035                                         time))
1036                                 goto nla_put_failure;
1037                         if (nla_put_u32(msg,
1038                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
1039                                         chan->dfs_cac_ms))
1040                                 goto nla_put_failure;
1041                 }
1042         }
1043
1044         if (large) {
1045                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
1046                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
1047                         goto nla_put_failure;
1048                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
1049                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
1050                         goto nla_put_failure;
1051                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
1052                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
1053                         goto nla_put_failure;
1054                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
1055                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
1056                         goto nla_put_failure;
1057                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
1058                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
1059                         goto nla_put_failure;
1060                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
1061                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
1062                         goto nla_put_failure;
1063                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
1064                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
1065                         goto nla_put_failure;
1066                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
1067                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
1068                         goto nla_put_failure;
1069                 if ((chan->flags & IEEE80211_CHAN_NO_HE) &&
1070                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HE))
1071                         goto nla_put_failure;
1072                 if ((chan->flags & IEEE80211_CHAN_1MHZ) &&
1073                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_1MHZ))
1074                         goto nla_put_failure;
1075                 if ((chan->flags & IEEE80211_CHAN_2MHZ) &&
1076                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_2MHZ))
1077                         goto nla_put_failure;
1078                 if ((chan->flags & IEEE80211_CHAN_4MHZ) &&
1079                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_4MHZ))
1080                         goto nla_put_failure;
1081                 if ((chan->flags & IEEE80211_CHAN_8MHZ) &&
1082                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_8MHZ))
1083                         goto nla_put_failure;
1084                 if ((chan->flags & IEEE80211_CHAN_16MHZ) &&
1085                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_16MHZ))
1086                         goto nla_put_failure;
1087         }
1088
1089         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
1090                         DBM_TO_MBM(chan->max_power)))
1091                 goto nla_put_failure;
1092
1093         if (large) {
1094                 const struct ieee80211_reg_rule *rule =
1095                         freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
1096
1097                 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
1098                         if (nl80211_msg_put_wmm_rules(msg, rule))
1099                                 goto nla_put_failure;
1100                 }
1101         }
1102
1103         return 0;
1104
1105  nla_put_failure:
1106         return -ENOBUFS;
1107 }
1108
1109 static bool nl80211_put_txq_stats(struct sk_buff *msg,
1110                                   struct cfg80211_txq_stats *txqstats,
1111                                   int attrtype)
1112 {
1113         struct nlattr *txqattr;
1114
1115 #define PUT_TXQVAL_U32(attr, memb) do {                                   \
1116         if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) &&         \
1117             nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
1118                 return false;                                             \
1119         } while (0)
1120
1121         txqattr = nla_nest_start_noflag(msg, attrtype);
1122         if (!txqattr)
1123                 return false;
1124
1125         PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
1126         PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
1127         PUT_TXQVAL_U32(FLOWS, flows);
1128         PUT_TXQVAL_U32(DROPS, drops);
1129         PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
1130         PUT_TXQVAL_U32(OVERLIMIT, overlimit);
1131         PUT_TXQVAL_U32(OVERMEMORY, overmemory);
1132         PUT_TXQVAL_U32(COLLISIONS, collisions);
1133         PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
1134         PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
1135         PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
1136         nla_nest_end(msg, txqattr);
1137
1138 #undef PUT_TXQVAL_U32
1139         return true;
1140 }
1141
1142 /* netlink command implementations */
1143
1144 struct key_parse {
1145         struct key_params p;
1146         int idx;
1147         int type;
1148         bool def, defmgmt, defbeacon;
1149         bool def_uni, def_multi;
1150 };
1151
1152 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
1153                                  struct key_parse *k)
1154 {
1155         struct nlattr *tb[NL80211_KEY_MAX + 1];
1156         int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key,
1157                                               nl80211_key_policy,
1158                                               info->extack);
1159         if (err)
1160                 return err;
1161
1162         k->def = !!tb[NL80211_KEY_DEFAULT];
1163         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
1164         k->defbeacon = !!tb[NL80211_KEY_DEFAULT_BEACON];
1165
1166         if (k->def) {
1167                 k->def_uni = true;
1168                 k->def_multi = true;
1169         }
1170         if (k->defmgmt || k->defbeacon)
1171                 k->def_multi = true;
1172
1173         if (tb[NL80211_KEY_IDX])
1174                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
1175
1176         if (tb[NL80211_KEY_DATA]) {
1177                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
1178                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
1179         }
1180
1181         if (tb[NL80211_KEY_SEQ]) {
1182                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
1183                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
1184         }
1185
1186         if (tb[NL80211_KEY_CIPHER])
1187                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
1188
1189         if (tb[NL80211_KEY_TYPE])
1190                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
1191
1192         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
1193                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1194
1195                 err = nla_parse_nested_deprecated(kdt,
1196                                                   NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1197                                                   tb[NL80211_KEY_DEFAULT_TYPES],
1198                                                   nl80211_key_default_policy,
1199                                                   info->extack);
1200                 if (err)
1201                         return err;
1202
1203                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1204                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1205         }
1206
1207         if (tb[NL80211_KEY_MODE])
1208                 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
1209
1210         return 0;
1211 }
1212
1213 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
1214 {
1215         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1216                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1217                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1218         }
1219
1220         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1221                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1222                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1223         }
1224
1225         if (info->attrs[NL80211_ATTR_KEY_IDX])
1226                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1227
1228         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
1229                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1230
1231         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
1232         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
1233
1234         if (k->def) {
1235                 k->def_uni = true;
1236                 k->def_multi = true;
1237         }
1238         if (k->defmgmt)
1239                 k->def_multi = true;
1240
1241         if (info->attrs[NL80211_ATTR_KEY_TYPE])
1242                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1243
1244         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
1245                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1246                 int err = nla_parse_nested_deprecated(kdt,
1247                                                       NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1248                                                       info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
1249                                                       nl80211_key_default_policy,
1250                                                       info->extack);
1251                 if (err)
1252                         return err;
1253
1254                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1255                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1256         }
1257
1258         return 0;
1259 }
1260
1261 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
1262 {
1263         int err;
1264
1265         memset(k, 0, sizeof(*k));
1266         k->idx = -1;
1267         k->type = -1;
1268
1269         if (info->attrs[NL80211_ATTR_KEY])
1270                 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
1271         else
1272                 err = nl80211_parse_key_old(info, k);
1273
1274         if (err)
1275                 return err;
1276
1277         if ((k->def ? 1 : 0) + (k->defmgmt ? 1 : 0) +
1278             (k->defbeacon ? 1 : 0) > 1) {
1279                 GENL_SET_ERR_MSG(info,
1280                                  "key with multiple default flags is invalid");
1281                 return -EINVAL;
1282         }
1283
1284         if (k->defmgmt || k->defbeacon) {
1285                 if (k->def_uni || !k->def_multi) {
1286                         GENL_SET_ERR_MSG(info,
1287                                          "defmgmt/defbeacon key must be mcast");
1288                         return -EINVAL;
1289                 }
1290         }
1291
1292         if (k->idx != -1) {
1293                 if (k->defmgmt) {
1294                         if (k->idx < 4 || k->idx > 5) {
1295                                 GENL_SET_ERR_MSG(info,
1296                                                  "defmgmt key idx not 4 or 5");
1297                                 return -EINVAL;
1298                         }
1299                 } else if (k->defbeacon) {
1300                         if (k->idx < 6 || k->idx > 7) {
1301                                 GENL_SET_ERR_MSG(info,
1302                                                  "defbeacon key idx not 6 or 7");
1303                                 return -EINVAL;
1304                         }
1305                 } else if (k->def) {
1306                         if (k->idx < 0 || k->idx > 3) {
1307                                 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1308                                 return -EINVAL;
1309                         }
1310                 } else {
1311                         if (k->idx < 0 || k->idx > 7) {
1312                                 GENL_SET_ERR_MSG(info, "key idx not 0-7");
1313                                 return -EINVAL;
1314                         }
1315                 }
1316         }
1317
1318         return 0;
1319 }
1320
1321 static struct cfg80211_cached_keys *
1322 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1323                        struct genl_info *info, bool *no_ht)
1324 {
1325         struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1326         struct key_parse parse;
1327         struct nlattr *key;
1328         struct cfg80211_cached_keys *result;
1329         int rem, err, def = 0;
1330         bool have_key = false;
1331
1332         nla_for_each_nested(key, keys, rem) {
1333                 have_key = true;
1334                 break;
1335         }
1336
1337         if (!have_key)
1338                 return NULL;
1339
1340         result = kzalloc(sizeof(*result), GFP_KERNEL);
1341         if (!result)
1342                 return ERR_PTR(-ENOMEM);
1343
1344         result->def = -1;
1345
1346         nla_for_each_nested(key, keys, rem) {
1347                 memset(&parse, 0, sizeof(parse));
1348                 parse.idx = -1;
1349
1350                 err = nl80211_parse_key_new(info, key, &parse);
1351                 if (err)
1352                         goto error;
1353                 err = -EINVAL;
1354                 if (!parse.p.key)
1355                         goto error;
1356                 if (parse.idx < 0 || parse.idx > 3) {
1357                         GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1358                         goto error;
1359                 }
1360                 if (parse.def) {
1361                         if (def) {
1362                                 GENL_SET_ERR_MSG(info,
1363                                                  "only one key can be default");
1364                                 goto error;
1365                         }
1366                         def = 1;
1367                         result->def = parse.idx;
1368                         if (!parse.def_uni || !parse.def_multi)
1369                                 goto error;
1370                 } else if (parse.defmgmt)
1371                         goto error;
1372                 err = cfg80211_validate_key_settings(rdev, &parse.p,
1373                                                      parse.idx, false, NULL);
1374                 if (err)
1375                         goto error;
1376                 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1377                     parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1378                         GENL_SET_ERR_MSG(info, "connect key must be WEP");
1379                         err = -EINVAL;
1380                         goto error;
1381                 }
1382                 result->params[parse.idx].cipher = parse.p.cipher;
1383                 result->params[parse.idx].key_len = parse.p.key_len;
1384                 result->params[parse.idx].key = result->data[parse.idx];
1385                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1386
1387                 /* must be WEP key if we got here */
1388                 if (no_ht)
1389                         *no_ht = true;
1390         }
1391
1392         if (result->def < 0) {
1393                 err = -EINVAL;
1394                 GENL_SET_ERR_MSG(info, "need a default/TX key");
1395                 goto error;
1396         }
1397
1398         return result;
1399  error:
1400         kfree(result);
1401         return ERR_PTR(err);
1402 }
1403
1404 static int nl80211_key_allowed(struct wireless_dev *wdev)
1405 {
1406         ASSERT_WDEV_LOCK(wdev);
1407
1408         switch (wdev->iftype) {
1409         case NL80211_IFTYPE_AP:
1410         case NL80211_IFTYPE_AP_VLAN:
1411         case NL80211_IFTYPE_P2P_GO:
1412         case NL80211_IFTYPE_MESH_POINT:
1413                 break;
1414         case NL80211_IFTYPE_ADHOC:
1415         case NL80211_IFTYPE_STATION:
1416         case NL80211_IFTYPE_P2P_CLIENT:
1417                 if (!wdev->current_bss)
1418                         return -ENOLINK;
1419                 break;
1420         case NL80211_IFTYPE_UNSPECIFIED:
1421         case NL80211_IFTYPE_OCB:
1422         case NL80211_IFTYPE_MONITOR:
1423         case NL80211_IFTYPE_NAN:
1424         case NL80211_IFTYPE_P2P_DEVICE:
1425         case NL80211_IFTYPE_WDS:
1426         case NUM_NL80211_IFTYPES:
1427                 return -EINVAL;
1428         }
1429
1430         return 0;
1431 }
1432
1433 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1434                                                         u32 freq)
1435 {
1436         struct ieee80211_channel *chan;
1437
1438         chan = ieee80211_get_channel_khz(wiphy, freq);
1439         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1440                 return NULL;
1441         return chan;
1442 }
1443
1444 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1445 {
1446         struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr);
1447         int i;
1448
1449         if (!nl_modes)
1450                 goto nla_put_failure;
1451
1452         i = 0;
1453         while (ifmodes) {
1454                 if ((ifmodes & 1) && nla_put_flag(msg, i))
1455                         goto nla_put_failure;
1456                 ifmodes >>= 1;
1457                 i++;
1458         }
1459
1460         nla_nest_end(msg, nl_modes);
1461         return 0;
1462
1463 nla_put_failure:
1464         return -ENOBUFS;
1465 }
1466
1467 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1468                                           struct sk_buff *msg,
1469                                           bool large)
1470 {
1471         struct nlattr *nl_combis;
1472         int i, j;
1473
1474         nl_combis = nla_nest_start_noflag(msg,
1475                                           NL80211_ATTR_INTERFACE_COMBINATIONS);
1476         if (!nl_combis)
1477                 goto nla_put_failure;
1478
1479         for (i = 0; i < wiphy->n_iface_combinations; i++) {
1480                 const struct ieee80211_iface_combination *c;
1481                 struct nlattr *nl_combi, *nl_limits;
1482
1483                 c = &wiphy->iface_combinations[i];
1484
1485                 nl_combi = nla_nest_start_noflag(msg, i + 1);
1486                 if (!nl_combi)
1487                         goto nla_put_failure;
1488
1489                 nl_limits = nla_nest_start_noflag(msg,
1490                                                   NL80211_IFACE_COMB_LIMITS);
1491                 if (!nl_limits)
1492                         goto nla_put_failure;
1493
1494                 for (j = 0; j < c->n_limits; j++) {
1495                         struct nlattr *nl_limit;
1496
1497                         nl_limit = nla_nest_start_noflag(msg, j + 1);
1498                         if (!nl_limit)
1499                                 goto nla_put_failure;
1500                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1501                                         c->limits[j].max))
1502                                 goto nla_put_failure;
1503                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1504                                                 c->limits[j].types))
1505                                 goto nla_put_failure;
1506                         nla_nest_end(msg, nl_limit);
1507                 }
1508
1509                 nla_nest_end(msg, nl_limits);
1510
1511                 if (c->beacon_int_infra_match &&
1512                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1513                         goto nla_put_failure;
1514                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1515                                 c->num_different_channels) ||
1516                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1517                                 c->max_interfaces))
1518                         goto nla_put_failure;
1519                 if (large &&
1520                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1521                                 c->radar_detect_widths) ||
1522                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1523                                 c->radar_detect_regions)))
1524                         goto nla_put_failure;
1525                 if (c->beacon_int_min_gcd &&
1526                     nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1527                                 c->beacon_int_min_gcd))
1528                         goto nla_put_failure;
1529
1530                 nla_nest_end(msg, nl_combi);
1531         }
1532
1533         nla_nest_end(msg, nl_combis);
1534
1535         return 0;
1536 nla_put_failure:
1537         return -ENOBUFS;
1538 }
1539
1540 #ifdef CONFIG_PM
1541 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1542                                         struct sk_buff *msg)
1543 {
1544         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1545         struct nlattr *nl_tcp;
1546
1547         if (!tcp)
1548                 return 0;
1549
1550         nl_tcp = nla_nest_start_noflag(msg,
1551                                        NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1552         if (!nl_tcp)
1553                 return -ENOBUFS;
1554
1555         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1556                         tcp->data_payload_max))
1557                 return -ENOBUFS;
1558
1559         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1560                         tcp->data_payload_max))
1561                 return -ENOBUFS;
1562
1563         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1564                 return -ENOBUFS;
1565
1566         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1567                                 sizeof(*tcp->tok), tcp->tok))
1568                 return -ENOBUFS;
1569
1570         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1571                         tcp->data_interval_max))
1572                 return -ENOBUFS;
1573
1574         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1575                         tcp->wake_payload_max))
1576                 return -ENOBUFS;
1577
1578         nla_nest_end(msg, nl_tcp);
1579         return 0;
1580 }
1581
1582 static int nl80211_send_wowlan(struct sk_buff *msg,
1583                                struct cfg80211_registered_device *rdev,
1584                                bool large)
1585 {
1586         struct nlattr *nl_wowlan;
1587
1588         if (!rdev->wiphy.wowlan)
1589                 return 0;
1590
1591         nl_wowlan = nla_nest_start_noflag(msg,
1592                                           NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1593         if (!nl_wowlan)
1594                 return -ENOBUFS;
1595
1596         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1597              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1598             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1599              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1600             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1601              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1602             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1603              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1604             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1605              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1606             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1607              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1608             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1609              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1610             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1611              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1612                 return -ENOBUFS;
1613
1614         if (rdev->wiphy.wowlan->n_patterns) {
1615                 struct nl80211_pattern_support pat = {
1616                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1617                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1618                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1619                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1620                 };
1621
1622                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1623                             sizeof(pat), &pat))
1624                         return -ENOBUFS;
1625         }
1626
1627         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1628             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1629                         rdev->wiphy.wowlan->max_nd_match_sets))
1630                 return -ENOBUFS;
1631
1632         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1633                 return -ENOBUFS;
1634
1635         nla_nest_end(msg, nl_wowlan);
1636
1637         return 0;
1638 }
1639 #endif
1640
1641 static int nl80211_send_coalesce(struct sk_buff *msg,
1642                                  struct cfg80211_registered_device *rdev)
1643 {
1644         struct nl80211_coalesce_rule_support rule;
1645
1646         if (!rdev->wiphy.coalesce)
1647                 return 0;
1648
1649         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1650         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1651         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1652         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1653         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1654         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1655
1656         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1657                 return -ENOBUFS;
1658
1659         return 0;
1660 }
1661
1662 static int
1663 nl80211_send_iftype_data(struct sk_buff *msg,
1664                          const struct ieee80211_supported_band *sband,
1665                          const struct ieee80211_sband_iftype_data *iftdata)
1666 {
1667         const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1668
1669         if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1670                                 iftdata->types_mask))
1671                 return -ENOBUFS;
1672
1673         if (he_cap->has_he) {
1674                 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1675                             sizeof(he_cap->he_cap_elem.mac_cap_info),
1676                             he_cap->he_cap_elem.mac_cap_info) ||
1677                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1678                             sizeof(he_cap->he_cap_elem.phy_cap_info),
1679                             he_cap->he_cap_elem.phy_cap_info) ||
1680                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1681                             sizeof(he_cap->he_mcs_nss_supp),
1682                             &he_cap->he_mcs_nss_supp) ||
1683                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1684                             sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1685                         return -ENOBUFS;
1686         }
1687
1688         if (sband->band == NL80211_BAND_6GHZ &&
1689             nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA,
1690                     sizeof(iftdata->he_6ghz_capa),
1691                     &iftdata->he_6ghz_capa))
1692                 return -ENOBUFS;
1693
1694         return 0;
1695 }
1696
1697 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1698                                       struct ieee80211_supported_band *sband,
1699                                       bool large)
1700 {
1701         struct nlattr *nl_rates, *nl_rate;
1702         struct ieee80211_rate *rate;
1703         int i;
1704
1705         /* add HT info */
1706         if (sband->ht_cap.ht_supported &&
1707             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1708                      sizeof(sband->ht_cap.mcs),
1709                      &sband->ht_cap.mcs) ||
1710              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1711                          sband->ht_cap.cap) ||
1712              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1713                         sband->ht_cap.ampdu_factor) ||
1714              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1715                         sband->ht_cap.ampdu_density)))
1716                 return -ENOBUFS;
1717
1718         /* add VHT info */
1719         if (sband->vht_cap.vht_supported &&
1720             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1721                      sizeof(sband->vht_cap.vht_mcs),
1722                      &sband->vht_cap.vht_mcs) ||
1723              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1724                          sband->vht_cap.cap)))
1725                 return -ENOBUFS;
1726
1727         if (large && sband->n_iftype_data) {
1728                 struct nlattr *nl_iftype_data =
1729                         nla_nest_start_noflag(msg,
1730                                               NL80211_BAND_ATTR_IFTYPE_DATA);
1731                 int err;
1732
1733                 if (!nl_iftype_data)
1734                         return -ENOBUFS;
1735
1736                 for (i = 0; i < sband->n_iftype_data; i++) {
1737                         struct nlattr *iftdata;
1738
1739                         iftdata = nla_nest_start_noflag(msg, i + 1);
1740                         if (!iftdata)
1741                                 return -ENOBUFS;
1742
1743                         err = nl80211_send_iftype_data(msg, sband,
1744                                                        &sband->iftype_data[i]);
1745                         if (err)
1746                                 return err;
1747
1748                         nla_nest_end(msg, iftdata);
1749                 }
1750
1751                 nla_nest_end(msg, nl_iftype_data);
1752         }
1753
1754         /* add EDMG info */
1755         if (large && sband->edmg_cap.channels &&
1756             (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS,
1757                        sband->edmg_cap.channels) ||
1758             nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG,
1759                        sband->edmg_cap.bw_config)))
1760
1761                 return -ENOBUFS;
1762
1763         /* add bitrates */
1764         nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES);
1765         if (!nl_rates)
1766                 return -ENOBUFS;
1767
1768         for (i = 0; i < sband->n_bitrates; i++) {
1769                 nl_rate = nla_nest_start_noflag(msg, i);
1770                 if (!nl_rate)
1771                         return -ENOBUFS;
1772
1773                 rate = &sband->bitrates[i];
1774                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1775                                 rate->bitrate))
1776                         return -ENOBUFS;
1777                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1778                     nla_put_flag(msg,
1779                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1780                         return -ENOBUFS;
1781
1782                 nla_nest_end(msg, nl_rate);
1783         }
1784
1785         nla_nest_end(msg, nl_rates);
1786
1787         return 0;
1788 }
1789
1790 static int
1791 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1792                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1793 {
1794         u16 stypes;
1795         struct nlattr *nl_ftypes, *nl_ifs;
1796         enum nl80211_iftype ift;
1797         int i;
1798
1799         if (!mgmt_stypes)
1800                 return 0;
1801
1802         nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES);
1803         if (!nl_ifs)
1804                 return -ENOBUFS;
1805
1806         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1807                 nl_ftypes = nla_nest_start_noflag(msg, ift);
1808                 if (!nl_ftypes)
1809                         return -ENOBUFS;
1810                 i = 0;
1811                 stypes = mgmt_stypes[ift].tx;
1812                 while (stypes) {
1813                         if ((stypes & 1) &&
1814                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1815                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1816                                 return -ENOBUFS;
1817                         stypes >>= 1;
1818                         i++;
1819                 }
1820                 nla_nest_end(msg, nl_ftypes);
1821         }
1822
1823         nla_nest_end(msg, nl_ifs);
1824
1825         nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES);
1826         if (!nl_ifs)
1827                 return -ENOBUFS;
1828
1829         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1830                 nl_ftypes = nla_nest_start_noflag(msg, ift);
1831                 if (!nl_ftypes)
1832                         return -ENOBUFS;
1833                 i = 0;
1834                 stypes = mgmt_stypes[ift].rx;
1835                 while (stypes) {
1836                         if ((stypes & 1) &&
1837                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1838                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1839                                 return -ENOBUFS;
1840                         stypes >>= 1;
1841                         i++;
1842                 }
1843                 nla_nest_end(msg, nl_ftypes);
1844         }
1845         nla_nest_end(msg, nl_ifs);
1846
1847         return 0;
1848 }
1849
1850 #define CMD(op, n)                                                      \
1851          do {                                                           \
1852                 if (rdev->ops->op) {                                    \
1853                         i++;                                            \
1854                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n))     \
1855                                 goto nla_put_failure;                   \
1856                 }                                                       \
1857         } while (0)
1858
1859 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
1860                                         struct sk_buff *msg)
1861 {
1862         int i = 0;
1863
1864         /*
1865          * do *NOT* add anything into this function, new things need to be
1866          * advertised only to new versions of userspace that can deal with
1867          * the split (and they can't possibly care about new features...
1868          */
1869         CMD(add_virtual_intf, NEW_INTERFACE);
1870         CMD(change_virtual_intf, SET_INTERFACE);
1871         CMD(add_key, NEW_KEY);
1872         CMD(start_ap, START_AP);
1873         CMD(add_station, NEW_STATION);
1874         CMD(add_mpath, NEW_MPATH);
1875         CMD(update_mesh_config, SET_MESH_CONFIG);
1876         CMD(change_bss, SET_BSS);
1877         CMD(auth, AUTHENTICATE);
1878         CMD(assoc, ASSOCIATE);
1879         CMD(deauth, DEAUTHENTICATE);
1880         CMD(disassoc, DISASSOCIATE);
1881         CMD(join_ibss, JOIN_IBSS);
1882         CMD(join_mesh, JOIN_MESH);
1883         CMD(set_pmksa, SET_PMKSA);
1884         CMD(del_pmksa, DEL_PMKSA);
1885         CMD(flush_pmksa, FLUSH_PMKSA);
1886         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1887                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1888         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1889         CMD(mgmt_tx, FRAME);
1890         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1891         if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1892                 i++;
1893                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1894                         goto nla_put_failure;
1895         }
1896         if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1897             rdev->ops->join_mesh) {
1898                 i++;
1899                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1900                         goto nla_put_failure;
1901         }
1902         if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1903                 CMD(tdls_mgmt, TDLS_MGMT);
1904                 CMD(tdls_oper, TDLS_OPER);
1905         }
1906         if (rdev->wiphy.max_sched_scan_reqs)
1907                 CMD(sched_scan_start, START_SCHED_SCAN);
1908         CMD(probe_client, PROBE_CLIENT);
1909         CMD(set_noack_map, SET_NOACK_MAP);
1910         if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1911                 i++;
1912                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1913                         goto nla_put_failure;
1914         }
1915         CMD(start_p2p_device, START_P2P_DEVICE);
1916         CMD(set_mcast_rate, SET_MCAST_RATE);
1917 #ifdef CONFIG_NL80211_TESTMODE
1918         CMD(testmode_cmd, TESTMODE);
1919 #endif
1920
1921         if (rdev->ops->connect || rdev->ops->auth) {
1922                 i++;
1923                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1924                         goto nla_put_failure;
1925         }
1926
1927         if (rdev->ops->disconnect || rdev->ops->deauth) {
1928                 i++;
1929                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1930                         goto nla_put_failure;
1931         }
1932
1933         return i;
1934  nla_put_failure:
1935         return -ENOBUFS;
1936 }
1937
1938 static int
1939 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
1940                            struct sk_buff *msg)
1941 {
1942         struct nlattr *ftm;
1943
1944         if (!cap->ftm.supported)
1945                 return 0;
1946
1947         ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM);
1948         if (!ftm)
1949                 return -ENOBUFS;
1950
1951         if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
1952                 return -ENOBUFS;
1953         if (cap->ftm.non_asap &&
1954             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
1955                 return -ENOBUFS;
1956         if (cap->ftm.request_lci &&
1957             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
1958                 return -ENOBUFS;
1959         if (cap->ftm.request_civicloc &&
1960             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
1961                 return -ENOBUFS;
1962         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
1963                         cap->ftm.preambles))
1964                 return -ENOBUFS;
1965         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
1966                         cap->ftm.bandwidths))
1967                 return -ENOBUFS;
1968         if (cap->ftm.max_bursts_exponent >= 0 &&
1969             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
1970                         cap->ftm.max_bursts_exponent))
1971                 return -ENOBUFS;
1972         if (cap->ftm.max_ftms_per_burst &&
1973             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
1974                         cap->ftm.max_ftms_per_burst))
1975                 return -ENOBUFS;
1976         if (cap->ftm.trigger_based &&
1977             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED))
1978                 return -ENOBUFS;
1979         if (cap->ftm.non_trigger_based &&
1980             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED))
1981                 return -ENOBUFS;
1982
1983         nla_nest_end(msg, ftm);
1984         return 0;
1985 }
1986
1987 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
1988                                   struct sk_buff *msg)
1989 {
1990         const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
1991         struct nlattr *pmsr, *caps;
1992
1993         if (!cap)
1994                 return 0;
1995
1996         /*
1997          * we don't need to clean up anything here since the caller
1998          * will genlmsg_cancel() if we fail
1999          */
2000
2001         pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS);
2002         if (!pmsr)
2003                 return -ENOBUFS;
2004
2005         if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
2006                 return -ENOBUFS;
2007
2008         if (cap->report_ap_tsf &&
2009             nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
2010                 return -ENOBUFS;
2011
2012         if (cap->randomize_mac_addr &&
2013             nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
2014                 return -ENOBUFS;
2015
2016         caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
2017         if (!caps)
2018                 return -ENOBUFS;
2019
2020         if (nl80211_send_pmsr_ftm_capa(cap, msg))
2021                 return -ENOBUFS;
2022
2023         nla_nest_end(msg, caps);
2024         nla_nest_end(msg, pmsr);
2025
2026         return 0;
2027 }
2028
2029 static int
2030 nl80211_put_iftype_akm_suites(struct cfg80211_registered_device *rdev,
2031                               struct sk_buff *msg)
2032 {
2033         int i;
2034         struct nlattr *nested, *nested_akms;
2035         const struct wiphy_iftype_akm_suites *iftype_akms;
2036
2037         if (!rdev->wiphy.num_iftype_akm_suites ||
2038             !rdev->wiphy.iftype_akm_suites)
2039                 return 0;
2040
2041         nested = nla_nest_start(msg, NL80211_ATTR_IFTYPE_AKM_SUITES);
2042         if (!nested)
2043                 return -ENOBUFS;
2044
2045         for (i = 0; i < rdev->wiphy.num_iftype_akm_suites; i++) {
2046                 nested_akms = nla_nest_start(msg, i + 1);
2047                 if (!nested_akms)
2048                         return -ENOBUFS;
2049
2050                 iftype_akms = &rdev->wiphy.iftype_akm_suites[i];
2051
2052                 if (nl80211_put_iftypes(msg, NL80211_IFTYPE_AKM_ATTR_IFTYPES,
2053                                         iftype_akms->iftypes_mask))
2054                         return -ENOBUFS;
2055
2056                 if (nla_put(msg, NL80211_IFTYPE_AKM_ATTR_SUITES,
2057                             sizeof(u32) * iftype_akms->n_akm_suites,
2058                             iftype_akms->akm_suites)) {
2059                         return -ENOBUFS;
2060                 }
2061                 nla_nest_end(msg, nested_akms);
2062         }
2063
2064         nla_nest_end(msg, nested);
2065
2066         return 0;
2067 }
2068
2069 static int
2070 nl80211_put_tid_config_support(struct cfg80211_registered_device *rdev,
2071                                struct sk_buff *msg)
2072 {
2073         struct nlattr *supp;
2074
2075         if (!rdev->wiphy.tid_config_support.vif &&
2076             !rdev->wiphy.tid_config_support.peer)
2077                 return 0;
2078
2079         supp = nla_nest_start(msg, NL80211_ATTR_TID_CONFIG);
2080         if (!supp)
2081                 return -ENOSPC;
2082
2083         if (rdev->wiphy.tid_config_support.vif &&
2084             nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_VIF_SUPP,
2085                               rdev->wiphy.tid_config_support.vif,
2086                               NL80211_TID_CONFIG_ATTR_PAD))
2087                 goto fail;
2088
2089         if (rdev->wiphy.tid_config_support.peer &&
2090             nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_PEER_SUPP,
2091                               rdev->wiphy.tid_config_support.peer,
2092                               NL80211_TID_CONFIG_ATTR_PAD))
2093                 goto fail;
2094
2095         /* for now we just use the same value ... makes more sense */
2096         if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_SHORT,
2097                        rdev->wiphy.tid_config_support.max_retry))
2098                 goto fail;
2099         if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_LONG,
2100                        rdev->wiphy.tid_config_support.max_retry))
2101                 goto fail;
2102
2103         nla_nest_end(msg, supp);
2104
2105         return 0;
2106 fail:
2107         nla_nest_cancel(msg, supp);
2108         return -ENOBUFS;
2109 }
2110
2111 static int
2112 nl80211_put_sar_specs(struct cfg80211_registered_device *rdev,
2113                       struct sk_buff *msg)
2114 {
2115         struct nlattr *sar_capa, *specs, *sub_freq_range;
2116         u8 num_freq_ranges;
2117         int i;
2118
2119         if (!rdev->wiphy.sar_capa)
2120                 return 0;
2121
2122         num_freq_ranges = rdev->wiphy.sar_capa->num_freq_ranges;
2123
2124         sar_capa = nla_nest_start(msg, NL80211_ATTR_SAR_SPEC);
2125         if (!sar_capa)
2126                 return -ENOSPC;
2127
2128         if (nla_put_u32(msg, NL80211_SAR_ATTR_TYPE, rdev->wiphy.sar_capa->type))
2129                 goto fail;
2130
2131         specs = nla_nest_start(msg, NL80211_SAR_ATTR_SPECS);
2132         if (!specs)
2133                 goto fail;
2134
2135         /* report supported freq_ranges */
2136         for (i = 0; i < num_freq_ranges; i++) {
2137                 sub_freq_range = nla_nest_start(msg, i + 1);
2138                 if (!sub_freq_range)
2139                         goto fail;
2140
2141                 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_START_FREQ,
2142                                 rdev->wiphy.sar_capa->freq_ranges[i].start_freq))
2143                         goto fail;
2144
2145                 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_END_FREQ,
2146                                 rdev->wiphy.sar_capa->freq_ranges[i].end_freq))
2147                         goto fail;
2148
2149                 nla_nest_end(msg, sub_freq_range);
2150         }
2151
2152         nla_nest_end(msg, specs);
2153         nla_nest_end(msg, sar_capa);
2154
2155         return 0;
2156 fail:
2157         nla_nest_cancel(msg, sar_capa);
2158         return -ENOBUFS;
2159 }
2160
2161 struct nl80211_dump_wiphy_state {
2162         s64 filter_wiphy;
2163         long start;
2164         long split_start, band_start, chan_start, capa_start;
2165         bool split;
2166 };
2167
2168 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
2169                               enum nl80211_commands cmd,
2170                               struct sk_buff *msg, u32 portid, u32 seq,
2171                               int flags, struct nl80211_dump_wiphy_state *state)
2172 {
2173         void *hdr;
2174         struct nlattr *nl_bands, *nl_band;
2175         struct nlattr *nl_freqs, *nl_freq;
2176         struct nlattr *nl_cmds;
2177         enum nl80211_band band;
2178         struct ieee80211_channel *chan;
2179         int i;
2180         const struct ieee80211_txrx_stypes *mgmt_stypes =
2181                                 rdev->wiphy.mgmt_stypes;
2182         u32 features;
2183
2184         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2185         if (!hdr)
2186                 return -ENOBUFS;
2187
2188         if (WARN_ON(!state))
2189                 return -EINVAL;
2190
2191         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2192             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
2193                            wiphy_name(&rdev->wiphy)) ||
2194             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2195                         cfg80211_rdev_list_generation))
2196                 goto nla_put_failure;
2197
2198         if (cmd != NL80211_CMD_NEW_WIPHY)
2199                 goto finish;
2200
2201         switch (state->split_start) {
2202         case 0:
2203                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
2204                                rdev->wiphy.retry_short) ||
2205                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
2206                                rdev->wiphy.retry_long) ||
2207                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
2208                                 rdev->wiphy.frag_threshold) ||
2209                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
2210                                 rdev->wiphy.rts_threshold) ||
2211                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
2212                                rdev->wiphy.coverage_class) ||
2213                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
2214                                rdev->wiphy.max_scan_ssids) ||
2215                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
2216                                rdev->wiphy.max_sched_scan_ssids) ||
2217                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
2218                                 rdev->wiphy.max_scan_ie_len) ||
2219                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
2220                                 rdev->wiphy.max_sched_scan_ie_len) ||
2221                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
2222                                rdev->wiphy.max_match_sets))
2223                         goto nla_put_failure;
2224
2225                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
2226                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
2227                         goto nla_put_failure;
2228                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
2229                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
2230                         goto nla_put_failure;
2231                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
2232                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
2233                         goto nla_put_failure;
2234                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
2235                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
2236                         goto nla_put_failure;
2237                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
2238                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
2239                         goto nla_put_failure;
2240                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
2241                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
2242                         goto nla_put_failure;
2243                 state->split_start++;
2244                 if (state->split)
2245                         break;
2246                 fallthrough;
2247         case 1:
2248                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
2249                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
2250                             rdev->wiphy.cipher_suites))
2251                         goto nla_put_failure;
2252
2253                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
2254                                rdev->wiphy.max_num_pmkids))
2255                         goto nla_put_failure;
2256
2257                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
2258                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
2259                         goto nla_put_failure;
2260
2261                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
2262                                 rdev->wiphy.available_antennas_tx) ||
2263                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
2264                                 rdev->wiphy.available_antennas_rx))
2265                         goto nla_put_failure;
2266
2267                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
2268                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
2269                                 rdev->wiphy.probe_resp_offload))
2270                         goto nla_put_failure;
2271
2272                 if ((rdev->wiphy.available_antennas_tx ||
2273                      rdev->wiphy.available_antennas_rx) &&
2274                     rdev->ops->get_antenna) {
2275                         u32 tx_ant = 0, rx_ant = 0;
2276                         int res;
2277
2278                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
2279                         if (!res) {
2280                                 if (nla_put_u32(msg,
2281                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
2282                                                 tx_ant) ||
2283                                     nla_put_u32(msg,
2284                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
2285                                                 rx_ant))
2286                                         goto nla_put_failure;
2287                         }
2288                 }
2289
2290                 state->split_start++;
2291                 if (state->split)
2292                         break;
2293                 fallthrough;
2294         case 2:
2295                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
2296                                         rdev->wiphy.interface_modes))
2297                                 goto nla_put_failure;
2298                 state->split_start++;
2299                 if (state->split)
2300                         break;
2301                 fallthrough;
2302         case 3:
2303                 nl_bands = nla_nest_start_noflag(msg,
2304                                                  NL80211_ATTR_WIPHY_BANDS);
2305                 if (!nl_bands)
2306                         goto nla_put_failure;
2307
2308                 for (band = state->band_start;
2309                      band < NUM_NL80211_BANDS; band++) {
2310                         struct ieee80211_supported_band *sband;
2311
2312                         /* omit higher bands for ancient software */
2313                         if (band > NL80211_BAND_5GHZ && !state->split)
2314                                 break;
2315
2316                         sband = rdev->wiphy.bands[band];
2317
2318                         if (!sband)
2319                                 continue;
2320
2321                         nl_band = nla_nest_start_noflag(msg, band);
2322                         if (!nl_band)
2323                                 goto nla_put_failure;
2324
2325                         switch (state->chan_start) {
2326                         case 0:
2327                                 if (nl80211_send_band_rateinfo(msg, sband,
2328                                                                state->split))
2329                                         goto nla_put_failure;
2330                                 state->chan_start++;
2331                                 if (state->split)
2332                                         break;
2333                                 fallthrough;
2334                         default:
2335                                 /* add frequencies */
2336                                 nl_freqs = nla_nest_start_noflag(msg,
2337                                                                  NL80211_BAND_ATTR_FREQS);
2338                                 if (!nl_freqs)
2339                                         goto nla_put_failure;
2340
2341                                 for (i = state->chan_start - 1;
2342                                      i < sband->n_channels;
2343                                      i++) {
2344                                         nl_freq = nla_nest_start_noflag(msg,
2345                                                                         i);
2346                                         if (!nl_freq)
2347                                                 goto nla_put_failure;
2348
2349                                         chan = &sband->channels[i];
2350
2351                                         if (nl80211_msg_put_channel(
2352                                                         msg, &rdev->wiphy, chan,
2353                                                         state->split))
2354                                                 goto nla_put_failure;
2355
2356                                         nla_nest_end(msg, nl_freq);
2357                                         if (state->split)
2358                                                 break;
2359                                 }
2360                                 if (i < sband->n_channels)
2361                                         state->chan_start = i + 2;
2362                                 else
2363                                         state->chan_start = 0;
2364                                 nla_nest_end(msg, nl_freqs);
2365                         }
2366
2367                         nla_nest_end(msg, nl_band);
2368
2369                         if (state->split) {
2370                                 /* start again here */
2371                                 if (state->chan_start)
2372                                         band--;
2373                                 break;
2374                         }
2375                 }
2376                 nla_nest_end(msg, nl_bands);
2377
2378                 if (band < NUM_NL80211_BANDS)
2379                         state->band_start = band + 1;
2380                 else
2381                         state->band_start = 0;
2382
2383                 /* if bands & channels are done, continue outside */
2384                 if (state->band_start == 0 && state->chan_start == 0)
2385                         state->split_start++;
2386                 if (state->split)
2387                         break;
2388                 fallthrough;
2389         case 4:
2390                 nl_cmds = nla_nest_start_noflag(msg,
2391                                                 NL80211_ATTR_SUPPORTED_COMMANDS);
2392                 if (!nl_cmds)
2393                         goto nla_put_failure;
2394
2395                 i = nl80211_add_commands_unsplit(rdev, msg);
2396                 if (i < 0)
2397                         goto nla_put_failure;
2398                 if (state->split) {
2399                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
2400                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
2401                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
2402                                 CMD(channel_switch, CHANNEL_SWITCH);
2403                         CMD(set_qos_map, SET_QOS_MAP);
2404                         if (rdev->wiphy.features &
2405                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
2406                                 CMD(add_tx_ts, ADD_TX_TS);
2407                         CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
2408                         CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
2409                         CMD(update_ft_ies, UPDATE_FT_IES);
2410                         if (rdev->wiphy.sar_capa)
2411                                 CMD(set_sar_specs, SET_SAR_SPECS);
2412                 }
2413 #undef CMD
2414
2415                 nla_nest_end(msg, nl_cmds);
2416                 state->split_start++;
2417                 if (state->split)
2418                         break;
2419                 fallthrough;
2420         case 5:
2421                 if (rdev->ops->remain_on_channel &&
2422                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
2423                     nla_put_u32(msg,
2424                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
2425                                 rdev->wiphy.max_remain_on_channel_duration))
2426                         goto nla_put_failure;
2427
2428                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
2429                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
2430                         goto nla_put_failure;
2431
2432                 state->split_start++;
2433                 if (state->split)
2434                         break;
2435                 fallthrough;
2436         case 6:
2437 #ifdef CONFIG_PM
2438                 if (nl80211_send_wowlan(msg, rdev, state->split))
2439                         goto nla_put_failure;
2440                 state->split_start++;
2441                 if (state->split)
2442                         break;
2443 #else
2444                 state->split_start++;
2445 #endif
2446                 fallthrough;
2447         case 7:
2448                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
2449                                         rdev->wiphy.software_iftypes))
2450                         goto nla_put_failure;
2451
2452                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
2453                                                    state->split))
2454                         goto nla_put_failure;
2455
2456                 state->split_start++;
2457                 if (state->split)
2458                         break;
2459                 fallthrough;
2460         case 8:
2461                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
2462                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
2463                                 rdev->wiphy.ap_sme_capa))
2464                         goto nla_put_failure;
2465
2466                 features = rdev->wiphy.features;
2467                 /*
2468                  * We can only add the per-channel limit information if the
2469                  * dump is split, otherwise it makes it too big. Therefore
2470                  * only advertise it in that case.
2471                  */
2472                 if (state->split)
2473                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
2474                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
2475                         goto nla_put_failure;
2476
2477                 if (rdev->wiphy.ht_capa_mod_mask &&
2478                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
2479                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
2480                             rdev->wiphy.ht_capa_mod_mask))
2481                         goto nla_put_failure;
2482
2483                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
2484                     rdev->wiphy.max_acl_mac_addrs &&
2485                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
2486                                 rdev->wiphy.max_acl_mac_addrs))
2487                         goto nla_put_failure;
2488
2489                 /*
2490                  * Any information below this point is only available to
2491                  * applications that can deal with it being split. This
2492                  * helps ensure that newly added capabilities don't break
2493                  * older tools by overrunning their buffers.
2494                  *
2495                  * We still increment split_start so that in the split
2496                  * case we'll continue with more data in the next round,
2497                  * but break unconditionally so unsplit data stops here.
2498                  */
2499                 if (state->split)
2500                         state->split_start++;
2501                 else
2502                         state->split_start = 0;
2503                 break;
2504         case 9:
2505                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
2506                         goto nla_put_failure;
2507
2508                 if (nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
2509                                 rdev->wiphy.max_sched_scan_plans) ||
2510                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
2511                                 rdev->wiphy.max_sched_scan_plan_interval) ||
2512                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
2513                                 rdev->wiphy.max_sched_scan_plan_iterations))
2514                         goto nla_put_failure;
2515
2516                 if (rdev->wiphy.extended_capabilities &&
2517                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
2518                              rdev->wiphy.extended_capabilities_len,
2519                              rdev->wiphy.extended_capabilities) ||
2520                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2521                              rdev->wiphy.extended_capabilities_len,
2522                              rdev->wiphy.extended_capabilities_mask)))
2523                         goto nla_put_failure;
2524
2525                 if (rdev->wiphy.vht_capa_mod_mask &&
2526                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
2527                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
2528                             rdev->wiphy.vht_capa_mod_mask))
2529                         goto nla_put_failure;
2530
2531                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
2532                             rdev->wiphy.perm_addr))
2533                         goto nla_put_failure;
2534
2535                 if (!is_zero_ether_addr(rdev->wiphy.addr_mask) &&
2536                     nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
2537                             rdev->wiphy.addr_mask))
2538                         goto nla_put_failure;
2539
2540                 if (rdev->wiphy.n_addresses > 1) {
2541                         void *attr;
2542
2543                         attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
2544                         if (!attr)
2545                                 goto nla_put_failure;
2546
2547                         for (i = 0; i < rdev->wiphy.n_addresses; i++)
2548                                 if (nla_put(msg, i + 1, ETH_ALEN,
2549                                             rdev->wiphy.addresses[i].addr))
2550                                         goto nla_put_failure;
2551
2552                         nla_nest_end(msg, attr);
2553                 }
2554
2555                 state->split_start++;
2556                 break;
2557         case 10:
2558                 if (nl80211_send_coalesce(msg, rdev))
2559                         goto nla_put_failure;
2560
2561                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
2562                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
2563                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
2564                         goto nla_put_failure;
2565
2566                 if (rdev->wiphy.max_ap_assoc_sta &&
2567                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
2568                                 rdev->wiphy.max_ap_assoc_sta))
2569                         goto nla_put_failure;
2570
2571                 state->split_start++;
2572                 break;
2573         case 11:
2574                 if (rdev->wiphy.n_vendor_commands) {
2575                         const struct nl80211_vendor_cmd_info *info;
2576                         struct nlattr *nested;
2577
2578                         nested = nla_nest_start_noflag(msg,
2579                                                        NL80211_ATTR_VENDOR_DATA);
2580                         if (!nested)
2581                                 goto nla_put_failure;
2582
2583                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
2584                                 info = &rdev->wiphy.vendor_commands[i].info;
2585                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2586                                         goto nla_put_failure;
2587                         }
2588                         nla_nest_end(msg, nested);
2589                 }
2590
2591                 if (rdev->wiphy.n_vendor_events) {
2592                         const struct nl80211_vendor_cmd_info *info;
2593                         struct nlattr *nested;
2594
2595                         nested = nla_nest_start_noflag(msg,
2596                                                        NL80211_ATTR_VENDOR_EVENTS);
2597                         if (!nested)
2598                                 goto nla_put_failure;
2599
2600                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
2601                                 info = &rdev->wiphy.vendor_events[i];
2602                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2603                                         goto nla_put_failure;
2604                         }
2605                         nla_nest_end(msg, nested);
2606                 }
2607                 state->split_start++;
2608                 break;
2609         case 12:
2610                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
2611                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
2612                                rdev->wiphy.max_num_csa_counters))
2613                         goto nla_put_failure;
2614
2615                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2616                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
2617                         goto nla_put_failure;
2618
2619                 if (rdev->wiphy.max_sched_scan_reqs &&
2620                     nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
2621                                 rdev->wiphy.max_sched_scan_reqs))
2622                         goto nla_put_failure;
2623
2624                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2625                             sizeof(rdev->wiphy.ext_features),
2626                             rdev->wiphy.ext_features))
2627                         goto nla_put_failure;
2628
2629                 if (rdev->wiphy.bss_select_support) {
2630                         struct nlattr *nested;
2631                         u32 bss_select_support = rdev->wiphy.bss_select_support;
2632
2633                         nested = nla_nest_start_noflag(msg,
2634                                                        NL80211_ATTR_BSS_SELECT);
2635                         if (!nested)
2636                                 goto nla_put_failure;
2637
2638                         i = 0;
2639                         while (bss_select_support) {
2640                                 if ((bss_select_support & 1) &&
2641                                     nla_put_flag(msg, i))
2642                                         goto nla_put_failure;
2643                                 i++;
2644                                 bss_select_support >>= 1;
2645                         }
2646                         nla_nest_end(msg, nested);
2647                 }
2648
2649                 state->split_start++;
2650                 break;
2651         case 13:
2652                 if (rdev->wiphy.num_iftype_ext_capab &&
2653                     rdev->wiphy.iftype_ext_capab) {
2654                         struct nlattr *nested_ext_capab, *nested;
2655
2656                         nested = nla_nest_start_noflag(msg,
2657                                                        NL80211_ATTR_IFTYPE_EXT_CAPA);
2658                         if (!nested)
2659                                 goto nla_put_failure;
2660
2661                         for (i = state->capa_start;
2662                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
2663                                 const struct wiphy_iftype_ext_capab *capab;
2664
2665                                 capab = &rdev->wiphy.iftype_ext_capab[i];
2666
2667                                 nested_ext_capab = nla_nest_start_noflag(msg,
2668                                                                          i);
2669                                 if (!nested_ext_capab ||
2670                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
2671                                                 capab->iftype) ||
2672                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
2673                                             capab->extended_capabilities_len,
2674                                             capab->extended_capabilities) ||
2675                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2676                                             capab->extended_capabilities_len,
2677                                             capab->extended_capabilities_mask))
2678                                         goto nla_put_failure;
2679
2680                                 nla_nest_end(msg, nested_ext_capab);
2681                                 if (state->split)
2682                                         break;
2683                         }
2684                         nla_nest_end(msg, nested);
2685                         if (i < rdev->wiphy.num_iftype_ext_capab) {
2686                                 state->capa_start = i + 1;
2687                                 break;
2688                         }
2689                 }
2690
2691                 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
2692                                 rdev->wiphy.nan_supported_bands))
2693                         goto nla_put_failure;
2694
2695                 if (wiphy_ext_feature_isset(&rdev->wiphy,
2696                                             NL80211_EXT_FEATURE_TXQS)) {
2697                         struct cfg80211_txq_stats txqstats = {};
2698                         int res;
2699
2700                         res = rdev_get_txq_stats(rdev, NULL, &txqstats);
2701                         if (!res &&
2702                             !nl80211_put_txq_stats(msg, &txqstats,
2703                                                    NL80211_ATTR_TXQ_STATS))
2704                                 goto nla_put_failure;
2705
2706                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
2707                                         rdev->wiphy.txq_limit))
2708                                 goto nla_put_failure;
2709                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
2710                                         rdev->wiphy.txq_memory_limit))
2711                                 goto nla_put_failure;
2712                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
2713                                         rdev->wiphy.txq_quantum))
2714                                 goto nla_put_failure;
2715                 }
2716
2717                 state->split_start++;
2718                 break;
2719         case 14:
2720                 if (nl80211_send_pmsr_capa(rdev, msg))
2721                         goto nla_put_failure;
2722
2723                 state->split_start++;
2724                 break;
2725         case 15:
2726                 if (rdev->wiphy.akm_suites &&
2727                     nla_put(msg, NL80211_ATTR_AKM_SUITES,
2728                             sizeof(u32) * rdev->wiphy.n_akm_suites,
2729                             rdev->wiphy.akm_suites))
2730                         goto nla_put_failure;
2731
2732                 if (nl80211_put_iftype_akm_suites(rdev, msg))
2733                         goto nla_put_failure;
2734
2735                 if (nl80211_put_tid_config_support(rdev, msg))
2736                         goto nla_put_failure;
2737                 state->split_start++;
2738                 break;
2739         case 16:
2740                 if (nl80211_put_sar_specs(rdev, msg))
2741                         goto nla_put_failure;
2742
2743                 /* done */
2744                 state->split_start = 0;
2745                 break;
2746         }
2747  finish:
2748         genlmsg_end(msg, hdr);
2749         return 0;
2750
2751  nla_put_failure:
2752         genlmsg_cancel(msg, hdr);
2753         return -EMSGSIZE;
2754 }
2755
2756 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
2757                                     struct netlink_callback *cb,
2758                                     struct nl80211_dump_wiphy_state *state)
2759 {
2760         struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
2761         int ret;
2762
2763         if (!tb)
2764                 return -ENOMEM;
2765
2766         ret = nlmsg_parse_deprecated(cb->nlh,
2767                                      GENL_HDRLEN + nl80211_fam.hdrsize,
2768                                      tb, nl80211_fam.maxattr,
2769                                      nl80211_policy, NULL);
2770         /* ignore parse errors for backward compatibility */
2771         if (ret) {
2772                 ret = 0;
2773                 goto out;
2774         }
2775
2776         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
2777         if (tb[NL80211_ATTR_WIPHY])
2778                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
2779         if (tb[NL80211_ATTR_WDEV])
2780                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
2781         if (tb[NL80211_ATTR_IFINDEX]) {
2782                 struct net_device *netdev;
2783                 struct cfg80211_registered_device *rdev;
2784                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2785
2786                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2787                 if (!netdev) {
2788                         ret = -ENODEV;
2789                         goto out;
2790                 }
2791                 if (netdev->ieee80211_ptr) {
2792                         rdev = wiphy_to_rdev(
2793                                 netdev->ieee80211_ptr->wiphy);
2794                         state->filter_wiphy = rdev->wiphy_idx;
2795                 }
2796         }
2797
2798         ret = 0;
2799 out:
2800         kfree(tb);
2801         return ret;
2802 }
2803
2804 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
2805 {
2806         int idx = 0, ret;
2807         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
2808         struct cfg80211_registered_device *rdev;
2809
2810         rtnl_lock();
2811         if (!state) {
2812                 state = kzalloc(sizeof(*state), GFP_KERNEL);
2813                 if (!state) {
2814                         rtnl_unlock();
2815                         return -ENOMEM;
2816                 }
2817                 state->filter_wiphy = -1;
2818                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
2819                 if (ret) {
2820                         kfree(state);
2821                         rtnl_unlock();
2822                         return ret;
2823                 }
2824                 cb->args[0] = (long)state;
2825         }
2826
2827         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2828                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2829                         continue;
2830                 if (++idx <= state->start)
2831                         continue;
2832                 if (state->filter_wiphy != -1 &&
2833                     state->filter_wiphy != rdev->wiphy_idx)
2834                         continue;
2835                 /* attempt to fit multiple wiphy data chunks into the skb */
2836                 do {
2837                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
2838                                                  skb,
2839                                                  NETLINK_CB(cb->skb).portid,
2840                                                  cb->nlh->nlmsg_seq,
2841                                                  NLM_F_MULTI, state);
2842                         if (ret < 0) {
2843                                 /*
2844                                  * If sending the wiphy data didn't fit (ENOBUFS
2845                                  * or EMSGSIZE returned), this SKB is still
2846                                  * empty (so it's not too big because another
2847                                  * wiphy dataset is already in the skb) and
2848                                  * we've not tried to adjust the dump allocation
2849                                  * yet ... then adjust the alloc size to be
2850                                  * bigger, and return 1 but with the empty skb.
2851                                  * This results in an empty message being RX'ed
2852                                  * in userspace, but that is ignored.
2853                                  *
2854                                  * We can then retry with the larger buffer.
2855                                  */
2856                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
2857                                     !skb->len && !state->split &&
2858                                     cb->min_dump_alloc < 4096) {
2859                                         cb->min_dump_alloc = 4096;
2860                                         state->split_start = 0;
2861                                         rtnl_unlock();
2862                                         return 1;
2863                                 }
2864                                 idx--;
2865                                 break;
2866                         }
2867                 } while (state->split_start > 0);
2868                 break;
2869         }
2870         rtnl_unlock();
2871
2872         state->start = idx;
2873
2874         return skb->len;
2875 }
2876
2877 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
2878 {
2879         kfree((void *)cb->args[0]);
2880         return 0;
2881 }
2882
2883 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
2884 {
2885         struct sk_buff *msg;
2886         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2887         struct nl80211_dump_wiphy_state state = {};
2888
2889         msg = nlmsg_new(4096, GFP_KERNEL);
2890         if (!msg)
2891                 return -ENOMEM;
2892
2893         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
2894                                info->snd_portid, info->snd_seq, 0,
2895                                &state) < 0) {
2896                 nlmsg_free(msg);
2897                 return -ENOBUFS;
2898         }
2899
2900         return genlmsg_reply(msg, info);
2901 }
2902
2903 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2904         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
2905         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
2906         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
2907         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
2908         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
2909 };
2910
2911 static int parse_txq_params(struct nlattr *tb[],
2912                             struct ieee80211_txq_params *txq_params)
2913 {
2914         u8 ac;
2915
2916         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2917             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2918             !tb[NL80211_TXQ_ATTR_AIFS])
2919                 return -EINVAL;
2920
2921         ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2922         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2923         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2924         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2925         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2926
2927         if (ac >= NL80211_NUM_ACS)
2928                 return -EINVAL;
2929         txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
2930         return 0;
2931 }
2932
2933 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2934 {
2935         /*
2936          * You can only set the channel explicitly for some interfaces,
2937          * most have their channel managed via their respective
2938          * "establish a connection" command (connect, join, ...)
2939          *
2940          * For AP/GO and mesh mode, the channel can be set with the
2941          * channel userspace API, but is only stored and passed to the
2942          * low-level driver when the AP starts or the mesh is joined.
2943          * This is for backward compatibility, userspace can also give
2944          * the channel in the start-ap or join-mesh commands instead.
2945          *
2946          * Monitors are special as they are normally slaved to
2947          * whatever else is going on, so they have their own special
2948          * operation to set the monitor channel if possible.
2949          */
2950         return !wdev ||
2951                 wdev->iftype == NL80211_IFTYPE_AP ||
2952                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2953                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
2954                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
2955 }
2956
2957 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2958                           struct genl_info *info,
2959                           struct cfg80211_chan_def *chandef)
2960 {
2961         struct netlink_ext_ack *extack = info->extack;
2962         struct nlattr **attrs = info->attrs;
2963         u32 control_freq;
2964
2965         if (!attrs[NL80211_ATTR_WIPHY_FREQ])
2966                 return -EINVAL;
2967
2968         control_freq = MHZ_TO_KHZ(
2969                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
2970         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
2971                 control_freq +=
2972                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
2973
2974         memset(chandef, 0, sizeof(*chandef));
2975         chandef->chan = ieee80211_get_channel_khz(&rdev->wiphy, control_freq);
2976         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2977         chandef->center_freq1 = KHZ_TO_MHZ(control_freq);
2978         chandef->freq1_offset = control_freq % 1000;
2979         chandef->center_freq2 = 0;
2980
2981         /* Primary channel not allowed */
2982         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) {
2983                 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
2984                                     "Channel is disabled");
2985                 return -EINVAL;
2986         }
2987
2988         if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2989                 enum nl80211_channel_type chantype;
2990
2991                 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2992
2993                 switch (chantype) {
2994                 case NL80211_CHAN_NO_HT:
2995                 case NL80211_CHAN_HT20:
2996                 case NL80211_CHAN_HT40PLUS:
2997                 case NL80211_CHAN_HT40MINUS:
2998                         cfg80211_chandef_create(chandef, chandef->chan,
2999                                                 chantype);
3000                         /* user input for center_freq is incorrect */
3001                         if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
3002                             chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
3003                                 NL_SET_ERR_MSG_ATTR(extack,
3004                                                     attrs[NL80211_ATTR_CENTER_FREQ1],
3005                                                     "bad center frequency 1");
3006                                 return -EINVAL;
3007                         }
3008                         /* center_freq2 must be zero */
3009                         if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
3010                             nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
3011                                 NL_SET_ERR_MSG_ATTR(extack,
3012                                                     attrs[NL80211_ATTR_CENTER_FREQ2],
3013                                                     "center frequency 2 can't be used");
3014                                 return -EINVAL;
3015                         }
3016                         break;
3017                 default:
3018                         NL_SET_ERR_MSG_ATTR(extack,
3019                                             attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
3020                                             "invalid channel type");
3021                         return -EINVAL;
3022                 }
3023         } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
3024                 chandef->width =
3025                         nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
3026                 if (attrs[NL80211_ATTR_CENTER_FREQ1]) {
3027                         chandef->center_freq1 =
3028                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
3029                         if (attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET])
3030                                 chandef->freq1_offset = nla_get_u32(
3031                                       attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET]);
3032                         else
3033                                 chandef->freq1_offset = 0;
3034                 }
3035                 if (attrs[NL80211_ATTR_CENTER_FREQ2])
3036                         chandef->center_freq2 =
3037                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
3038         }
3039
3040         if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
3041                 chandef->edmg.channels =
3042                       nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
3043
3044                 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
3045                         chandef->edmg.bw_config =
3046                      nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
3047         } else {
3048                 chandef->edmg.bw_config = 0;
3049                 chandef->edmg.channels = 0;
3050         }
3051
3052         if (!cfg80211_chandef_valid(chandef)) {
3053                 NL_SET_ERR_MSG(extack, "invalid channel definition");
3054                 return -EINVAL;
3055         }
3056
3057         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
3058                                      IEEE80211_CHAN_DISABLED)) {
3059                 NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
3060                 return -EINVAL;
3061         }
3062
3063         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
3064              chandef->width == NL80211_CHAN_WIDTH_10) &&
3065             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
3066                 NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
3067                 return -EINVAL;
3068         }
3069
3070         return 0;
3071 }
3072
3073 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
3074                                  struct net_device *dev,
3075                                  struct genl_info *info)
3076 {
3077         struct cfg80211_chan_def chandef;
3078         int result;
3079         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
3080         struct wireless_dev *wdev = NULL;
3081
3082         if (dev)
3083                 wdev = dev->ieee80211_ptr;
3084         if (!nl80211_can_set_dev_channel(wdev))
3085                 return -EOPNOTSUPP;
3086         if (wdev)
3087                 iftype = wdev->iftype;
3088
3089         result = nl80211_parse_chandef(rdev, info, &chandef);
3090         if (result)
3091                 return result;
3092
3093         switch (iftype) {
3094         case NL80211_IFTYPE_AP:
3095         case NL80211_IFTYPE_P2P_GO:
3096                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
3097                                                    iftype)) {
3098                         result = -EINVAL;
3099                         break;
3100                 }
3101                 if (wdev->beacon_interval) {
3102                         if (!dev || !rdev->ops->set_ap_chanwidth ||
3103                             !(rdev->wiphy.features &
3104                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
3105                                 result = -EBUSY;
3106                                 break;
3107                         }
3108
3109                         /* Only allow dynamic channel width changes */
3110                         if (chandef.chan != wdev->preset_chandef.chan) {
3111                                 result = -EBUSY;
3112                                 break;
3113                         }
3114                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
3115                         if (result)
3116                                 break;
3117                 }
3118                 wdev->preset_chandef = chandef;
3119                 result = 0;
3120                 break;
3121         case NL80211_IFTYPE_MESH_POINT:
3122                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
3123                 break;
3124         case NL80211_IFTYPE_MONITOR:
3125                 result = cfg80211_set_monitor_channel(rdev, &chandef);
3126                 break;
3127         default:
3128                 result = -EINVAL;
3129         }
3130
3131         return result;
3132 }
3133
3134 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
3135 {
3136         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3137         struct net_device *netdev = info->user_ptr[1];
3138
3139         return __nl80211_set_channel(rdev, netdev, info);
3140 }
3141
3142 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
3143 {
3144         struct cfg80211_registered_device *rdev;
3145         struct net_device *netdev = NULL;
3146         struct wireless_dev *wdev;
3147         int result = 0, rem_txq_params = 0;
3148         struct nlattr *nl_txq_params;
3149         u32 changed;
3150         u8 retry_short = 0, retry_long = 0;
3151         u32 frag_threshold = 0, rts_threshold = 0;
3152         u8 coverage_class = 0;
3153         u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
3154
3155         ASSERT_RTNL();
3156
3157         /*
3158          * Try to find the wiphy and netdev. Normally this
3159          * function shouldn't need the netdev, but this is
3160          * done for backward compatibility -- previously
3161          * setting the channel was done per wiphy, but now
3162          * it is per netdev. Previous userland like hostapd
3163          * also passed a netdev to set_wiphy, so that it is
3164          * possible to let that go to the right netdev!
3165          */
3166
3167         if (info->attrs[NL80211_ATTR_IFINDEX]) {
3168                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
3169
3170                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
3171                 if (netdev && netdev->ieee80211_ptr)
3172                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
3173                 else
3174                         netdev = NULL;
3175         }
3176
3177         if (!netdev) {
3178                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
3179                                                   info->attrs);
3180                 if (IS_ERR(rdev))
3181                         return PTR_ERR(rdev);
3182                 wdev = NULL;
3183                 netdev = NULL;
3184                 result = 0;
3185         } else
3186                 wdev = netdev->ieee80211_ptr;
3187
3188         /*
3189          * end workaround code, by now the rdev is available
3190          * and locked, and wdev may or may not be NULL.
3191          */
3192
3193         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
3194                 result = cfg80211_dev_rename(
3195                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
3196
3197         if (result)
3198                 return result;
3199
3200         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
3201                 struct ieee80211_txq_params txq_params;
3202                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
3203
3204                 if (!rdev->ops->set_txq_params)
3205                         return -EOPNOTSUPP;
3206
3207                 if (!netdev)
3208                         return -EINVAL;
3209
3210                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3211                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3212                         return -EINVAL;
3213
3214                 if (!netif_running(netdev))
3215                         return -ENETDOWN;
3216
3217                 nla_for_each_nested(nl_txq_params,
3218                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
3219                                     rem_txq_params) {
3220                         result = nla_parse_nested_deprecated(tb,
3221                                                              NL80211_TXQ_ATTR_MAX,
3222                                                              nl_txq_params,
3223                                                              txq_params_policy,
3224                                                              info->extack);
3225                         if (result)
3226                                 return result;
3227                         result = parse_txq_params(tb, &txq_params);
3228                         if (result)
3229                                 return result;
3230
3231                         result = rdev_set_txq_params(rdev, netdev,
3232                                                      &txq_params);
3233                         if (result)
3234                                 return result;
3235                 }
3236         }
3237
3238         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3239                 result = __nl80211_set_channel(
3240                         rdev,
3241                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
3242                         info);
3243                 if (result)
3244                         return result;
3245         }
3246
3247         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
3248                 struct wireless_dev *txp_wdev = wdev;
3249                 enum nl80211_tx_power_setting type;
3250                 int idx, mbm = 0;
3251
3252                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
3253                         txp_wdev = NULL;
3254
3255                 if (!rdev->ops->set_tx_power)
3256                         return -EOPNOTSUPP;
3257
3258                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
3259                 type = nla_get_u32(info->attrs[idx]);
3260
3261                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
3262                     (type != NL80211_TX_POWER_AUTOMATIC))
3263                         return -EINVAL;
3264
3265                 if (type != NL80211_TX_POWER_AUTOMATIC) {
3266                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
3267                         mbm = nla_get_u32(info->attrs[idx]);
3268                 }
3269
3270                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
3271                 if (result)
3272                         return result;
3273         }
3274
3275         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
3276             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
3277                 u32 tx_ant, rx_ant;
3278
3279                 if ((!rdev->wiphy.available_antennas_tx &&
3280                      !rdev->wiphy.available_antennas_rx) ||
3281                     !rdev->ops->set_antenna)
3282                         return -EOPNOTSUPP;
3283
3284                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
3285                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
3286
3287                 /* reject antenna configurations which don't match the
3288                  * available antenna masks, except for the "all" mask */
3289                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
3290                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
3291                         return -EINVAL;
3292
3293                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
3294                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
3295
3296                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
3297                 if (result)
3298                         return result;
3299         }
3300
3301         changed = 0;
3302
3303         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
3304                 retry_short = nla_get_u8(
3305                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
3306
3307                 changed |= WIPHY_PARAM_RETRY_SHORT;
3308         }
3309
3310         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
3311                 retry_long = nla_get_u8(
3312                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
3313
3314                 changed |= WIPHY_PARAM_RETRY_LONG;
3315         }
3316
3317         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
3318                 frag_threshold = nla_get_u32(
3319                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
3320                 if (frag_threshold < 256)
3321                         return -EINVAL;
3322
3323                 if (frag_threshold != (u32) -1) {
3324                         /*
3325                          * Fragments (apart from the last one) are required to
3326                          * have even length. Make the fragmentation code
3327                          * simpler by stripping LSB should someone try to use
3328                          * odd threshold value.
3329                          */
3330                         frag_threshold &= ~0x1;
3331                 }
3332                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
3333         }
3334
3335         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
3336                 rts_threshold = nla_get_u32(
3337                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
3338                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
3339         }
3340
3341         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
3342                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
3343                         return -EINVAL;
3344
3345                 coverage_class = nla_get_u8(
3346                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
3347                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
3348         }
3349
3350         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3351                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
3352                         return -EOPNOTSUPP;
3353
3354                 changed |= WIPHY_PARAM_DYN_ACK;
3355         }
3356
3357         if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
3358                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3359                                              NL80211_EXT_FEATURE_TXQS))
3360                         return -EOPNOTSUPP;
3361                 txq_limit = nla_get_u32(
3362                         info->attrs[NL80211_ATTR_TXQ_LIMIT]);
3363                 changed |= WIPHY_PARAM_TXQ_LIMIT;
3364         }
3365
3366         if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
3367                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3368                                              NL80211_EXT_FEATURE_TXQS))
3369                         return -EOPNOTSUPP;
3370                 txq_memory_limit = nla_get_u32(
3371                         info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
3372                 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
3373         }
3374
3375         if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
3376                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3377                                              NL80211_EXT_FEATURE_TXQS))
3378                         return -EOPNOTSUPP;
3379                 txq_quantum = nla_get_u32(
3380                         info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
3381                 changed |= WIPHY_PARAM_TXQ_QUANTUM;
3382         }
3383
3384         if (changed) {
3385                 u8 old_retry_short, old_retry_long;
3386                 u32 old_frag_threshold, old_rts_threshold;
3387                 u8 old_coverage_class;
3388                 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
3389
3390                 if (!rdev->ops->set_wiphy_params)
3391                         return -EOPNOTSUPP;
3392
3393                 old_retry_short = rdev->wiphy.retry_short;
3394                 old_retry_long = rdev->wiphy.retry_long;
3395                 old_frag_threshold = rdev->wiphy.frag_threshold;
3396                 old_rts_threshold = rdev->wiphy.rts_threshold;
3397                 old_coverage_class = rdev->wiphy.coverage_class;
3398                 old_txq_limit = rdev->wiphy.txq_limit;
3399                 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
3400                 old_txq_quantum = rdev->wiphy.txq_quantum;
3401
3402                 if (changed & WIPHY_PARAM_RETRY_SHORT)
3403                         rdev->wiphy.retry_short = retry_short;
3404                 if (changed & WIPHY_PARAM_RETRY_LONG)
3405                         rdev->wiphy.retry_long = retry_long;
3406                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
3407                         rdev->wiphy.frag_threshold = frag_threshold;
3408                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
3409                         rdev->wiphy.rts_threshold = rts_threshold;
3410                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
3411                         rdev->wiphy.coverage_class = coverage_class;
3412                 if (changed & WIPHY_PARAM_TXQ_LIMIT)
3413                         rdev->wiphy.txq_limit = txq_limit;
3414                 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
3415                         rdev->wiphy.txq_memory_limit = txq_memory_limit;
3416                 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
3417                         rdev->wiphy.txq_quantum = txq_quantum;
3418
3419                 result = rdev_set_wiphy_params(rdev, changed);
3420                 if (result) {
3421                         rdev->wiphy.retry_short = old_retry_short;
3422                         rdev->wiphy.retry_long = old_retry_long;
3423                         rdev->wiphy.frag_threshold = old_frag_threshold;
3424                         rdev->wiphy.rts_threshold = old_rts_threshold;
3425                         rdev->wiphy.coverage_class = old_coverage_class;
3426                         rdev->wiphy.txq_limit = old_txq_limit;
3427                         rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
3428                         rdev->wiphy.txq_quantum = old_txq_quantum;
3429                         return result;
3430                 }
3431         }
3432         return 0;
3433 }
3434
3435 static int nl80211_send_chandef(struct sk_buff *msg,
3436                                 const struct cfg80211_chan_def *chandef)
3437 {
3438         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
3439                 return -EINVAL;
3440
3441         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
3442                         chandef->chan->center_freq))
3443                 return -ENOBUFS;
3444         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
3445                         chandef->chan->freq_offset))
3446                 return -ENOBUFS;
3447         switch (chandef->width) {
3448         case NL80211_CHAN_WIDTH_20_NOHT:
3449         case NL80211_CHAN_WIDTH_20:
3450         case NL80211_CHAN_WIDTH_40:
3451                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3452                                 cfg80211_get_chandef_type(chandef)))
3453                         return -ENOBUFS;
3454                 break;
3455         default:
3456                 break;
3457         }
3458         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
3459                 return -ENOBUFS;
3460         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
3461                 return -ENOBUFS;
3462         if (chandef->center_freq2 &&
3463             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
3464                 return -ENOBUFS;
3465         return 0;
3466 }
3467
3468 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
3469                               struct cfg80211_registered_device *rdev,
3470                               struct wireless_dev *wdev,
3471                               enum nl80211_commands cmd)
3472 {
3473         struct net_device *dev = wdev->netdev;
3474         void *hdr;
3475
3476         WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
3477                 cmd != NL80211_CMD_DEL_INTERFACE &&
3478                 cmd != NL80211_CMD_SET_INTERFACE);
3479
3480         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3481         if (!hdr)
3482                 return -1;
3483
3484         if (dev &&
3485             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3486              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
3487                 goto nla_put_failure;
3488
3489         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
3490             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
3491             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
3492                               NL80211_ATTR_PAD) ||
3493             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
3494             nla_put_u32(msg, NL80211_ATTR_GENERATION,
3495                         rdev->devlist_generation ^
3496                         (cfg80211_rdev_list_generation << 2)) ||
3497             nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr))
3498                 goto nla_put_failure;
3499
3500         if (rdev->ops->get_channel) {
3501                 int ret;
3502                 struct cfg80211_chan_def chandef = {};
3503
3504                 ret = rdev_get_channel(rdev, wdev, &chandef);
3505                 if (ret == 0) {
3506                         if (nl80211_send_chandef(msg, &chandef))
3507                                 goto nla_put_failure;
3508                 }
3509         }
3510
3511         if (rdev->ops->get_tx_power) {
3512                 int dbm, ret;
3513
3514                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
3515                 if (ret == 0 &&
3516                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
3517                                 DBM_TO_MBM(dbm)))
3518                         goto nla_put_failure;
3519         }
3520
3521         wdev_lock(wdev);
3522         switch (wdev->iftype) {
3523         case NL80211_IFTYPE_AP:
3524                 if (wdev->ssid_len &&
3525                     nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
3526                         goto nla_put_failure_locked;
3527                 break;
3528         case NL80211_IFTYPE_STATION:
3529         case NL80211_IFTYPE_P2P_CLIENT:
3530         case NL80211_IFTYPE_ADHOC: {
3531                 const u8 *ssid_ie;
3532                 if (!wdev->current_bss)
3533                         break;
3534                 rcu_read_lock();
3535                 ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
3536                                                WLAN_EID_SSID);
3537                 if (ssid_ie &&
3538                     nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2))
3539                         goto nla_put_failure_rcu_locked;
3540                 rcu_read_unlock();
3541                 break;
3542                 }
3543         default:
3544                 /* nothing */
3545                 break;
3546         }
3547         wdev_unlock(wdev);
3548
3549         if (rdev->ops->get_txq_stats) {
3550                 struct cfg80211_txq_stats txqstats = {};
3551                 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
3552
3553                 if (ret == 0 &&
3554                     !nl80211_put_txq_stats(msg, &txqstats,
3555                                            NL80211_ATTR_TXQ_STATS))
3556                         goto nla_put_failure;
3557         }
3558
3559         genlmsg_end(msg, hdr);
3560         return 0;
3561
3562  nla_put_failure_rcu_locked:
3563         rcu_read_unlock();
3564  nla_put_failure_locked:
3565         wdev_unlock(wdev);
3566  nla_put_failure:
3567         genlmsg_cancel(msg, hdr);
3568         return -EMSGSIZE;
3569 }
3570
3571 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
3572 {
3573         int wp_idx = 0;
3574         int if_idx = 0;
3575         int wp_start = cb->args[0];
3576         int if_start = cb->args[1];
3577         int filter_wiphy = -1;
3578         struct cfg80211_registered_device *rdev;
3579         struct wireless_dev *wdev;
3580         int ret;
3581
3582         rtnl_lock();
3583         if (!cb->args[2]) {
3584                 struct nl80211_dump_wiphy_state state = {
3585                         .filter_wiphy = -1,
3586                 };
3587
3588                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
3589                 if (ret)
3590                         goto out_unlock;
3591
3592                 filter_wiphy = state.filter_wiphy;
3593
3594                 /*
3595                  * if filtering, set cb->args[2] to +1 since 0 is the default
3596                  * value needed to determine that parsing is necessary.
3597                  */
3598                 if (filter_wiphy >= 0)
3599                         cb->args[2] = filter_wiphy + 1;
3600                 else
3601                         cb->args[2] = -1;
3602         } else if (cb->args[2] > 0) {
3603                 filter_wiphy = cb->args[2] - 1;
3604         }
3605
3606         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3607                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3608                         continue;
3609                 if (wp_idx < wp_start) {
3610                         wp_idx++;
3611                         continue;
3612                 }
3613
3614                 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
3615                         continue;
3616
3617                 if_idx = 0;
3618
3619                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3620                         if (if_idx < if_start) {
3621                                 if_idx++;
3622                                 continue;
3623                         }
3624                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
3625                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
3626                                                rdev, wdev,
3627                                                NL80211_CMD_NEW_INTERFACE) < 0) {
3628                                 goto out;
3629                         }
3630                         if_idx++;
3631                 }
3632
3633                 wp_idx++;
3634         }
3635  out:
3636         cb->args[0] = wp_idx;
3637         cb->args[1] = if_idx;
3638
3639         ret = skb->len;
3640  out_unlock:
3641         rtnl_unlock();
3642
3643         return ret;
3644 }
3645
3646 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
3647 {
3648         struct sk_buff *msg;
3649         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3650         struct wireless_dev *wdev = info->user_ptr[1];
3651
3652         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3653         if (!msg)
3654                 return -ENOMEM;
3655
3656         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3657                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
3658                 nlmsg_free(msg);
3659                 return -ENOBUFS;
3660         }
3661
3662         return genlmsg_reply(msg, info);
3663 }
3664
3665 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
3666         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
3667         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
3668         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
3669         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
3670         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
3671         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
3672 };
3673
3674 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
3675 {
3676         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
3677         int flag;
3678
3679         *mntrflags = 0;
3680
3681         if (!nla)
3682                 return -EINVAL;
3683
3684         if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL))
3685                 return -EINVAL;
3686
3687         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
3688                 if (flags[flag])
3689                         *mntrflags |= (1<<flag);
3690
3691         *mntrflags |= MONITOR_FLAG_CHANGED;
3692
3693         return 0;
3694 }
3695
3696 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
3697                                      enum nl80211_iftype type,
3698                                      struct genl_info *info,
3699                                      struct vif_params *params)
3700 {
3701         bool change = false;
3702         int err;
3703
3704         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
3705                 if (type != NL80211_IFTYPE_MONITOR)
3706                         return -EINVAL;
3707
3708                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
3709                                           &params->flags);
3710                 if (err)
3711                         return err;
3712
3713                 change = true;
3714         }
3715
3716         if (params->flags & MONITOR_FLAG_ACTIVE &&
3717             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
3718                 return -EOPNOTSUPP;
3719
3720         if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
3721                 const u8 *mumimo_groups;
3722                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3723
3724                 if (type != NL80211_IFTYPE_MONITOR)
3725                         return -EINVAL;
3726
3727                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3728                         return -EOPNOTSUPP;
3729
3730                 mumimo_groups =
3731                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
3732
3733                 /* bits 0 and 63 are reserved and must be zero */
3734                 if ((mumimo_groups[0] & BIT(0)) ||
3735                     (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
3736                         return -EINVAL;
3737
3738                 params->vht_mumimo_groups = mumimo_groups;
3739                 change = true;
3740         }
3741
3742         if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
3743                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3744
3745                 if (type != NL80211_IFTYPE_MONITOR)
3746                         return -EINVAL;
3747
3748                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3749                         return -EOPNOTSUPP;
3750
3751                 params->vht_mumimo_follow_addr =
3752                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
3753                 change = true;
3754         }
3755
3756         return change ? 1 : 0;
3757 }
3758
3759 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
3760                                struct net_device *netdev, u8 use_4addr,
3761                                enum nl80211_iftype iftype)
3762 {
3763         if (!use_4addr) {
3764                 if (netdev && netif_is_bridge_port(netdev))
3765                         return -EBUSY;
3766                 return 0;
3767         }
3768
3769         switch (iftype) {
3770         case NL80211_IFTYPE_AP_VLAN:
3771                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
3772                         return 0;
3773                 break;
3774         case NL80211_IFTYPE_STATION:
3775                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
3776                         return 0;
3777                 break;
3778         default:
3779                 break;
3780         }
3781
3782         return -EOPNOTSUPP;
3783 }
3784
3785 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
3786 {
3787         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3788         struct vif_params params;
3789         int err;
3790         enum nl80211_iftype otype, ntype;
3791         struct net_device *dev = info->user_ptr[1];
3792         bool change = false;
3793
3794         memset(&params, 0, sizeof(params));
3795
3796         otype = ntype = dev->ieee80211_ptr->iftype;
3797
3798         if (info->attrs[NL80211_ATTR_IFTYPE]) {
3799                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3800                 if (otype != ntype)
3801                         change = true;
3802         }
3803
3804         if (info->attrs[NL80211_ATTR_MESH_ID]) {
3805                 struct wireless_dev *wdev = dev->ieee80211_ptr;
3806
3807                 if (ntype != NL80211_IFTYPE_MESH_POINT)
3808                         return -EINVAL;
3809                 if (netif_running(dev))
3810                         return -EBUSY;
3811
3812                 wdev_lock(wdev);
3813                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3814                              IEEE80211_MAX_MESH_ID_LEN);
3815                 wdev->mesh_id_up_len =
3816                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3817                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3818                        wdev->mesh_id_up_len);
3819                 wdev_unlock(wdev);
3820         }
3821
3822         if (info->attrs[NL80211_ATTR_4ADDR]) {
3823                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3824                 change = true;
3825                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
3826                 if (err)
3827                         return err;
3828         } else {
3829                 params.use_4addr = -1;
3830         }
3831
3832         err = nl80211_parse_mon_options(rdev, ntype, info, &params);
3833         if (err < 0)
3834                 return err;
3835         if (err > 0)
3836                 change = true;
3837
3838         if (change)
3839                 err = cfg80211_change_iface(rdev, dev, ntype, &params);
3840         else
3841                 err = 0;
3842
3843         if (!err && params.use_4addr != -1)
3844                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
3845
3846         if (change && !err) {
3847                 struct wireless_dev *wdev = dev->ieee80211_ptr;
3848
3849                 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
3850         }
3851
3852         return err;
3853 }
3854
3855 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
3856 {
3857         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3858         struct vif_params params;
3859         struct wireless_dev *wdev;
3860         struct sk_buff *msg;
3861         int err;
3862         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
3863
3864         /* to avoid failing a new interface creation due to pending removal */
3865         cfg80211_destroy_ifaces(rdev);
3866
3867         memset(&params, 0, sizeof(params));
3868
3869         if (!info->attrs[NL80211_ATTR_IFNAME])
3870                 return -EINVAL;
3871
3872         if (info->attrs[NL80211_ATTR_IFTYPE])
3873                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3874
3875         if (!rdev->ops->add_virtual_intf)
3876                 return -EOPNOTSUPP;
3877
3878         if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
3879              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
3880             info->attrs[NL80211_ATTR_MAC]) {
3881                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
3882                            ETH_ALEN);
3883                 if (!is_valid_ether_addr(params.macaddr))
3884                         return -EADDRNOTAVAIL;
3885         }
3886
3887         if (info->attrs[NL80211_ATTR_4ADDR]) {
3888                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3889                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
3890                 if (err)
3891                         return err;
3892         }
3893
3894         if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
3895                 return -EOPNOTSUPP;
3896
3897         err = nl80211_parse_mon_options(rdev, type, info, &params);
3898         if (err < 0)
3899                 return err;
3900
3901         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3902         if (!msg)
3903                 return -ENOMEM;
3904
3905         wdev = rdev_add_virtual_intf(rdev,
3906                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
3907                                 NET_NAME_USER, type, &params);
3908         if (WARN_ON(!wdev)) {
3909                 nlmsg_free(msg);
3910                 return -EPROTO;
3911         } else if (IS_ERR(wdev)) {
3912                 nlmsg_free(msg);
3913                 return PTR_ERR(wdev);
3914         }
3915
3916         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
3917                 wdev->owner_nlportid = info->snd_portid;
3918
3919         switch (type) {
3920         case NL80211_IFTYPE_MESH_POINT:
3921                 if (!info->attrs[NL80211_ATTR_MESH_ID])
3922                         break;
3923                 wdev_lock(wdev);
3924                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3925                              IEEE80211_MAX_MESH_ID_LEN);
3926                 wdev->mesh_id_up_len =
3927                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3928                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3929                        wdev->mesh_id_up_len);
3930                 wdev_unlock(wdev);
3931                 break;
3932         case NL80211_IFTYPE_NAN:
3933         case NL80211_IFTYPE_P2P_DEVICE:
3934                 /*
3935                  * P2P Device and NAN do not have a netdev, so don't go
3936                  * through the netdev notifier and must be added here
3937                  */
3938                 cfg80211_init_wdev(wdev);
3939                 cfg80211_register_wdev(rdev, wdev);
3940                 break;
3941         default:
3942                 break;
3943         }
3944
3945         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3946                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
3947                 nlmsg_free(msg);
3948                 return -ENOBUFS;
3949         }
3950
3951         return genlmsg_reply(msg, info);
3952 }
3953
3954 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
3955 {
3956         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3957         struct wireless_dev *wdev = info->user_ptr[1];
3958
3959         if (!rdev->ops->del_virtual_intf)
3960                 return -EOPNOTSUPP;
3961
3962         /*
3963          * If we remove a wireless device without a netdev then clear
3964          * user_ptr[1] so that nl80211_post_doit won't dereference it
3965          * to check if it needs to do dev_put(). Otherwise it crashes
3966          * since the wdev has been freed, unlike with a netdev where
3967          * we need the dev_put() for the netdev to really be freed.
3968          */
3969         if (!wdev->netdev)
3970                 info->user_ptr[1] = NULL;
3971
3972         return rdev_del_virtual_intf(rdev, wdev);
3973 }
3974
3975 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
3976 {
3977         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3978         struct net_device *dev = info->user_ptr[1];
3979         u16 noack_map;
3980
3981         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
3982                 return -EINVAL;
3983
3984         if (!rdev->ops->set_noack_map)
3985                 return -EOPNOTSUPP;
3986
3987         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
3988
3989         return rdev_set_noack_map(rdev, dev, noack_map);
3990 }
3991
3992 struct get_key_cookie {
3993         struct sk_buff *msg;
3994         int error;
3995         int idx;
3996 };
3997
3998 static void get_key_callback(void *c, struct key_params *params)
3999 {
4000         struct nlattr *key;
4001         struct get_key_cookie *cookie = c;
4002
4003         if ((params->key &&
4004              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
4005                      params->key_len, params->key)) ||
4006             (params->seq &&
4007              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
4008                      params->seq_len, params->seq)) ||
4009             (params->cipher &&
4010              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
4011                          params->cipher)))
4012                 goto nla_put_failure;
4013
4014         key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY);
4015         if (!key)
4016                 goto nla_put_failure;
4017
4018         if ((params->key &&
4019              nla_put(cookie->msg, NL80211_KEY_DATA,
4020                      params->key_len, params->key)) ||
4021             (params->seq &&
4022              nla_put(cookie->msg, NL80211_KEY_SEQ,
4023                      params->seq_len, params->seq)) ||
4024             (params->cipher &&
4025              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
4026                          params->cipher)))
4027                 goto nla_put_failure;
4028
4029         if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
4030                 goto nla_put_failure;
4031
4032         nla_nest_end(cookie->msg, key);
4033
4034         return;
4035  nla_put_failure:
4036         cookie->error = 1;
4037 }
4038
4039 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
4040 {
4041         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4042         int err;
4043         struct net_device *dev = info->user_ptr[1];
4044         u8 key_idx = 0;
4045         const u8 *mac_addr = NULL;
4046         bool pairwise;
4047         struct get_key_cookie cookie = {
4048                 .error = 0,
4049         };
4050         void *hdr;
4051         struct sk_buff *msg;
4052         bool bigtk_support = false;
4053
4054         if (wiphy_ext_feature_isset(&rdev->wiphy,
4055                                     NL80211_EXT_FEATURE_BEACON_PROTECTION))
4056                 bigtk_support = true;
4057
4058         if ((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_STATION ||
4059              dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_CLIENT) &&
4060             wiphy_ext_feature_isset(&rdev->wiphy,
4061                                     NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT))
4062                 bigtk_support = true;
4063
4064         if (info->attrs[NL80211_ATTR_KEY_IDX]) {
4065                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
4066
4067                 if (key_idx >= 6 && key_idx <= 7 && !bigtk_support) {
4068                         GENL_SET_ERR_MSG(info, "BIGTK not supported");
4069                         return -EINVAL;
4070                 }
4071         }
4072
4073         if (info->attrs[NL80211_ATTR_MAC])
4074                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4075
4076         pairwise = !!mac_addr;
4077         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
4078                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
4079
4080                 if (kt != NL80211_KEYTYPE_GROUP &&
4081                     kt != NL80211_KEYTYPE_PAIRWISE)
4082                         return -EINVAL;
4083                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
4084         }
4085
4086         if (!rdev->ops->get_key)
4087                 return -EOPNOTSUPP;
4088
4089         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4090                 return -ENOENT;
4091
4092         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4093         if (!msg)
4094                 return -ENOMEM;
4095
4096         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4097                              NL80211_CMD_NEW_KEY);
4098         if (!hdr)
4099                 goto nla_put_failure;
4100
4101         cookie.msg = msg;
4102         cookie.idx = key_idx;
4103
4104         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4105             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
4106                 goto nla_put_failure;
4107         if (mac_addr &&
4108             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
4109                 goto nla_put_failure;
4110
4111         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
4112                            get_key_callback);
4113
4114         if (err)
4115                 goto free_msg;
4116
4117         if (cookie.error)
4118                 goto nla_put_failure;
4119
4120         genlmsg_end(msg, hdr);
4121         return genlmsg_reply(msg, info);
4122
4123  nla_put_failure:
4124         err = -ENOBUFS;
4125  free_msg:
4126         nlmsg_free(msg);
4127         return err;
4128 }
4129
4130 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
4131 {
4132         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4133         struct key_parse key;
4134         int err;
4135         struct net_device *dev = info->user_ptr[1];
4136
4137         err = nl80211_parse_key(info, &key);
4138         if (err)
4139                 return err;
4140
4141         if (key.idx < 0)
4142                 return -EINVAL;
4143
4144         /* Only support setting default key and
4145          * Extended Key ID action NL80211_KEY_SET_TX.
4146          */
4147         if (!key.def && !key.defmgmt && !key.defbeacon &&
4148             !(key.p.mode == NL80211_KEY_SET_TX))
4149                 return -EINVAL;
4150
4151         wdev_lock(dev->ieee80211_ptr);
4152
4153         if (key.def) {
4154                 if (!rdev->ops->set_default_key) {
4155                         err = -EOPNOTSUPP;
4156                         goto out;
4157                 }
4158
4159                 err = nl80211_key_allowed(dev->ieee80211_ptr);
4160                 if (err)
4161                         goto out;
4162
4163                 err = rdev_set_default_key(rdev, dev, key.idx,
4164                                                  key.def_uni, key.def_multi);
4165
4166                 if (err)
4167                         goto out;
4168
4169 #ifdef CONFIG_CFG80211_WEXT
4170                 dev->ieee80211_ptr->wext.default_key = key.idx;
4171 #endif
4172         } else if (key.defmgmt) {
4173                 if (key.def_uni || !key.def_multi) {
4174                         err = -EINVAL;
4175                         goto out;
4176                 }
4177
4178                 if (!rdev->ops->set_default_mgmt_key) {
4179                         err = -EOPNOTSUPP;
4180                         goto out;
4181                 }
4182
4183                 err = nl80211_key_allowed(dev->ieee80211_ptr);
4184                 if (err)
4185                         goto out;
4186
4187                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
4188                 if (err)
4189                         goto out;
4190
4191 #ifdef CONFIG_CFG80211_WEXT
4192                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
4193 #endif
4194         } else if (key.defbeacon) {
4195                 if (key.def_uni || !key.def_multi) {
4196                         err = -EINVAL;
4197                         goto out;
4198                 }
4199
4200                 if (!rdev->ops->set_default_beacon_key) {
4201                         err = -EOPNOTSUPP;
4202                         goto out;
4203                 }
4204
4205                 err = nl80211_key_allowed(dev->ieee80211_ptr);
4206                 if (err)
4207                         goto out;
4208
4209                 err = rdev_set_default_beacon_key(rdev, dev, key.idx);
4210                 if (err)
4211                         goto out;
4212         } else if (key.p.mode == NL80211_KEY_SET_TX &&
4213                    wiphy_ext_feature_isset(&rdev->wiphy,
4214                                            NL80211_EXT_FEATURE_EXT_KEY_ID)) {
4215                 u8 *mac_addr = NULL;
4216
4217                 if (info->attrs[NL80211_ATTR_MAC])
4218                         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4219
4220                 if (!mac_addr || key.idx < 0 || key.idx > 1) {
4221                         err = -EINVAL;
4222                         goto out;
4223                 }
4224
4225                 err = rdev_add_key(rdev, dev, key.idx,
4226                                    NL80211_KEYTYPE_PAIRWISE,
4227                                    mac_addr, &key.p);
4228         } else {
4229                 err = -EINVAL;
4230         }
4231  out:
4232         wdev_unlock(dev->ieee80211_ptr);
4233
4234         return err;
4235 }
4236
4237 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
4238 {
4239         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4240         int err;
4241         struct net_device *dev = info->user_ptr[1];
4242         struct key_parse key;
4243         const u8 *mac_addr = NULL;
4244
4245         err = nl80211_parse_key(info, &key);
4246         if (err)
4247                 return err;
4248
4249         if (!key.p.key) {
4250                 GENL_SET_ERR_MSG(info, "no key");
4251                 return -EINVAL;
4252         }
4253
4254         if (info->attrs[NL80211_ATTR_MAC])
4255                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4256
4257         if (key.type == -1) {
4258                 if (mac_addr)
4259                         key.type = NL80211_KEYTYPE_PAIRWISE;
4260                 else
4261                         key.type = NL80211_KEYTYPE_GROUP;
4262         }
4263
4264         /* for now */
4265         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4266             key.type != NL80211_KEYTYPE_GROUP) {
4267                 GENL_SET_ERR_MSG(info, "key type not pairwise or group");
4268                 return -EINVAL;
4269         }
4270
4271         if (key.type == NL80211_KEYTYPE_GROUP &&
4272             info->attrs[NL80211_ATTR_VLAN_ID])
4273                 key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
4274
4275         if (!rdev->ops->add_key)
4276                 return -EOPNOTSUPP;
4277
4278         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
4279                                            key.type == NL80211_KEYTYPE_PAIRWISE,
4280                                            mac_addr)) {
4281                 GENL_SET_ERR_MSG(info, "key setting validation failed");
4282                 return -EINVAL;
4283         }
4284
4285         wdev_lock(dev->ieee80211_ptr);
4286         err = nl80211_key_allowed(dev->ieee80211_ptr);
4287         if (err)
4288                 GENL_SET_ERR_MSG(info, "key not allowed");
4289         if (!err) {
4290                 err = rdev_add_key(rdev, dev, key.idx,
4291                                    key.type == NL80211_KEYTYPE_PAIRWISE,
4292                                     mac_addr, &key.p);
4293                 if (err)
4294                         GENL_SET_ERR_MSG(info, "key addition failed");
4295         }
4296         wdev_unlock(dev->ieee80211_ptr);
4297
4298         return err;
4299 }
4300
4301 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
4302 {
4303         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4304         int err;
4305         struct net_device *dev = info->user_ptr[1];
4306         u8 *mac_addr = NULL;
4307         struct key_parse key;
4308
4309         err = nl80211_parse_key(info, &key);
4310         if (err)
4311                 return err;
4312
4313         if (info->attrs[NL80211_ATTR_MAC])
4314                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4315
4316         if (key.type == -1) {
4317                 if (mac_addr)
4318                         key.type = NL80211_KEYTYPE_PAIRWISE;
4319                 else
4320                         key.type = NL80211_KEYTYPE_GROUP;
4321         }
4322
4323         /* for now */
4324         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4325             key.type != NL80211_KEYTYPE_GROUP)
4326                 return -EINVAL;
4327
4328         if (!cfg80211_valid_key_idx(rdev, key.idx,
4329                                     key.type == NL80211_KEYTYPE_PAIRWISE))
4330                 return -EINVAL;
4331
4332         if (!rdev->ops->del_key)
4333                 return -EOPNOTSUPP;
4334
4335         wdev_lock(dev->ieee80211_ptr);
4336         err = nl80211_key_allowed(dev->ieee80211_ptr);
4337
4338         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
4339             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4340                 err = -ENOENT;
4341
4342         if (!err)
4343                 err = rdev_del_key(rdev, dev, key.idx,
4344                                    key.type == NL80211_KEYTYPE_PAIRWISE,
4345                                    mac_addr);
4346
4347 #ifdef CONFIG_CFG80211_WEXT
4348         if (!err) {
4349                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
4350                         dev->ieee80211_ptr->wext.default_key = -1;
4351                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
4352                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
4353         }
4354 #endif
4355         wdev_unlock(dev->ieee80211_ptr);
4356
4357         return err;
4358 }
4359
4360 /* This function returns an error or the number of nested attributes */
4361 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
4362 {
4363         struct nlattr *attr;
4364         int n_entries = 0, tmp;
4365
4366         nla_for_each_nested(attr, nl_attr, tmp) {
4367                 if (nla_len(attr) != ETH_ALEN)
4368                         return -EINVAL;
4369
4370                 n_entries++;
4371         }
4372
4373         return n_entries;
4374 }
4375
4376 /*
4377  * This function parses ACL information and allocates memory for ACL data.
4378  * On successful return, the calling function is responsible to free the
4379  * ACL buffer returned by this function.
4380  */
4381 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
4382                                                 struct genl_info *info)
4383 {
4384         enum nl80211_acl_policy acl_policy;
4385         struct nlattr *attr;
4386         struct cfg80211_acl_data *acl;
4387         int i = 0, n_entries, tmp;
4388
4389         if (!wiphy->max_acl_mac_addrs)
4390                 return ERR_PTR(-EOPNOTSUPP);
4391
4392         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
4393                 return ERR_PTR(-EINVAL);
4394
4395         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
4396         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
4397             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
4398                 return ERR_PTR(-EINVAL);
4399
4400         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
4401                 return ERR_PTR(-EINVAL);
4402
4403         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
4404         if (n_entries < 0)
4405                 return ERR_PTR(n_entries);
4406
4407         if (n_entries > wiphy->max_acl_mac_addrs)
4408                 return ERR_PTR(-ENOTSUPP);
4409
4410         acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL);
4411         if (!acl)
4412                 return ERR_PTR(-ENOMEM);
4413
4414         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
4415                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
4416                 i++;
4417         }
4418
4419         acl->n_acl_entries = n_entries;
4420         acl->acl_policy = acl_policy;
4421
4422         return acl;
4423 }
4424
4425 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
4426 {
4427         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4428         struct net_device *dev = info->user_ptr[1];
4429         struct cfg80211_acl_data *acl;
4430         int err;
4431
4432         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4433             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4434                 return -EOPNOTSUPP;
4435
4436         if (!dev->ieee80211_ptr->beacon_interval)
4437                 return -EINVAL;
4438
4439         acl = parse_acl_data(&rdev->wiphy, info);
4440         if (IS_ERR(acl))
4441                 return PTR_ERR(acl);
4442
4443         err = rdev_set_mac_acl(rdev, dev, acl);
4444
4445         kfree(acl);
4446
4447         return err;
4448 }
4449
4450 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4451                            u8 *rates, u8 rates_len)
4452 {
4453         u8 i;
4454         u32 mask = 0;
4455
4456         for (i = 0; i < rates_len; i++) {
4457                 int rate = (rates[i] & 0x7f) * 5;
4458                 int ridx;
4459
4460                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4461                         struct ieee80211_rate *srate =
4462                                 &sband->bitrates[ridx];
4463                         if (rate == srate->bitrate) {
4464                                 mask |= 1 << ridx;
4465                                 break;
4466                         }
4467                 }
4468                 if (ridx == sband->n_bitrates)
4469                         return 0; /* rate not found */
4470         }
4471
4472         return mask;
4473 }
4474
4475 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
4476                                u8 *rates, u8 rates_len,
4477                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
4478 {
4479         u8 i;
4480
4481         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
4482
4483         for (i = 0; i < rates_len; i++) {
4484                 int ridx, rbit;
4485
4486                 ridx = rates[i] / 8;
4487                 rbit = BIT(rates[i] % 8);
4488
4489                 /* check validity */
4490                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
4491                         return false;
4492
4493                 /* check availability */
4494                 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
4495                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
4496                         mcs[ridx] |= rbit;
4497                 else
4498                         return false;
4499         }
4500
4501         return true;
4502 }
4503
4504 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
4505 {
4506         u16 mcs_mask = 0;
4507
4508         switch (vht_mcs_map) {
4509         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
4510                 break;
4511         case IEEE80211_VHT_MCS_SUPPORT_0_7:
4512                 mcs_mask = 0x00FF;
4513                 break;
4514         case IEEE80211_VHT_MCS_SUPPORT_0_8:
4515                 mcs_mask = 0x01FF;
4516                 break;
4517         case IEEE80211_VHT_MCS_SUPPORT_0_9:
4518                 mcs_mask = 0x03FF;
4519                 break;
4520         default:
4521                 break;
4522         }
4523
4524         return mcs_mask;
4525 }
4526
4527 static void vht_build_mcs_mask(u16 vht_mcs_map,
4528                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
4529 {
4530         u8 nss;
4531
4532         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
4533                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
4534                 vht_mcs_map >>= 2;
4535         }
4536 }
4537
4538 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
4539                              struct nl80211_txrate_vht *txrate,
4540                              u16 mcs[NL80211_VHT_NSS_MAX])
4541 {
4542         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4543         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
4544         u8 i;
4545
4546         if (!sband->vht_cap.vht_supported)
4547                 return false;
4548
4549         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
4550
4551         /* Build vht_mcs_mask from VHT capabilities */
4552         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
4553
4554         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
4555                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
4556                         mcs[i] = txrate->mcs[i];
4557                 else
4558                         return false;
4559         }
4560
4561         return true;
4562 }
4563
4564 static u16 he_mcs_map_to_mcs_mask(u8 he_mcs_map)
4565 {
4566         switch (he_mcs_map) {
4567         case IEEE80211_HE_MCS_NOT_SUPPORTED:
4568                 return 0;
4569         case IEEE80211_HE_MCS_SUPPORT_0_7:
4570                 return 0x00FF;
4571         case IEEE80211_HE_MCS_SUPPORT_0_9:
4572                 return 0x03FF;
4573         case IEEE80211_HE_MCS_SUPPORT_0_11:
4574                 return 0xFFF;
4575         default:
4576                 break;
4577         }
4578         return 0;
4579 }
4580
4581 static void he_build_mcs_mask(u16 he_mcs_map,
4582                               u16 he_mcs_mask[NL80211_HE_NSS_MAX])
4583 {
4584         u8 nss;
4585
4586         for (nss = 0; nss < NL80211_HE_NSS_MAX; nss++) {
4587                 he_mcs_mask[nss] = he_mcs_map_to_mcs_mask(he_mcs_map & 0x03);
4588                 he_mcs_map >>= 2;
4589         }
4590 }
4591
4592 static u16 he_get_txmcsmap(struct genl_info *info,
4593                            const struct ieee80211_sta_he_cap *he_cap)
4594 {
4595         struct net_device *dev = info->user_ptr[1];
4596         struct wireless_dev *wdev = dev->ieee80211_ptr;
4597         __le16  tx_mcs;
4598
4599         switch (wdev->chandef.width) {
4600         case NL80211_CHAN_WIDTH_80P80:
4601                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80p80;
4602                 break;
4603         case NL80211_CHAN_WIDTH_160:
4604                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_160;
4605                 break;
4606         default:
4607                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80;
4608                 break;
4609         }
4610         return le16_to_cpu(tx_mcs);
4611 }
4612
4613 static bool he_set_mcs_mask(struct genl_info *info,
4614                             struct wireless_dev *wdev,
4615                             struct ieee80211_supported_band *sband,
4616                             struct nl80211_txrate_he *txrate,
4617                             u16 mcs[NL80211_HE_NSS_MAX])
4618 {
4619         const struct ieee80211_sta_he_cap *he_cap;
4620         u16 tx_mcs_mask[NL80211_HE_NSS_MAX] = {};
4621         u16 tx_mcs_map = 0;
4622         u8 i;
4623
4624         he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
4625         if (!he_cap)
4626                 return false;
4627
4628         memset(mcs, 0, sizeof(u16) * NL80211_HE_NSS_MAX);
4629
4630         tx_mcs_map = he_get_txmcsmap(info, he_cap);
4631
4632         /* Build he_mcs_mask from HE capabilities */
4633         he_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
4634
4635         for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
4636                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
4637                         mcs[i] = txrate->mcs[i];
4638                 else
4639                         return false;
4640         }
4641
4642         return true;
4643 }
4644
4645 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
4646                                          struct nlattr *attrs[],
4647                                          enum nl80211_attrs attr,
4648                                          struct cfg80211_bitrate_mask *mask,
4649                                          struct net_device *dev,
4650                                          bool default_all_enabled)
4651 {
4652         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
4653         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4654         struct wireless_dev *wdev = dev->ieee80211_ptr;
4655         int rem, i;
4656         struct nlattr *tx_rates;
4657         struct ieee80211_supported_band *sband;
4658         u16 vht_tx_mcs_map, he_tx_mcs_map;
4659
4660         memset(mask, 0, sizeof(*mask));
4661         /* Default to all rates enabled */
4662         for (i = 0; i < NUM_NL80211_BANDS; i++) {
4663                 const struct ieee80211_sta_he_cap *he_cap;
4664
4665                 if (!default_all_enabled)
4666                         break;
4667
4668                 sband = rdev->wiphy.bands[i];
4669
4670                 if (!sband)
4671                         continue;
4672
4673                 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
4674                 memcpy(mask->control[i].ht_mcs,
4675                        sband->ht_cap.mcs.rx_mask,
4676                        sizeof(mask->control[i].ht_mcs));
4677
4678                 if (!sband->vht_cap.vht_supported)
4679                         continue;
4680
4681                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4682                 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
4683
4684                 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
4685                 if (!he_cap)
4686                         continue;
4687
4688                 he_tx_mcs_map = he_get_txmcsmap(info, he_cap);
4689                 he_build_mcs_mask(he_tx_mcs_map, mask->control[i].he_mcs);
4690
4691                 mask->control[i].he_gi = 0xFF;
4692                 mask->control[i].he_ltf = 0xFF;
4693         }
4694
4695         /* if no rates are given set it back to the defaults */
4696         if (!attrs[attr])
4697                 goto out;
4698
4699         /* The nested attribute uses enum nl80211_band as the index. This maps
4700          * directly to the enum nl80211_band values used in cfg80211.
4701          */
4702         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
4703         nla_for_each_nested(tx_rates, attrs[attr], rem) {
4704                 enum nl80211_band band = nla_type(tx_rates);
4705                 int err;
4706
4707                 if (band < 0 || band >= NUM_NL80211_BANDS)
4708                         return -EINVAL;
4709                 sband = rdev->wiphy.bands[band];
4710                 if (sband == NULL)
4711                         return -EINVAL;
4712                 err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX,
4713                                                   tx_rates,
4714                                                   nl80211_txattr_policy,
4715                                                   info->extack);
4716                 if (err)
4717                         return err;
4718                 if (tb[NL80211_TXRATE_LEGACY]) {
4719                         mask->control[band].legacy = rateset_to_mask(
4720                                 sband,
4721                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
4722                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
4723                         if ((mask->control[band].legacy == 0) &&
4724                             nla_len(tb[NL80211_TXRATE_LEGACY]))
4725                                 return -EINVAL;
4726                 }
4727                 if (tb[NL80211_TXRATE_HT]) {
4728                         if (!ht_rateset_to_mask(
4729                                         sband,
4730                                         nla_data(tb[NL80211_TXRATE_HT]),
4731                                         nla_len(tb[NL80211_TXRATE_HT]),
4732                                         mask->control[band].ht_mcs))
4733                                 return -EINVAL;
4734                 }
4735
4736                 if (tb[NL80211_TXRATE_VHT]) {
4737                         if (!vht_set_mcs_mask(
4738                                         sband,
4739                                         nla_data(tb[NL80211_TXRATE_VHT]),
4740                                         mask->control[band].vht_mcs))
4741                                 return -EINVAL;
4742                 }
4743
4744                 if (tb[NL80211_TXRATE_GI]) {
4745                         mask->control[band].gi =
4746                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
4747                         if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
4748                                 return -EINVAL;
4749                 }
4750                 if (tb[NL80211_TXRATE_HE] &&
4751                     !he_set_mcs_mask(info, wdev, sband,
4752                                      nla_data(tb[NL80211_TXRATE_HE]),
4753                                      mask->control[band].he_mcs))
4754                         return -EINVAL;
4755
4756                 if (tb[NL80211_TXRATE_HE_GI])
4757                         mask->control[band].he_gi =
4758                                 nla_get_u8(tb[NL80211_TXRATE_HE_GI]);
4759                 if (tb[NL80211_TXRATE_HE_LTF])
4760                         mask->control[band].he_ltf =
4761                                 nla_get_u8(tb[NL80211_TXRATE_HE_LTF]);
4762
4763                 if (mask->control[band].legacy == 0) {
4764                         /* don't allow empty legacy rates if HT, VHT or HE
4765                          * are not even supported.
4766                          */
4767                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
4768                               rdev->wiphy.bands[band]->vht_cap.vht_supported ||
4769                               ieee80211_get_he_iftype_cap(sband, wdev->iftype)))
4770                                 return -EINVAL;
4771
4772                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
4773                                 if (mask->control[band].ht_mcs[i])
4774                                         goto out;
4775
4776                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
4777                                 if (mask->control[band].vht_mcs[i])
4778                                         goto out;
4779
4780                         for (i = 0; i < NL80211_HE_NSS_MAX; i++)
4781                                 if (mask->control[band].he_mcs[i])
4782                                         goto out;
4783
4784                         /* legacy and mcs rates may not be both empty */
4785                         return -EINVAL;
4786                 }
4787         }
4788
4789 out:
4790         return 0;
4791 }
4792
4793 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
4794                                    enum nl80211_band band,
4795                                    struct cfg80211_bitrate_mask *beacon_rate)
4796 {
4797         u32 count_ht, count_vht, count_he, i;
4798         u32 rate = beacon_rate->control[band].legacy;
4799
4800         /* Allow only one rate */
4801         if (hweight32(rate) > 1)
4802                 return -EINVAL;
4803
4804         count_ht = 0;
4805         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
4806                 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
4807                         return -EINVAL;
4808                 } else if (beacon_rate->control[band].ht_mcs[i]) {
4809                         count_ht++;
4810                         if (count_ht > 1)
4811                                 return -EINVAL;
4812                 }
4813                 if (count_ht && rate)
4814                         return -EINVAL;
4815         }
4816
4817         count_vht = 0;
4818         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
4819                 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
4820                         return -EINVAL;
4821                 } else if (beacon_rate->control[band].vht_mcs[i]) {
4822                         count_vht++;
4823                         if (count_vht > 1)
4824                                 return -EINVAL;
4825                 }
4826                 if (count_vht && rate)
4827                         return -EINVAL;
4828         }
4829
4830         count_he = 0;
4831         for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
4832                 if (hweight16(beacon_rate->control[band].he_mcs[i]) > 1) {
4833                         return -EINVAL;
4834                 } else if (beacon_rate->control[band].he_mcs[i]) {
4835                         count_he++;
4836                         if (count_he > 1)
4837                                 return -EINVAL;
4838                 }
4839                 if (count_he && rate)
4840                         return -EINVAL;
4841         }
4842
4843         if ((count_ht && count_vht && count_he) ||
4844             (!rate && !count_ht && !count_vht && !count_he))
4845                 return -EINVAL;
4846
4847         if (rate &&
4848             !wiphy_ext_feature_isset(&rdev->wiphy,
4849                                      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
4850                 return -EINVAL;
4851         if (count_ht &&
4852             !wiphy_ext_feature_isset(&rdev->wiphy,
4853                                      NL80211_EXT_FEATURE_BEACON_RATE_HT))
4854                 return -EINVAL;
4855         if (count_vht &&
4856             !wiphy_ext_feature_isset(&rdev->wiphy,
4857                                      NL80211_EXT_FEATURE_BEACON_RATE_VHT))
4858                 return -EINVAL;
4859         if (count_he &&
4860             !wiphy_ext_feature_isset(&rdev->wiphy,
4861                                      NL80211_EXT_FEATURE_BEACON_RATE_HE))
4862                 return -EINVAL;
4863
4864         return 0;
4865 }
4866
4867 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
4868                                 struct nlattr *attrs[],
4869                                 struct cfg80211_beacon_data *bcn)
4870 {
4871         bool haveinfo = false;
4872         int err;
4873
4874         memset(bcn, 0, sizeof(*bcn));
4875
4876         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
4877                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
4878                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
4879                 if (!bcn->head_len)
4880                         return -EINVAL;
4881                 haveinfo = true;
4882         }
4883
4884         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
4885                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
4886                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
4887                 haveinfo = true;
4888         }
4889
4890         if (!haveinfo)
4891                 return -EINVAL;
4892
4893         if (attrs[NL80211_ATTR_IE]) {
4894                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
4895                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
4896         }
4897
4898         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
4899                 bcn->proberesp_ies =
4900                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4901                 bcn->proberesp_ies_len =
4902                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4903         }
4904
4905         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
4906                 bcn->assocresp_ies =
4907                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4908                 bcn->assocresp_ies_len =
4909                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4910         }
4911
4912         if (attrs[NL80211_ATTR_PROBE_RESP]) {
4913                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
4914                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
4915         }
4916
4917         if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
4918                 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
4919
4920                 err = nla_parse_nested_deprecated(tb,
4921                                                   NL80211_FTM_RESP_ATTR_MAX,
4922                                                   attrs[NL80211_ATTR_FTM_RESPONDER],
4923                                                   NULL, NULL);
4924                 if (err)
4925                         return err;
4926
4927                 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
4928                     wiphy_ext_feature_isset(&rdev->wiphy,
4929                                             NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
4930                         bcn->ftm_responder = 1;
4931                 else
4932                         return -EOPNOTSUPP;
4933
4934                 if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
4935                         bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
4936                         bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
4937                 }
4938
4939                 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
4940                         bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
4941                         bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
4942                 }
4943         } else {
4944                 bcn->ftm_responder = -1;
4945         }
4946
4947         return 0;
4948 }
4949
4950 static int nl80211_parse_he_obss_pd(struct nlattr *attrs,
4951                                     struct ieee80211_he_obss_pd *he_obss_pd)
4952 {
4953         struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1];
4954         int err;
4955
4956         err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs,
4957                                he_obss_pd_policy, NULL);
4958         if (err)
4959                 return err;
4960
4961         if (!tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL])
4962                 return -EINVAL;
4963
4964         he_obss_pd->sr_ctrl = nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]);
4965
4966         if (tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET])
4967                 he_obss_pd->min_offset =
4968                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]);
4969         if (tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET])
4970                 he_obss_pd->max_offset =
4971                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]);
4972         if (tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET])
4973                 he_obss_pd->non_srg_max_offset =
4974                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]);
4975
4976         if (he_obss_pd->min_offset > he_obss_pd->max_offset)
4977                 return -EINVAL;
4978
4979         if (tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP])
4980                 memcpy(he_obss_pd->bss_color_bitmap,
4981                        nla_data(tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]),
4982                        sizeof(he_obss_pd->bss_color_bitmap));
4983
4984         if (tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP])
4985                 memcpy(he_obss_pd->partial_bssid_bitmap,
4986                        nla_data(tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]),
4987                        sizeof(he_obss_pd->partial_bssid_bitmap));
4988
4989         he_obss_pd->enable = true;
4990
4991         return 0;
4992 }
4993
4994 static int nl80211_parse_he_bss_color(struct nlattr *attrs,
4995                                       struct cfg80211_he_bss_color *he_bss_color)
4996 {
4997         struct nlattr *tb[NL80211_HE_BSS_COLOR_ATTR_MAX + 1];
4998         int err;
4999
5000         err = nla_parse_nested(tb, NL80211_HE_BSS_COLOR_ATTR_MAX, attrs,
5001                                he_bss_color_policy, NULL);
5002         if (err)
5003                 return err;
5004
5005         if (!tb[NL80211_HE_BSS_COLOR_ATTR_COLOR])
5006                 return -EINVAL;
5007
5008         he_bss_color->color =
5009                 nla_get_u8(tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]);
5010         he_bss_color->enabled =
5011                 !nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_DISABLED]);
5012         he_bss_color->partial =
5013                 nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_PARTIAL]);
5014
5015         return 0;
5016 }
5017
5018 static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev,
5019                                         struct nlattr *attrs,
5020                                         struct cfg80211_ap_settings *params)
5021 {
5022         struct nlattr *tb[NL80211_FILS_DISCOVERY_ATTR_MAX + 1];
5023         int ret;
5024         struct cfg80211_fils_discovery *fd = &params->fils_discovery;
5025
5026         if (!wiphy_ext_feature_isset(&rdev->wiphy,
5027                                      NL80211_EXT_FEATURE_FILS_DISCOVERY))
5028                 return -EINVAL;
5029
5030         ret = nla_parse_nested(tb, NL80211_FILS_DISCOVERY_ATTR_MAX, attrs,
5031                                NULL, NULL);
5032         if (ret)
5033                 return ret;
5034
5035         if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] ||
5036             !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] ||
5037             !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL])
5038                 return -EINVAL;
5039
5040         fd->tmpl_len = nla_len(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5041         fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5042         fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]);
5043         fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]);
5044
5045         return 0;
5046 }
5047
5048 static int
5049 nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device *rdev,
5050                                      struct nlattr *attrs,
5051                                      struct cfg80211_ap_settings *params)
5052 {
5053         struct nlattr *tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1];
5054         int ret;
5055         struct cfg80211_unsol_bcast_probe_resp *presp =
5056                                         &params->unsol_bcast_probe_resp;
5057
5058         if (!wiphy_ext_feature_isset(&rdev->wiphy,
5059                                      NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP))
5060                 return -EINVAL;
5061
5062         ret = nla_parse_nested(tb, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX,
5063                                attrs, NULL, NULL);
5064         if (ret)
5065                 return ret;
5066
5067         if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] ||
5068             !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL])
5069                 return -EINVAL;
5070
5071         presp->tmpl = nla_data(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5072         presp->tmpl_len = nla_len(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5073         presp->interval = nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT]);
5074         return 0;
5075 }
5076
5077 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
5078                                             const u8 *rates)
5079 {
5080         int i;
5081
5082         if (!rates)
5083                 return;
5084
5085         for (i = 0; i < rates[1]; i++) {
5086                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
5087                         params->ht_required = true;
5088                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
5089                         params->vht_required = true;
5090                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HE_PHY)
5091                         params->he_required = true;
5092                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_SAE_H2E)
5093                         params->sae_h2e_required = true;
5094         }
5095 }
5096
5097 /*
5098  * Since the nl80211 API didn't include, from the beginning, attributes about
5099  * HT/VHT requirements/capabilities, we parse them out of the IEs for the
5100  * benefit of drivers that rebuild IEs in the firmware.
5101  */
5102 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
5103 {
5104         const struct cfg80211_beacon_data *bcn = &params->beacon;
5105         size_t ies_len = bcn->tail_len;
5106         const u8 *ies = bcn->tail;
5107         const u8 *rates;
5108         const u8 *cap;
5109
5110         rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len);
5111         nl80211_check_ap_rate_selectors(params, rates);
5112
5113         rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
5114         nl80211_check_ap_rate_selectors(params, rates);
5115
5116         cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len);
5117         if (cap && cap[1] >= sizeof(*params->ht_cap))
5118                 params->ht_cap = (void *)(cap + 2);
5119         cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
5120         if (cap && cap[1] >= sizeof(*params->vht_cap))
5121                 params->vht_cap = (void *)(cap + 2);
5122         cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
5123         if (cap && cap[1] >= sizeof(*params->he_cap) + 1)
5124                 params->he_cap = (void *)(cap + 3);
5125         cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_OPERATION, ies, ies_len);
5126         if (cap && cap[1] >= sizeof(*params->he_oper) + 1)
5127                 params->he_oper = (void *)(cap + 3);
5128 }
5129
5130 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
5131                                    struct cfg80211_ap_settings *params)
5132 {
5133         struct wireless_dev *wdev;
5134         bool ret = false;
5135
5136         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
5137                 if (wdev->iftype != NL80211_IFTYPE_AP &&
5138                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
5139                         continue;
5140
5141                 if (!wdev->preset_chandef.chan)
5142                         continue;
5143
5144                 params->chandef = wdev->preset_chandef;
5145                 ret = true;
5146                 break;
5147         }
5148
5149         return ret;
5150 }
5151
5152 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
5153                                     enum nl80211_auth_type auth_type,
5154                                     enum nl80211_commands cmd)
5155 {
5156         if (auth_type > NL80211_AUTHTYPE_MAX)
5157                 return false;
5158
5159         switch (cmd) {
5160         case NL80211_CMD_AUTHENTICATE:
5161                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
5162                     auth_type == NL80211_AUTHTYPE_SAE)
5163                         return false;
5164                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5165                                              NL80211_EXT_FEATURE_FILS_STA) &&
5166                     (auth_type == NL80211_AUTHTYPE_FILS_SK ||
5167                      auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5168                      auth_type == NL80211_AUTHTYPE_FILS_PK))
5169                         return false;
5170                 return true;
5171         case NL80211_CMD_CONNECT:
5172                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
5173                     !wiphy_ext_feature_isset(&rdev->wiphy,
5174                                              NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
5175                     auth_type == NL80211_AUTHTYPE_SAE)
5176                         return false;
5177
5178                 /* FILS with SK PFS or PK not supported yet */
5179                 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5180                     auth_type == NL80211_AUTHTYPE_FILS_PK)
5181                         return false;
5182                 if (!wiphy_ext_feature_isset(
5183                             &rdev->wiphy,
5184                             NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
5185                     auth_type == NL80211_AUTHTYPE_FILS_SK)
5186                         return false;
5187                 return true;
5188         case NL80211_CMD_START_AP:
5189                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5190                                              NL80211_EXT_FEATURE_SAE_OFFLOAD_AP) &&
5191                     auth_type == NL80211_AUTHTYPE_SAE)
5192                         return false;
5193                 /* FILS not supported yet */
5194                 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
5195                     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5196                     auth_type == NL80211_AUTHTYPE_FILS_PK)
5197                         return false;
5198                 return true;
5199         default:
5200                 return false;
5201         }
5202 }
5203
5204 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
5205 {
5206         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5207         struct net_device *dev = info->user_ptr[1];
5208         struct wireless_dev *wdev = dev->ieee80211_ptr;
5209         struct cfg80211_ap_settings params;
5210         int err;
5211
5212         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5213             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5214                 return -EOPNOTSUPP;
5215
5216         if (!rdev->ops->start_ap)
5217                 return -EOPNOTSUPP;
5218
5219         if (wdev->beacon_interval)
5220                 return -EALREADY;
5221
5222         memset(&params, 0, sizeof(params));
5223
5224         /* these are required for START_AP */
5225         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
5226             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
5227             !info->attrs[NL80211_ATTR_BEACON_HEAD])
5228                 return -EINVAL;
5229
5230         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon);
5231         if (err)
5232                 return err;
5233
5234         params.beacon_interval =
5235                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
5236         params.dtim_period =
5237                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
5238
5239         err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
5240                                            params.beacon_interval);
5241         if (err)
5242                 return err;
5243
5244         /*
5245          * In theory, some of these attributes should be required here
5246          * but since they were not used when the command was originally
5247          * added, keep them optional for old user space programs to let
5248          * them continue to work with drivers that do not need the
5249          * additional information -- drivers must check!
5250          */
5251         if (info->attrs[NL80211_ATTR_SSID]) {
5252                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5253                 params.ssid_len =
5254                         nla_len(info->attrs[NL80211_ATTR_SSID]);
5255                 if (params.ssid_len == 0)
5256                         return -EINVAL;
5257         }
5258
5259         if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
5260                 params.hidden_ssid = nla_get_u32(
5261                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
5262
5263         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
5264
5265         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
5266                 params.auth_type = nla_get_u32(
5267                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
5268                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
5269                                              NL80211_CMD_START_AP))
5270                         return -EINVAL;
5271         } else
5272                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
5273
5274         err = nl80211_crypto_settings(rdev, info, &params.crypto,
5275                                       NL80211_MAX_NR_CIPHER_SUITES);
5276         if (err)
5277                 return err;
5278
5279         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
5280                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
5281                         return -EOPNOTSUPP;
5282                 params.inactivity_timeout = nla_get_u16(
5283                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
5284         }
5285
5286         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
5287                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5288                         return -EINVAL;
5289                 params.p2p_ctwindow =
5290                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
5291                 if (params.p2p_ctwindow != 0 &&
5292                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
5293                         return -EINVAL;
5294         }
5295
5296         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
5297                 u8 tmp;
5298
5299                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5300                         return -EINVAL;
5301                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
5302                 params.p2p_opp_ps = tmp;
5303                 if (params.p2p_opp_ps != 0 &&
5304                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
5305                         return -EINVAL;
5306         }
5307
5308         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
5309                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
5310                 if (err)
5311                         return err;
5312         } else if (wdev->preset_chandef.chan) {
5313                 params.chandef = wdev->preset_chandef;
5314         } else if (!nl80211_get_ap_channel(rdev, &params))
5315                 return -EINVAL;
5316
5317         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
5318                                            wdev->iftype))
5319                 return -EINVAL;
5320
5321         if (info->attrs[NL80211_ATTR_TX_RATES]) {
5322                 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
5323                                                     NL80211_ATTR_TX_RATES,
5324                                                     &params.beacon_rate,
5325                                                     dev, false);
5326                 if (err)
5327                         return err;
5328
5329                 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
5330                                               &params.beacon_rate);
5331                 if (err)
5332                         return err;
5333         }
5334
5335         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
5336                 params.smps_mode =
5337                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
5338                 switch (params.smps_mode) {
5339                 case NL80211_SMPS_OFF:
5340                         break;
5341                 case NL80211_SMPS_STATIC:
5342                         if (!(rdev->wiphy.features &
5343                               NL80211_FEATURE_STATIC_SMPS))
5344                                 return -EINVAL;
5345                         break;
5346                 case NL80211_SMPS_DYNAMIC:
5347                         if (!(rdev->wiphy.features &
5348                               NL80211_FEATURE_DYNAMIC_SMPS))
5349                                 return -EINVAL;
5350                         break;
5351                 default:
5352                         return -EINVAL;
5353                 }
5354         } else {
5355                 params.smps_mode = NL80211_SMPS_OFF;
5356         }
5357
5358         params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
5359         if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
5360                 return -EOPNOTSUPP;
5361
5362         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
5363                 params.acl = parse_acl_data(&rdev->wiphy, info);
5364                 if (IS_ERR(params.acl))
5365                         return PTR_ERR(params.acl);
5366         }
5367
5368         params.twt_responder =
5369                     nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]);
5370
5371         if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) {
5372                 err = nl80211_parse_he_obss_pd(
5373                                         info->attrs[NL80211_ATTR_HE_OBSS_PD],
5374                                         &params.he_obss_pd);
5375                 if (err)
5376                         goto out;
5377         }
5378
5379         if (info->attrs[NL80211_ATTR_HE_BSS_COLOR]) {
5380                 err = nl80211_parse_he_bss_color(
5381                                         info->attrs[NL80211_ATTR_HE_BSS_COLOR],
5382                                         &params.he_bss_color);
5383                 if (err)
5384                         goto out;
5385         }
5386
5387         if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) {
5388                 err = nl80211_parse_fils_discovery(rdev,
5389                                                    info->attrs[NL80211_ATTR_FILS_DISCOVERY],
5390                                                    &params);
5391                 if (err)
5392                         goto out;
5393         }
5394
5395         if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
5396                 err = nl80211_parse_unsol_bcast_probe_resp(
5397                         rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
5398                         &params);
5399                 if (err)
5400                         return err;
5401         }
5402
5403         nl80211_calculate_ap_params(&params);
5404
5405         if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
5406                 params.flags |= AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
5407
5408         wdev_lock(wdev);
5409         err = rdev_start_ap(rdev, dev, &params);
5410         if (!err) {
5411                 wdev->preset_chandef = params.chandef;
5412                 wdev->beacon_interval = params.beacon_interval;
5413                 wdev->chandef = params.chandef;
5414                 wdev->ssid_len = params.ssid_len;
5415                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
5416
5417                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
5418                         wdev->conn_owner_nlportid = info->snd_portid;
5419         }
5420         wdev_unlock(wdev);
5421
5422 out:
5423         kfree(params.acl);
5424
5425         return err;
5426 }
5427
5428 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
5429 {
5430         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5431         struct net_device *dev = info->user_ptr[1];
5432         struct wireless_dev *wdev = dev->ieee80211_ptr;
5433         struct cfg80211_beacon_data params;
5434         int err;
5435
5436         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5437             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5438                 return -EOPNOTSUPP;
5439
5440         if (!rdev->ops->change_beacon)
5441                 return -EOPNOTSUPP;
5442
5443         if (!wdev->beacon_interval)
5444                 return -EINVAL;
5445
5446         err = nl80211_parse_beacon(rdev, info->attrs, &params);
5447         if (err)
5448                 return err;
5449
5450         wdev_lock(wdev);
5451         err = rdev_change_beacon(rdev, dev, &params);
5452         wdev_unlock(wdev);
5453
5454         return err;
5455 }
5456
5457 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
5458 {
5459         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5460         struct net_device *dev = info->user_ptr[1];
5461
5462         return cfg80211_stop_ap(rdev, dev, false);
5463 }
5464
5465 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
5466         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
5467         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
5468         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
5469         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
5470         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
5471         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
5472 };
5473
5474 static int parse_station_flags(struct genl_info *info,
5475                                enum nl80211_iftype iftype,
5476                                struct station_parameters *params)
5477 {
5478         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
5479         struct nlattr *nla;
5480         int flag;
5481
5482         /*
5483          * Try parsing the new attribute first so userspace
5484          * can specify both for older kernels.
5485          */
5486         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
5487         if (nla) {
5488                 struct nl80211_sta_flag_update *sta_flags;
5489
5490                 sta_flags = nla_data(nla);
5491                 params->sta_flags_mask = sta_flags->mask;
5492                 params->sta_flags_set = sta_flags->set;
5493                 params->sta_flags_set &= params->sta_flags_mask;
5494                 if ((params->sta_flags_mask |
5495                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
5496                         return -EINVAL;
5497                 return 0;
5498         }
5499
5500         /* if present, parse the old attribute */
5501
5502         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
5503         if (!nla)
5504                 return 0;
5505
5506         if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack))
5507                 return -EINVAL;
5508
5509         /*
5510          * Only allow certain flags for interface types so that
5511          * other attributes are silently ignored. Remember that
5512          * this is backward compatibility code with old userspace
5513          * and shouldn't be hit in other cases anyway.
5514          */
5515         switch (iftype) {
5516         case NL80211_IFTYPE_AP:
5517         case NL80211_IFTYPE_AP_VLAN:
5518         case NL80211_IFTYPE_P2P_GO:
5519                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
5520                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
5521                                          BIT(NL80211_STA_FLAG_WME) |
5522                                          BIT(NL80211_STA_FLAG_MFP);
5523                 break;
5524         case NL80211_IFTYPE_P2P_CLIENT:
5525         case NL80211_IFTYPE_STATION:
5526                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
5527                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
5528                 break;
5529         case NL80211_IFTYPE_MESH_POINT:
5530                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5531                                          BIT(NL80211_STA_FLAG_MFP) |
5532                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
5533                 break;
5534         default:
5535                 return -EINVAL;
5536         }
5537
5538         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
5539                 if (flags[flag]) {
5540                         params->sta_flags_set |= (1<<flag);
5541
5542                         /* no longer support new API additions in old API */
5543                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
5544                                 return -EINVAL;
5545                 }
5546         }
5547
5548         return 0;
5549 }
5550
5551 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
5552 {
5553         struct nlattr *rate;
5554         u32 bitrate;
5555         u16 bitrate_compat;
5556         enum nl80211_rate_info rate_flg;
5557
5558         rate = nla_nest_start_noflag(msg, attr);
5559         if (!rate)
5560                 return false;
5561
5562         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
5563         bitrate = cfg80211_calculate_bitrate(info);
5564         /* report 16-bit bitrate only if we can */
5565         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
5566         if (bitrate > 0 &&
5567             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
5568                 return false;
5569         if (bitrate_compat > 0 &&
5570             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
5571                 return false;
5572
5573         switch (info->bw) {
5574         case RATE_INFO_BW_5:
5575                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
5576                 break;
5577         case RATE_INFO_BW_10:
5578                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
5579                 break;
5580         default:
5581                 WARN_ON(1);
5582                 fallthrough;
5583         case RATE_INFO_BW_20:
5584                 rate_flg = 0;
5585                 break;
5586         case RATE_INFO_BW_40:
5587                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
5588                 break;
5589         case RATE_INFO_BW_80:
5590                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
5591                 break;
5592         case RATE_INFO_BW_160:
5593                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
5594                 break;
5595         case RATE_INFO_BW_HE_RU:
5596                 rate_flg = 0;
5597                 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
5598         }
5599
5600         if (rate_flg && nla_put_flag(msg, rate_flg))
5601                 return false;
5602
5603         if (info->flags & RATE_INFO_FLAGS_MCS) {
5604                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
5605                         return false;
5606                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
5607                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
5608                         return false;
5609         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
5610                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
5611                         return false;
5612                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
5613                         return false;
5614                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
5615                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
5616                         return false;
5617         } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
5618                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
5619                         return false;
5620                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
5621                         return false;
5622                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
5623                         return false;
5624                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
5625                         return false;
5626                 if (info->bw == RATE_INFO_BW_HE_RU &&
5627                     nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
5628                                info->he_ru_alloc))
5629                         return false;
5630         }
5631
5632         nla_nest_end(msg, rate);
5633         return true;
5634 }
5635
5636 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
5637                                int id)
5638 {
5639         void *attr;
5640         int i = 0;
5641
5642         if (!mask)
5643                 return true;
5644
5645         attr = nla_nest_start_noflag(msg, id);
5646         if (!attr)
5647                 return false;
5648
5649         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
5650                 if (!(mask & BIT(i)))
5651                         continue;
5652
5653                 if (nla_put_u8(msg, i, signal[i]))
5654                         return false;
5655         }
5656
5657         nla_nest_end(msg, attr);
5658
5659         return true;
5660 }
5661
5662 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
5663                                 u32 seq, int flags,
5664                                 struct cfg80211_registered_device *rdev,
5665                                 struct net_device *dev,
5666                                 const u8 *mac_addr, struct station_info *sinfo)
5667 {
5668         void *hdr;
5669         struct nlattr *sinfoattr, *bss_param;
5670
5671         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
5672         if (!hdr) {
5673                 cfg80211_sinfo_release_content(sinfo);
5674                 return -1;
5675         }
5676
5677         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5678             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
5679             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
5680                 goto nla_put_failure;
5681
5682         sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
5683         if (!sinfoattr)
5684                 goto nla_put_failure;
5685
5686 #define PUT_SINFO(attr, memb, type) do {                                \
5687         BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
5688         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
5689             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
5690                              sinfo->memb))                              \
5691                 goto nla_put_failure;                                   \
5692         } while (0)
5693 #define PUT_SINFO_U64(attr, memb) do {                                  \
5694         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
5695             nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
5696                               sinfo->memb, NL80211_STA_INFO_PAD))       \
5697                 goto nla_put_failure;                                   \
5698         } while (0)
5699
5700         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
5701         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
5702         PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at);
5703
5704         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
5705                              BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
5706             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
5707                         (u32)sinfo->rx_bytes))
5708                 goto nla_put_failure;
5709
5710         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
5711                              BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
5712             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
5713                         (u32)sinfo->tx_bytes))
5714                 goto nla_put_failure;
5715
5716         PUT_SINFO_U64(RX_BYTES64, rx_bytes);
5717         PUT_SINFO_U64(TX_BYTES64, tx_bytes);
5718         PUT_SINFO(LLID, llid, u16);
5719         PUT_SINFO(PLID, plid, u16);
5720         PUT_SINFO(PLINK_STATE, plink_state, u8);
5721         PUT_SINFO_U64(RX_DURATION, rx_duration);
5722         PUT_SINFO_U64(TX_DURATION, tx_duration);
5723
5724         if (wiphy_ext_feature_isset(&rdev->wiphy,
5725                                     NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
5726                 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
5727
5728         switch (rdev->wiphy.signal_type) {
5729         case CFG80211_SIGNAL_TYPE_MBM:
5730                 PUT_SINFO(SIGNAL, signal, u8);
5731                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
5732                 break;
5733         default:
5734                 break;
5735         }
5736         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
5737                 if (!nl80211_put_signal(msg, sinfo->chains,
5738                                         sinfo->chain_signal,
5739                                         NL80211_STA_INFO_CHAIN_SIGNAL))
5740                         goto nla_put_failure;
5741         }
5742         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
5743                 if (!nl80211_put_signal(msg, sinfo->chains,
5744                                         sinfo->chain_signal_avg,
5745                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
5746                         goto nla_put_failure;
5747         }
5748         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
5749                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
5750                                           NL80211_STA_INFO_TX_BITRATE))
5751                         goto nla_put_failure;
5752         }
5753         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
5754                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
5755                                           NL80211_STA_INFO_RX_BITRATE))
5756                         goto nla_put_failure;
5757         }
5758
5759         PUT_SINFO(RX_PACKETS, rx_packets, u32);
5760         PUT_SINFO(TX_PACKETS, tx_packets, u32);
5761         PUT_SINFO(TX_RETRIES, tx_retries, u32);
5762         PUT_SINFO(TX_FAILED, tx_failed, u32);
5763         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
5764         PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32);
5765         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
5766         PUT_SINFO(LOCAL_PM, local_pm, u32);
5767         PUT_SINFO(PEER_PM, peer_pm, u32);
5768         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
5769         PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8);
5770         PUT_SINFO(CONNECTED_TO_AS, connected_to_as, u8);
5771
5772         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
5773                 bss_param = nla_nest_start_noflag(msg,
5774                                                   NL80211_STA_INFO_BSS_PARAM);
5775                 if (!bss_param)
5776                         goto nla_put_failure;
5777
5778                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
5779                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
5780                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
5781                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
5782                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
5783                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
5784                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
5785                                sinfo->bss_param.dtim_period) ||
5786                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
5787                                 sinfo->bss_param.beacon_interval))
5788                         goto nla_put_failure;
5789
5790                 nla_nest_end(msg, bss_param);
5791         }
5792         if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
5793             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
5794                     sizeof(struct nl80211_sta_flag_update),
5795                     &sinfo->sta_flags))
5796                 goto nla_put_failure;
5797
5798         PUT_SINFO_U64(T_OFFSET, t_offset);
5799         PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
5800         PUT_SINFO_U64(BEACON_RX, rx_beacon);
5801         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
5802         PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
5803         PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
5804         if (wiphy_ext_feature_isset(&rdev->wiphy,
5805                                     NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
5806                 PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
5807                 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
5808         }
5809
5810 #undef PUT_SINFO
5811 #undef PUT_SINFO_U64
5812
5813         if (sinfo->pertid) {
5814                 struct nlattr *tidsattr;
5815                 int tid;
5816
5817                 tidsattr = nla_nest_start_noflag(msg,
5818                                                  NL80211_STA_INFO_TID_STATS);
5819                 if (!tidsattr)
5820                         goto nla_put_failure;
5821
5822                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
5823                         struct cfg80211_tid_stats *tidstats;
5824                         struct nlattr *tidattr;
5825
5826                         tidstats = &sinfo->pertid[tid];
5827
5828                         if (!tidstats->filled)
5829                                 continue;
5830
5831                         tidattr = nla_nest_start_noflag(msg, tid + 1);
5832                         if (!tidattr)
5833                                 goto nla_put_failure;
5834
5835 #define PUT_TIDVAL_U64(attr, memb) do {                                 \
5836         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
5837             nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,          \
5838                               tidstats->memb, NL80211_TID_STATS_PAD))   \
5839                 goto nla_put_failure;                                   \
5840         } while (0)
5841
5842                         PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
5843                         PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
5844                         PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
5845                         PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
5846
5847 #undef PUT_TIDVAL_U64
5848                         if ((tidstats->filled &
5849                              BIT(NL80211_TID_STATS_TXQ_STATS)) &&
5850                             !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
5851                                                    NL80211_TID_STATS_TXQ_STATS))
5852                                 goto nla_put_failure;
5853
5854                         nla_nest_end(msg, tidattr);
5855                 }
5856
5857                 nla_nest_end(msg, tidsattr);
5858         }
5859
5860         nla_nest_end(msg, sinfoattr);
5861
5862         if (sinfo->assoc_req_ies_len &&
5863             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
5864                     sinfo->assoc_req_ies))
5865                 goto nla_put_failure;
5866
5867         cfg80211_sinfo_release_content(sinfo);
5868         genlmsg_end(msg, hdr);
5869         return 0;
5870
5871  nla_put_failure:
5872         cfg80211_sinfo_release_content(sinfo);
5873         genlmsg_cancel(msg, hdr);
5874         return -EMSGSIZE;
5875 }
5876
5877 static int nl80211_dump_station(struct sk_buff *skb,
5878                                 struct netlink_callback *cb)
5879 {
5880         struct station_info sinfo;
5881         struct cfg80211_registered_device *rdev;
5882         struct wireless_dev *wdev;
5883         u8 mac_addr[ETH_ALEN];
5884         int sta_idx = cb->args[2];
5885         int err;
5886
5887         rtnl_lock();
5888         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
5889         if (err)
5890                 goto out_err;
5891
5892         if (!wdev->netdev) {
5893                 err = -EINVAL;
5894                 goto out_err;
5895         }
5896
5897         if (!rdev->ops->dump_station) {
5898                 err = -EOPNOTSUPP;
5899                 goto out_err;
5900         }
5901
5902         while (1) {
5903                 memset(&sinfo, 0, sizeof(sinfo));
5904                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
5905                                         mac_addr, &sinfo);
5906                 if (err == -ENOENT)
5907                         break;
5908                 if (err)
5909                         goto out_err;
5910
5911                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
5912                                 NETLINK_CB(cb->skb).portid,
5913                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5914                                 rdev, wdev->netdev, mac_addr,
5915                                 &sinfo) < 0)
5916                         goto out;
5917
5918                 sta_idx++;
5919         }
5920
5921  out:
5922         cb->args[2] = sta_idx;
5923         err = skb->len;
5924  out_err:
5925         rtnl_unlock();
5926
5927         return err;
5928 }
5929
5930 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
5931 {
5932         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5933         struct net_device *dev = info->user_ptr[1];
5934         struct station_info sinfo;
5935         struct sk_buff *msg;
5936         u8 *mac_addr = NULL;
5937         int err;
5938
5939         memset(&sinfo, 0, sizeof(sinfo));
5940
5941         if (!info->attrs[NL80211_ATTR_MAC])
5942                 return -EINVAL;
5943
5944         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5945
5946         if (!rdev->ops->get_station)
5947                 return -EOPNOTSUPP;
5948
5949         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
5950         if (err)
5951                 return err;
5952
5953         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5954         if (!msg) {
5955                 cfg80211_sinfo_release_content(&sinfo);
5956                 return -ENOMEM;
5957         }
5958
5959         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
5960                                  info->snd_portid, info->snd_seq, 0,
5961                                  rdev, dev, mac_addr, &sinfo) < 0) {
5962                 nlmsg_free(msg);
5963                 return -ENOBUFS;
5964         }
5965
5966         return genlmsg_reply(msg, info);
5967 }
5968
5969 int cfg80211_check_station_change(struct wiphy *wiphy,
5970                                   struct station_parameters *params,
5971                                   enum cfg80211_station_type statype)
5972 {
5973         if (params->listen_interval != -1 &&
5974             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
5975                 return -EINVAL;
5976
5977         if (params->support_p2p_ps != -1 &&
5978             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
5979                 return -EINVAL;
5980
5981         if (params->aid &&
5982             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
5983             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
5984                 return -EINVAL;
5985
5986         /* When you run into this, adjust the code below for the new flag */
5987         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
5988
5989         switch (statype) {
5990         case CFG80211_STA_MESH_PEER_KERNEL:
5991         case CFG80211_STA_MESH_PEER_USER:
5992                 /*
5993                  * No ignoring the TDLS flag here -- the userspace mesh
5994                  * code doesn't have the bug of including TDLS in the
5995                  * mask everywhere.
5996                  */
5997                 if (params->sta_flags_mask &
5998                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5999                                   BIT(NL80211_STA_FLAG_MFP) |
6000                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
6001                         return -EINVAL;
6002                 break;
6003         case CFG80211_STA_TDLS_PEER_SETUP:
6004         case CFG80211_STA_TDLS_PEER_ACTIVE:
6005                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
6006                         return -EINVAL;
6007                 /* ignore since it can't change */
6008                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6009                 break;
6010         default:
6011                 /* disallow mesh-specific things */
6012                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
6013                         return -EINVAL;
6014                 if (params->local_pm)
6015                         return -EINVAL;
6016                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
6017                         return -EINVAL;
6018         }
6019
6020         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
6021             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
6022                 /* TDLS can't be set, ... */
6023                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
6024                         return -EINVAL;
6025                 /*
6026                  * ... but don't bother the driver with it. This works around
6027                  * a hostapd/wpa_supplicant issue -- it always includes the
6028                  * TLDS_PEER flag in the mask even for AP mode.
6029                  */
6030                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6031         }
6032
6033         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
6034             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
6035                 /* reject other things that can't change */
6036                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
6037                         return -EINVAL;
6038                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
6039                         return -EINVAL;
6040                 if (params->supported_rates)
6041                         return -EINVAL;
6042                 if (params->ext_capab || params->ht_capa || params->vht_capa ||
6043                     params->he_capa)
6044                         return -EINVAL;
6045         }
6046
6047         if (statype != CFG80211_STA_AP_CLIENT &&
6048             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
6049                 if (params->vlan)
6050                         return -EINVAL;
6051         }
6052
6053         switch (statype) {
6054         case CFG80211_STA_AP_MLME_CLIENT:
6055                 /* Use this only for authorizing/unauthorizing a station */
6056                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
6057                         return -EOPNOTSUPP;
6058                 break;
6059         case CFG80211_STA_AP_CLIENT:
6060         case CFG80211_STA_AP_CLIENT_UNASSOC:
6061                 /* accept only the listed bits */
6062                 if (params->sta_flags_mask &
6063                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
6064                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6065                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
6066                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
6067                                   BIT(NL80211_STA_FLAG_WME) |
6068                                   BIT(NL80211_STA_FLAG_MFP)))
6069                         return -EINVAL;
6070
6071                 /* but authenticated/associated only if driver handles it */
6072                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
6073                     params->sta_flags_mask &
6074                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6075                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
6076                         return -EINVAL;
6077                 break;
6078         case CFG80211_STA_IBSS:
6079         case CFG80211_STA_AP_STA:
6080                 /* reject any changes other than AUTHORIZED */
6081                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
6082                         return -EINVAL;
6083                 break;
6084         case CFG80211_STA_TDLS_PEER_SETUP:
6085                 /* reject any changes other than AUTHORIZED or WME */
6086                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
6087                                                BIT(NL80211_STA_FLAG_WME)))
6088                         return -EINVAL;
6089                 /* force (at least) rates when authorizing */
6090                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
6091                     !params->supported_rates)
6092                         return -EINVAL;
6093                 break;
6094         case CFG80211_STA_TDLS_PEER_ACTIVE:
6095                 /* reject any changes */
6096                 return -EINVAL;
6097         case CFG80211_STA_MESH_PEER_KERNEL:
6098                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
6099                         return -EINVAL;
6100                 break;
6101         case CFG80211_STA_MESH_PEER_USER:
6102                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
6103                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
6104                         return -EINVAL;
6105                 break;
6106         }
6107
6108         /*
6109          * Older kernel versions ignored this attribute entirely, so don't
6110          * reject attempts to update it but mark it as unused instead so the
6111          * driver won't look at the data.
6112          */
6113         if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
6114             statype != CFG80211_STA_TDLS_PEER_SETUP)
6115                 params->opmode_notif_used = false;
6116
6117         return 0;
6118 }
6119 EXPORT_SYMBOL(cfg80211_check_station_change);
6120
6121 /*
6122  * Get vlan interface making sure it is running and on the right wiphy.
6123  */
6124 static struct net_device *get_vlan(struct genl_info *info,
6125                                    struct cfg80211_registered_device *rdev)
6126 {
6127         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
6128         struct net_device *v;
6129         int ret;
6130
6131         if (!vlanattr)
6132                 return NULL;
6133
6134         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
6135         if (!v)
6136                 return ERR_PTR(-ENODEV);
6137
6138         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
6139                 ret = -EINVAL;
6140                 goto error;
6141         }
6142
6143         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
6144             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6145             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6146                 ret = -EINVAL;
6147                 goto error;
6148         }
6149
6150         if (!netif_running(v)) {
6151                 ret = -ENETDOWN;
6152                 goto error;
6153         }
6154
6155         return v;
6156  error:
6157         dev_put(v);
6158         return ERR_PTR(ret);
6159 }
6160
6161 static const struct nla_policy
6162 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
6163         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
6164         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
6165 };
6166
6167 static int nl80211_parse_sta_wme(struct genl_info *info,
6168                                  struct station_parameters *params)
6169 {
6170         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
6171         struct nlattr *nla;
6172         int err;
6173
6174         /* parse WME attributes if present */
6175         if (!info->attrs[NL80211_ATTR_STA_WME])
6176                 return 0;
6177
6178         nla = info->attrs[NL80211_ATTR_STA_WME];
6179         err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla,
6180                                           nl80211_sta_wme_policy,
6181                                           info->extack);
6182         if (err)
6183                 return err;
6184
6185         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
6186                 params->uapsd_queues = nla_get_u8(
6187                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
6188         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
6189                 return -EINVAL;
6190
6191         if (tb[NL80211_STA_WME_MAX_SP])
6192                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
6193
6194         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
6195                 return -EINVAL;
6196
6197         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
6198
6199         return 0;
6200 }
6201
6202 static int nl80211_parse_sta_channel_info(struct genl_info *info,
6203                                       struct station_parameters *params)
6204 {
6205         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
6206                 params->supported_channels =
6207                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
6208                 params->supported_channels_len =
6209                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
6210                 /*
6211                  * Need to include at least one (first channel, number of
6212                  * channels) tuple for each subband (checked in policy),
6213                  * and must have proper tuples for the rest of the data as well.
6214                  */
6215                 if (params->supported_channels_len % 2)
6216                         return -EINVAL;
6217         }
6218
6219         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
6220                 params->supported_oper_classes =
6221                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
6222                 params->supported_oper_classes_len =
6223                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
6224         }
6225         return 0;
6226 }
6227
6228 static int nl80211_set_station_tdls(struct genl_info *info,
6229                                     struct station_parameters *params)
6230 {
6231         int err;
6232         /* Dummy STA entry gets updated once the peer capabilities are known */
6233         if (info->attrs[NL80211_ATTR_PEER_AID])
6234                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
6235         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
6236                 params->ht_capa =
6237                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
6238         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
6239                 params->vht_capa =
6240                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
6241         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
6242                 params->he_capa =
6243                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6244                 params->he_capa_len =
6245                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6246         }
6247
6248         err = nl80211_parse_sta_channel_info(info, params);
6249         if (err)
6250                 return err;
6251
6252         return nl80211_parse_sta_wme(info, params);
6253 }
6254
6255 static int nl80211_parse_sta_txpower_setting(struct genl_info *info,
6256                                              struct station_parameters *params)
6257 {
6258         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6259         int idx;
6260
6261         if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) {
6262                 if (!rdev->ops->set_tx_power ||
6263                     !wiphy_ext_feature_isset(&rdev->wiphy,
6264                                          NL80211_EXT_FEATURE_STA_TX_PWR))
6265                         return -EOPNOTSUPP;
6266
6267                 idx = NL80211_ATTR_STA_TX_POWER_SETTING;
6268                 params->txpwr.type = nla_get_u8(info->attrs[idx]);
6269
6270                 if (params->txpwr.type == NL80211_TX_POWER_LIMITED) {
6271                         idx = NL80211_ATTR_STA_TX_POWER;
6272
6273                         if (info->attrs[idx])
6274                                 params->txpwr.power =
6275                                         nla_get_s16(info->attrs[idx]);
6276                         else
6277                                 return -EINVAL;
6278                 }
6279                 params->sta_modify_mask |= STATION_PARAM_APPLY_STA_TXPOWER;
6280         }
6281
6282         return 0;
6283 }
6284
6285 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
6286 {
6287         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6288         struct net_device *dev = info->user_ptr[1];
6289         struct station_parameters params;
6290         u8 *mac_addr;
6291         int err;
6292
6293         memset(&params, 0, sizeof(params));
6294
6295         if (!rdev->ops->change_station)
6296                 return -EOPNOTSUPP;
6297
6298         /*
6299          * AID and listen_interval properties can be set only for unassociated
6300          * station. Include these parameters here and will check them in
6301          * cfg80211_check_station_change().
6302          */
6303         if (info->attrs[NL80211_ATTR_STA_AID])
6304                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
6305
6306         if (info->attrs[NL80211_ATTR_VLAN_ID])
6307                 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
6308
6309         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
6310                 params.listen_interval =
6311                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
6312         else
6313                 params.listen_interval = -1;
6314
6315         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
6316                 params.support_p2p_ps =
6317                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
6318         else
6319                 params.support_p2p_ps = -1;
6320
6321         if (!info->attrs[NL80211_ATTR_MAC])
6322                 return -EINVAL;
6323
6324         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6325
6326         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
6327                 params.supported_rates =
6328                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
6329                 params.supported_rates_len =
6330                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
6331         }
6332
6333         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
6334                 params.capability =
6335                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
6336                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
6337         }
6338
6339         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
6340                 params.ext_capab =
6341                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
6342                 params.ext_capab_len =
6343                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
6344         }
6345
6346         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
6347                 return -EINVAL;
6348
6349         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
6350                 params.plink_action =
6351                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
6352
6353         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
6354                 params.plink_state =
6355                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
6356                 if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
6357                         params.peer_aid = nla_get_u16(
6358                                 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
6359                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
6360         }
6361
6362         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
6363                 params.local_pm = nla_get_u32(
6364                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
6365
6366         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
6367                 params.opmode_notif_used = true;
6368                 params.opmode_notif =
6369                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
6370         }
6371
6372         if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
6373                 params.he_6ghz_capa =
6374                         nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
6375
6376         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
6377                 params.airtime_weight =
6378                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
6379
6380         if (params.airtime_weight &&
6381             !wiphy_ext_feature_isset(&rdev->wiphy,
6382                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
6383                 return -EOPNOTSUPP;
6384
6385         err = nl80211_parse_sta_txpower_setting(info, &params);
6386         if (err)
6387                 return err;
6388
6389         /* Include parameters for TDLS peer (will check later) */
6390         err = nl80211_set_station_tdls(info, &params);
6391         if (err)
6392                 return err;
6393
6394         params.vlan = get_vlan(info, rdev);
6395         if (IS_ERR(params.vlan))
6396                 return PTR_ERR(params.vlan);
6397
6398         switch (dev->ieee80211_ptr->iftype) {
6399         case NL80211_IFTYPE_AP:
6400         case NL80211_IFTYPE_AP_VLAN:
6401         case NL80211_IFTYPE_P2P_GO:
6402         case NL80211_IFTYPE_P2P_CLIENT:
6403         case NL80211_IFTYPE_STATION:
6404         case NL80211_IFTYPE_ADHOC:
6405         case NL80211_IFTYPE_MESH_POINT:
6406                 break;
6407         default:
6408                 err = -EOPNOTSUPP;
6409                 goto out_put_vlan;
6410         }
6411
6412         /* driver will call cfg80211_check_station_change() */
6413         err = rdev_change_station(rdev, dev, mac_addr, &params);
6414
6415  out_put_vlan:
6416         if (params.vlan)
6417                 dev_put(params.vlan);
6418
6419         return err;
6420 }
6421
6422 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
6423 {
6424         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6425         int err;
6426         struct net_device *dev = info->user_ptr[1];
6427         struct station_parameters params;
6428         u8 *mac_addr = NULL;
6429         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6430                          BIT(NL80211_STA_FLAG_ASSOCIATED);
6431
6432         memset(&params, 0, sizeof(params));
6433
6434         if (!rdev->ops->add_station)
6435                 return -EOPNOTSUPP;
6436
6437         if (!info->attrs[NL80211_ATTR_MAC])
6438                 return -EINVAL;
6439
6440         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
6441                 return -EINVAL;
6442
6443         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
6444                 return -EINVAL;
6445
6446         if (!info->attrs[NL80211_ATTR_STA_AID] &&
6447             !info->attrs[NL80211_ATTR_PEER_AID])
6448                 return -EINVAL;
6449
6450         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6451         params.supported_rates =
6452                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
6453         params.supported_rates_len =
6454                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
6455         params.listen_interval =
6456                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
6457
6458         if (info->attrs[NL80211_ATTR_VLAN_ID])
6459                 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
6460
6461         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
6462                 params.support_p2p_ps =
6463                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
6464         } else {
6465                 /*
6466                  * if not specified, assume it's supported for P2P GO interface,
6467                  * and is NOT supported for AP interface
6468                  */
6469                 params.support_p2p_ps =
6470                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
6471         }
6472
6473         if (info->attrs[NL80211_ATTR_PEER_AID])
6474                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
6475         else
6476                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
6477
6478         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
6479                 params.capability =
6480                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
6481                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
6482         }
6483
6484         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
6485                 params.ext_capab =
6486                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
6487                 params.ext_capab_len =
6488                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
6489         }
6490
6491         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
6492                 params.ht_capa =
6493                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
6494
6495         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
6496                 params.vht_capa =
6497                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
6498
6499         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
6500                 params.he_capa =
6501                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6502                 params.he_capa_len =
6503                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6504         }
6505
6506         if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
6507                 params.he_6ghz_capa =
6508                         nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
6509
6510         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
6511                 params.opmode_notif_used = true;
6512                 params.opmode_notif =
6513                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
6514         }
6515
6516         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
6517                 params.plink_action =
6518                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
6519
6520         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
6521                 params.airtime_weight =
6522                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
6523
6524         if (params.airtime_weight &&
6525             !wiphy_ext_feature_isset(&rdev->wiphy,
6526                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
6527                 return -EOPNOTSUPP;
6528
6529         err = nl80211_parse_sta_txpower_setting(info, &params);
6530         if (err)
6531                 return err;
6532
6533         err = nl80211_parse_sta_channel_info(info, &params);
6534         if (err)
6535                 return err;
6536
6537         err = nl80211_parse_sta_wme(info, &params);
6538         if (err)
6539                 return err;
6540
6541         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
6542                 return -EINVAL;
6543
6544         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
6545          * as userspace might just pass through the capabilities from the IEs
6546          * directly, rather than enforcing this restriction and returning an
6547          * error in this case.
6548          */
6549         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
6550                 params.ht_capa = NULL;
6551                 params.vht_capa = NULL;
6552
6553                 /* HE requires WME */
6554                 if (params.he_capa_len || params.he_6ghz_capa)
6555                         return -EINVAL;
6556         }
6557
6558         /* Ensure that HT/VHT capabilities are not set for 6 GHz HE STA */
6559         if (params.he_6ghz_capa && (params.ht_capa || params.vht_capa))
6560                 return -EINVAL;
6561
6562         /* When you run into this, adjust the code below for the new flag */
6563         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
6564
6565         switch (dev->ieee80211_ptr->iftype) {
6566         case NL80211_IFTYPE_AP:
6567         case NL80211_IFTYPE_AP_VLAN:
6568         case NL80211_IFTYPE_P2P_GO:
6569                 /* ignore WME attributes if iface/sta is not capable */
6570                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
6571                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
6572                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
6573
6574                 /* TDLS peers cannot be added */
6575                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
6576                     info->attrs[NL80211_ATTR_PEER_AID])
6577                         return -EINVAL;
6578                 /* but don't bother the driver with it */
6579                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6580
6581                 /* allow authenticated/associated only if driver handles it */
6582                 if (!(rdev->wiphy.features &
6583                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
6584                     params.sta_flags_mask & auth_assoc)
6585                         return -EINVAL;
6586
6587                 /* Older userspace, or userspace wanting to be compatible with
6588                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
6589                  * and assoc flags in the mask, but assumes the station will be
6590                  * added as associated anyway since this was the required driver
6591                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
6592                  * introduced.
6593                  * In order to not bother drivers with this quirk in the API
6594                  * set the flags in both the mask and set for new stations in
6595                  * this case.
6596                  */
6597                 if (!(params.sta_flags_mask & auth_assoc)) {
6598                         params.sta_flags_mask |= auth_assoc;
6599                         params.sta_flags_set |= auth_assoc;
6600                 }
6601
6602                 /* must be last in here for error handling */
6603                 params.vlan = get_vlan(info, rdev);
6604                 if (IS_ERR(params.vlan))
6605                         return PTR_ERR(params.vlan);
6606                 break;
6607         case NL80211_IFTYPE_MESH_POINT:
6608                 /* ignore uAPSD data */
6609                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
6610
6611                 /* associated is disallowed */
6612                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
6613                         return -EINVAL;
6614                 /* TDLS peers cannot be added */
6615                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
6616                     info->attrs[NL80211_ATTR_PEER_AID])
6617                         return -EINVAL;
6618                 break;
6619         case NL80211_IFTYPE_STATION:
6620         case NL80211_IFTYPE_P2P_CLIENT:
6621                 /* ignore uAPSD data */
6622                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
6623
6624                 /* these are disallowed */
6625                 if (params.sta_flags_mask &
6626                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
6627                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
6628                         return -EINVAL;
6629                 /* Only TDLS peers can be added */
6630                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
6631                         return -EINVAL;
6632                 /* Can only add if TDLS ... */
6633                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
6634                         return -EOPNOTSUPP;
6635                 /* ... with external setup is supported */
6636                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
6637                         return -EOPNOTSUPP;
6638                 /*
6639                  * Older wpa_supplicant versions always mark the TDLS peer
6640                  * as authorized, but it shouldn't yet be.
6641                  */
6642                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
6643                 break;
6644         default:
6645                 return -EOPNOTSUPP;
6646         }
6647
6648         /* be aware of params.vlan when changing code here */
6649
6650         err = rdev_add_station(rdev, dev, mac_addr, &params);
6651
6652         if (params.vlan)
6653                 dev_put(params.vlan);
6654         return err;
6655 }
6656
6657 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
6658 {
6659         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6660         struct net_device *dev = info->user_ptr[1];
6661         struct station_del_parameters params;
6662
6663         memset(&params, 0, sizeof(params));
6664
6665         if (info->attrs[NL80211_ATTR_MAC])
6666                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
6667
6668         switch (dev->ieee80211_ptr->iftype) {
6669         case NL80211_IFTYPE_AP:
6670         case NL80211_IFTYPE_AP_VLAN:
6671         case NL80211_IFTYPE_MESH_POINT:
6672         case NL80211_IFTYPE_P2P_GO:
6673                 /* always accept these */
6674                 break;
6675         case NL80211_IFTYPE_ADHOC:
6676                 /* conditionally accept */
6677                 if (wiphy_ext_feature_isset(&rdev->wiphy,
6678                                             NL80211_EXT_FEATURE_DEL_IBSS_STA))
6679                         break;
6680                 return -EINVAL;
6681         default:
6682                 return -EINVAL;
6683         }
6684
6685         if (!rdev->ops->del_station)
6686                 return -EOPNOTSUPP;
6687
6688         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
6689                 params.subtype =
6690                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
6691                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
6692                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
6693                         return -EINVAL;
6694         } else {
6695                 /* Default to Deauthentication frame */
6696                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
6697         }
6698
6699         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
6700                 params.reason_code =
6701                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6702                 if (params.reason_code == 0)
6703                         return -EINVAL; /* 0 is reserved */
6704         } else {
6705                 /* Default to reason code 2 */
6706                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
6707         }
6708
6709         return rdev_del_station(rdev, dev, &params);
6710 }
6711
6712 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
6713                                 int flags, struct net_device *dev,
6714                                 u8 *dst, u8 *next_hop,
6715                                 struct mpath_info *pinfo)
6716 {
6717         void *hdr;
6718         struct nlattr *pinfoattr;
6719
6720         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
6721         if (!hdr)
6722                 return -1;
6723
6724         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6725             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
6726             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
6727             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
6728                 goto nla_put_failure;
6729
6730         pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO);
6731         if (!pinfoattr)
6732                 goto nla_put_failure;
6733         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
6734             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
6735                         pinfo->frame_qlen))
6736                 goto nla_put_failure;
6737         if (((pinfo->filled & MPATH_INFO_SN) &&
6738              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
6739             ((pinfo->filled & MPATH_INFO_METRIC) &&
6740              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
6741                          pinfo->metric)) ||
6742             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
6743              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
6744                          pinfo->exptime)) ||
6745             ((pinfo->filled & MPATH_INFO_FLAGS) &&
6746              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
6747                         pinfo->flags)) ||
6748             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
6749              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
6750                          pinfo->discovery_timeout)) ||
6751             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
6752              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
6753                         pinfo->discovery_retries)) ||
6754             ((pinfo->filled & MPATH_INFO_HOP_COUNT) &&
6755              nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT,
6756                         pinfo->hop_count)) ||
6757             ((pinfo->filled & MPATH_INFO_PATH_CHANGE) &&
6758              nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE,
6759                          pinfo->path_change_count)))
6760                 goto nla_put_failure;
6761
6762         nla_nest_end(msg, pinfoattr);
6763
6764         genlmsg_end(msg, hdr);
6765         return 0;
6766
6767  nla_put_failure:
6768         genlmsg_cancel(msg, hdr);
6769         return -EMSGSIZE;
6770 }
6771
6772 static int nl80211_dump_mpath(struct sk_buff *skb,
6773                               struct netlink_callback *cb)
6774 {
6775         struct mpath_info pinfo;
6776         struct cfg80211_registered_device *rdev;
6777         struct wireless_dev *wdev;
6778         u8 dst[ETH_ALEN];
6779         u8 next_hop[ETH_ALEN];
6780         int path_idx = cb->args[2];
6781         int err;
6782
6783         rtnl_lock();
6784         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
6785         if (err)
6786                 goto out_err;
6787
6788         if (!rdev->ops->dump_mpath) {
6789                 err = -EOPNOTSUPP;
6790                 goto out_err;
6791         }
6792
6793         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
6794                 err = -EOPNOTSUPP;
6795                 goto out_err;
6796         }
6797
6798         while (1) {
6799                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
6800                                       next_hop, &pinfo);
6801                 if (err == -ENOENT)
6802                         break;
6803                 if (err)
6804                         goto out_err;
6805
6806                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
6807                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
6808                                        wdev->netdev, dst, next_hop,
6809                                        &pinfo) < 0)
6810                         goto out;
6811
6812                 path_idx++;
6813         }
6814
6815  out:
6816         cb->args[2] = path_idx;
6817         err = skb->len;
6818  out_err:
6819         rtnl_unlock();
6820         return err;
6821 }
6822
6823 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
6824 {
6825         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6826         int err;
6827         struct net_device *dev = info->user_ptr[1];
6828         struct mpath_info pinfo;
6829         struct sk_buff *msg;
6830         u8 *dst = NULL;
6831         u8 next_hop[ETH_ALEN];
6832
6833         memset(&pinfo, 0, sizeof(pinfo));
6834
6835         if (!info->attrs[NL80211_ATTR_MAC])
6836                 return -EINVAL;
6837
6838         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6839
6840         if (!rdev->ops->get_mpath)
6841                 return -EOPNOTSUPP;
6842
6843         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6844                 return -EOPNOTSUPP;
6845
6846         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
6847         if (err)
6848                 return err;
6849
6850         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6851         if (!msg)
6852                 return -ENOMEM;
6853
6854         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
6855                                  dev, dst, next_hop, &pinfo) < 0) {
6856                 nlmsg_free(msg);
6857                 return -ENOBUFS;
6858         }
6859
6860         return genlmsg_reply(msg, info);
6861 }
6862
6863 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
6864 {
6865         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6866         struct net_device *dev = info->user_ptr[1];
6867         u8 *dst = NULL;
6868         u8 *next_hop = NULL;
6869
6870         if (!info->attrs[NL80211_ATTR_MAC])
6871                 return -EINVAL;
6872
6873         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
6874                 return -EINVAL;
6875
6876         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6877         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
6878
6879         if (!rdev->ops->change_mpath)
6880                 return -EOPNOTSUPP;
6881
6882         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6883                 return -EOPNOTSUPP;
6884
6885         return rdev_change_mpath(rdev, dev, dst, next_hop);
6886 }
6887
6888 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
6889 {
6890         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6891         struct net_device *dev = info->user_ptr[1];
6892         u8 *dst = NULL;
6893         u8 *next_hop = NULL;
6894
6895         if (!info->attrs[NL80211_ATTR_MAC])
6896                 return -EINVAL;
6897
6898         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
6899                 return -EINVAL;
6900
6901         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6902         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
6903
6904         if (!rdev->ops->add_mpath)
6905                 return -EOPNOTSUPP;
6906
6907         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6908                 return -EOPNOTSUPP;
6909
6910         return rdev_add_mpath(rdev, dev, dst, next_hop);
6911 }
6912
6913 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
6914 {
6915         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6916         struct net_device *dev = info->user_ptr[1];
6917         u8 *dst = NULL;
6918
6919         if (info->attrs[NL80211_ATTR_MAC])
6920                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6921
6922         if (!rdev->ops->del_mpath)
6923                 return -EOPNOTSUPP;
6924
6925         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6926                 return -EOPNOTSUPP;
6927
6928         return rdev_del_mpath(rdev, dev, dst);
6929 }
6930
6931 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
6932 {
6933         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6934         int err;
6935         struct net_device *dev = info->user_ptr[1];
6936         struct mpath_info pinfo;
6937         struct sk_buff *msg;
6938         u8 *dst = NULL;
6939         u8 mpp[ETH_ALEN];
6940
6941         memset(&pinfo, 0, sizeof(pinfo));
6942
6943         if (!info->attrs[NL80211_ATTR_MAC])
6944                 return -EINVAL;
6945
6946         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6947
6948         if (!rdev->ops->get_mpp)
6949                 return -EOPNOTSUPP;
6950
6951         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6952                 return -EOPNOTSUPP;
6953
6954         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
6955         if (err)
6956                 return err;
6957
6958         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6959         if (!msg)
6960                 return -ENOMEM;
6961
6962         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
6963                                dev, dst, mpp, &pinfo) < 0) {
6964                 nlmsg_free(msg);
6965                 return -ENOBUFS;
6966         }
6967
6968         return genlmsg_reply(msg, info);
6969 }
6970
6971 static int nl80211_dump_mpp(struct sk_buff *skb,
6972                             struct netlink_callback *cb)
6973 {
6974         struct mpath_info pinfo;
6975         struct cfg80211_registered_device *rdev;
6976         struct wireless_dev *wdev;
6977         u8 dst[ETH_ALEN];
6978         u8 mpp[ETH_ALEN];
6979         int path_idx = cb->args[2];
6980         int err;
6981
6982         rtnl_lock();
6983         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
6984         if (err)
6985                 goto out_err;
6986
6987         if (!rdev->ops->dump_mpp) {
6988                 err = -EOPNOTSUPP;
6989                 goto out_err;
6990         }
6991
6992         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
6993                 err = -EOPNOTSUPP;
6994                 goto out_err;
6995         }
6996
6997         while (1) {
6998                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
6999                                     mpp, &pinfo);
7000                 if (err == -ENOENT)
7001                         break;
7002                 if (err)
7003                         goto out_err;
7004
7005                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
7006                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
7007                                        wdev->netdev, dst, mpp,
7008                                        &pinfo) < 0)
7009                         goto out;
7010
7011                 path_idx++;
7012         }
7013
7014  out:
7015         cb->args[2] = path_idx;
7016         err = skb->len;
7017  out_err:
7018         rtnl_unlock();
7019         return err;
7020 }
7021
7022 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
7023 {
7024         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7025         struct net_device *dev = info->user_ptr[1];
7026         struct wireless_dev *wdev = dev->ieee80211_ptr;
7027         struct bss_parameters params;
7028         int err;
7029
7030         memset(&params, 0, sizeof(params));
7031         /* default to not changing parameters */
7032         params.use_cts_prot = -1;
7033         params.use_short_preamble = -1;
7034         params.use_short_slot_time = -1;
7035         params.ap_isolate = -1;
7036         params.ht_opmode = -1;
7037         params.p2p_ctwindow = -1;
7038         params.p2p_opp_ps = -1;
7039
7040         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
7041                 params.use_cts_prot =
7042                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
7043         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
7044                 params.use_short_preamble =
7045                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
7046         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
7047                 params.use_short_slot_time =
7048                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
7049         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
7050                 params.basic_rates =
7051                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7052                 params.basic_rates_len =
7053                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7054         }
7055         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
7056                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
7057         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
7058                 params.ht_opmode =
7059                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
7060
7061         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
7062                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
7063                         return -EINVAL;
7064                 params.p2p_ctwindow =
7065                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
7066                 if (params.p2p_ctwindow != 0 &&
7067                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
7068                         return -EINVAL;
7069         }
7070
7071         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
7072                 u8 tmp;
7073
7074                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
7075                         return -EINVAL;
7076                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
7077                 params.p2p_opp_ps = tmp;
7078                 if (params.p2p_opp_ps &&
7079                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
7080                         return -EINVAL;
7081         }
7082
7083         if (!rdev->ops->change_bss)
7084                 return -EOPNOTSUPP;
7085
7086         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
7087             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
7088                 return -EOPNOTSUPP;
7089
7090         wdev_lock(wdev);
7091         err = rdev_change_bss(rdev, dev, &params);
7092         wdev_unlock(wdev);
7093
7094         return err;
7095 }
7096
7097 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
7098 {
7099         char *data = NULL;
7100         bool is_indoor;
7101         enum nl80211_user_reg_hint_type user_reg_hint_type;
7102         u32 owner_nlportid;
7103
7104         /*
7105          * You should only get this when cfg80211 hasn't yet initialized
7106          * completely when built-in to the kernel right between the time
7107          * window between nl80211_init() and regulatory_init(), if that is
7108          * even possible.
7109          */
7110         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
7111                 return -EINPROGRESS;
7112
7113         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
7114                 user_reg_hint_type =
7115                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
7116         else
7117                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
7118
7119         switch (user_reg_hint_type) {
7120         case NL80211_USER_REG_HINT_USER:
7121         case NL80211_USER_REG_HINT_CELL_BASE:
7122                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
7123                         return -EINVAL;
7124
7125                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
7126                 return regulatory_hint_user(data, user_reg_hint_type);
7127         case NL80211_USER_REG_HINT_INDOOR:
7128                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
7129                         owner_nlportid = info->snd_portid;
7130                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
7131                 } else {
7132                         owner_nlportid = 0;
7133                         is_indoor = true;
7134                 }
7135
7136                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
7137         default:
7138                 return -EINVAL;
7139         }
7140 }
7141
7142 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
7143 {
7144         return reg_reload_regdb();
7145 }
7146
7147 static int nl80211_get_mesh_config(struct sk_buff *skb,
7148                                    struct genl_info *info)
7149 {
7150         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7151         struct net_device *dev = info->user_ptr[1];
7152         struct wireless_dev *wdev = dev->ieee80211_ptr;
7153         struct mesh_config cur_params;
7154         int err = 0;
7155         void *hdr;
7156         struct nlattr *pinfoattr;
7157         struct sk_buff *msg;
7158
7159         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
7160                 return -EOPNOTSUPP;
7161
7162         if (!rdev->ops->get_mesh_config)
7163                 return -EOPNOTSUPP;
7164
7165         wdev_lock(wdev);
7166         /* If not connected, get default parameters */
7167         if (!wdev->mesh_id_len)
7168                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
7169         else
7170                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
7171         wdev_unlock(wdev);
7172
7173         if (err)
7174                 return err;
7175
7176         /* Draw up a netlink message to send back */
7177         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7178         if (!msg)
7179                 return -ENOMEM;
7180         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7181                              NL80211_CMD_GET_MESH_CONFIG);
7182         if (!hdr)
7183                 goto out;
7184         pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG);
7185         if (!pinfoattr)
7186                 goto nla_put_failure;
7187         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
7188             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
7189                         cur_params.dot11MeshRetryTimeout) ||
7190             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
7191                         cur_params.dot11MeshConfirmTimeout) ||
7192             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
7193                         cur_params.dot11MeshHoldingTimeout) ||
7194             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
7195                         cur_params.dot11MeshMaxPeerLinks) ||
7196             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
7197                        cur_params.dot11MeshMaxRetries) ||
7198             nla_put_u8(msg, NL80211_MESHCONF_TTL,
7199                        cur_params.dot11MeshTTL) ||
7200             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
7201                        cur_params.element_ttl) ||
7202             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
7203                        cur_params.auto_open_plinks) ||
7204             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
7205                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
7206             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
7207                        cur_params.dot11MeshHWMPmaxPREQretries) ||
7208             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
7209                         cur_params.path_refresh_time) ||
7210             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
7211                         cur_params.min_discovery_timeout) ||
7212             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
7213                         cur_params.dot11MeshHWMPactivePathTimeout) ||
7214             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
7215                         cur_params.dot11MeshHWMPpreqMinInterval) ||
7216             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
7217                         cur_params.dot11MeshHWMPperrMinInterval) ||
7218             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
7219                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
7220             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
7221                        cur_params.dot11MeshHWMPRootMode) ||
7222             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
7223                         cur_params.dot11MeshHWMPRannInterval) ||
7224             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
7225                        cur_params.dot11MeshGateAnnouncementProtocol) ||
7226             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
7227                        cur_params.dot11MeshForwarding) ||
7228             nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
7229                         cur_params.rssi_threshold) ||
7230             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
7231                         cur_params.ht_opmode) ||
7232             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
7233                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
7234             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
7235                         cur_params.dot11MeshHWMProotInterval) ||
7236             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
7237                         cur_params.dot11MeshHWMPconfirmationInterval) ||
7238             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
7239                         cur_params.power_mode) ||
7240             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
7241                         cur_params.dot11MeshAwakeWindowDuration) ||
7242             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
7243                         cur_params.plink_timeout) ||
7244             nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE,
7245                        cur_params.dot11MeshConnectedToMeshGate) ||
7246             nla_put_u8(msg, NL80211_MESHCONF_NOLEARN,
7247                        cur_params.dot11MeshNolearn) ||
7248             nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_AS,
7249                        cur_params.dot11MeshConnectedToAuthServer))
7250                 goto nla_put_failure;
7251         nla_nest_end(msg, pinfoattr);
7252         genlmsg_end(msg, hdr);
7253         return genlmsg_reply(msg, info);
7254
7255  nla_put_failure:
7256  out:
7257         nlmsg_free(msg);
7258         return -ENOBUFS;
7259 }
7260
7261 static const struct nla_policy
7262 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
7263         [NL80211_MESHCONF_RETRY_TIMEOUT] =
7264                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
7265         [NL80211_MESHCONF_CONFIRM_TIMEOUT] =
7266                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
7267         [NL80211_MESHCONF_HOLDING_TIMEOUT] =
7268                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
7269         [NL80211_MESHCONF_MAX_PEER_LINKS] =
7270                 NLA_POLICY_RANGE(NLA_U16, 0, 255),
7271         [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
7272         [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
7273         [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
7274         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
7275         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
7276                 NLA_POLICY_RANGE(NLA_U32, 1, 255),
7277         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
7278         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
7279         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
7280         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
7281         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
7282                 NLA_POLICY_MIN(NLA_U16, 1),
7283         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
7284                 NLA_POLICY_MIN(NLA_U16, 1),
7285         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
7286                 NLA_POLICY_MIN(NLA_U16, 1),
7287         [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
7288         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
7289                 NLA_POLICY_MIN(NLA_U16, 1),
7290         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
7291         [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
7292         [NL80211_MESHCONF_RSSI_THRESHOLD] =
7293                 NLA_POLICY_RANGE(NLA_S32, -255, 0),
7294         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
7295         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
7296         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
7297                 NLA_POLICY_MIN(NLA_U16, 1),
7298         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
7299                 NLA_POLICY_MIN(NLA_U16, 1),
7300         [NL80211_MESHCONF_POWER_MODE] =
7301                 NLA_POLICY_RANGE(NLA_U32,
7302                                  NL80211_MESH_POWER_ACTIVE,
7303                                  NL80211_MESH_POWER_MAX),
7304         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
7305         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
7306         [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
7307         [NL80211_MESHCONF_NOLEARN] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
7308         [NL80211_MESHCONF_CONNECTED_TO_AS] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
7309 };
7310
7311 static const struct nla_policy
7312         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
7313         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
7314         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
7315         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
7316         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
7317         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
7318         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
7319         [NL80211_MESH_SETUP_IE] =
7320                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
7321                                        IEEE80211_MAX_DATA_LEN),
7322         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
7323 };
7324
7325 static int nl80211_parse_mesh_config(struct genl_info *info,
7326                                      struct mesh_config *cfg,
7327                                      u32 *mask_out)
7328 {
7329         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
7330         u32 mask = 0;
7331         u16 ht_opmode;
7332
7333 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn)       \
7334 do {                                                                    \
7335         if (tb[attr]) {                                                 \
7336                 cfg->param = fn(tb[attr]);                              \
7337                 mask |= BIT((attr) - 1);                                \
7338         }                                                               \
7339 } while (0)
7340
7341         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
7342                 return -EINVAL;
7343         if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack))
7344                 return -EINVAL;
7345
7346         /* This makes sure that there aren't more than 32 mesh config
7347          * parameters (otherwise our bitfield scheme would not work.) */
7348         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
7349
7350         /* Fill in the params struct */
7351         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
7352                                   NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
7353         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
7354                                   NL80211_MESHCONF_CONFIRM_TIMEOUT,
7355                                   nla_get_u16);
7356         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
7357                                   NL80211_MESHCONF_HOLDING_TIMEOUT,
7358                                   nla_get_u16);
7359         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
7360                                   NL80211_MESHCONF_MAX_PEER_LINKS,
7361                                   nla_get_u16);
7362         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
7363                                   NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
7364         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
7365                                   NL80211_MESHCONF_TTL, nla_get_u8);
7366         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
7367                                   NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
7368         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
7369                                   NL80211_MESHCONF_AUTO_OPEN_PLINKS,
7370                                   nla_get_u8);
7371         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
7372                                   mask,
7373                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
7374                                   nla_get_u32);
7375         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
7376                                   NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
7377                                   nla_get_u8);
7378         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
7379                                   NL80211_MESHCONF_PATH_REFRESH_TIME,
7380                                   nla_get_u32);
7381         if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
7382             (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
7383                 return -EINVAL;
7384         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
7385                                   NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
7386                                   nla_get_u16);
7387         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
7388                                   mask,
7389                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
7390                                   nla_get_u32);
7391         if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
7392             (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
7393              cfg->dot11MeshHWMPactivePathTimeout > 65535))
7394                 return -EINVAL;
7395         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
7396                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
7397                                   nla_get_u16);
7398         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
7399                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
7400                                   nla_get_u16);
7401         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
7402                                   dot11MeshHWMPnetDiameterTraversalTime, mask,
7403                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
7404                                   nla_get_u16);
7405         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
7406                                   NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
7407         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
7408                                   NL80211_MESHCONF_HWMP_RANN_INTERVAL,
7409                                   nla_get_u16);
7410         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
7411                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
7412                                   nla_get_u8);
7413         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
7414                                   NL80211_MESHCONF_FORWARDING, nla_get_u8);
7415         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
7416                                   NL80211_MESHCONF_RSSI_THRESHOLD,
7417                                   nla_get_s32);
7418         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask,
7419                                   NL80211_MESHCONF_CONNECTED_TO_GATE,
7420                                   nla_get_u8);
7421         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToAuthServer, mask,
7422                                   NL80211_MESHCONF_CONNECTED_TO_AS,
7423                                   nla_get_u8);
7424         /*
7425          * Check HT operation mode based on
7426          * IEEE 802.11-2016 9.4.2.57 HT Operation element.
7427          */
7428         if (tb[NL80211_MESHCONF_HT_OPMODE]) {
7429                 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
7430
7431                 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
7432                                   IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
7433                                   IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
7434                         return -EINVAL;
7435
7436                 /* NON_HT_STA bit is reserved, but some programs set it */
7437                 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
7438
7439                 cfg->ht_opmode = ht_opmode;
7440                 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
7441         }
7442         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
7443                                   dot11MeshHWMPactivePathToRootTimeout, mask,
7444                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
7445                                   nla_get_u32);
7446         if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
7447             (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
7448              cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
7449                 return -EINVAL;
7450         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
7451                                   NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
7452                                   nla_get_u16);
7453         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
7454                                   mask,
7455                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
7456                                   nla_get_u16);
7457         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
7458                                   NL80211_MESHCONF_POWER_MODE, nla_get_u32);
7459         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
7460                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
7461         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
7462                                   NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
7463         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNolearn, mask,
7464                                   NL80211_MESHCONF_NOLEARN, nla_get_u8);
7465         if (mask_out)
7466                 *mask_out = mask;
7467
7468         return 0;
7469
7470 #undef FILL_IN_MESH_PARAM_IF_SET
7471 }
7472
7473 static int nl80211_parse_mesh_setup(struct genl_info *info,
7474                                      struct mesh_setup *setup)
7475 {
7476         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7477         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
7478
7479         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
7480                 return -EINVAL;
7481         if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack))
7482                 return -EINVAL;
7483
7484         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
7485                 setup->sync_method =
7486                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
7487                  IEEE80211_SYNC_METHOD_VENDOR :
7488                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
7489
7490         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
7491                 setup->path_sel_proto =
7492                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
7493                  IEEE80211_PATH_PROTOCOL_VENDOR :
7494                  IEEE80211_PATH_PROTOCOL_HWMP;
7495
7496         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
7497                 setup->path_metric =
7498                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
7499                  IEEE80211_PATH_METRIC_VENDOR :
7500                  IEEE80211_PATH_METRIC_AIRTIME;
7501
7502         if (tb[NL80211_MESH_SETUP_IE]) {
7503                 struct nlattr *ieattr =
7504                         tb[NL80211_MESH_SETUP_IE];
7505                 setup->ie = nla_data(ieattr);
7506                 setup->ie_len = nla_len(ieattr);
7507         }
7508         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
7509             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
7510                 return -EINVAL;
7511         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
7512         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
7513         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
7514         if (setup->is_secure)
7515                 setup->user_mpm = true;
7516
7517         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
7518                 if (!setup->user_mpm)
7519                         return -EINVAL;
7520                 setup->auth_id =
7521                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
7522         }
7523
7524         return 0;
7525 }
7526
7527 static int nl80211_update_mesh_config(struct sk_buff *skb,
7528                                       struct genl_info *info)
7529 {
7530         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7531         struct net_device *dev = info->user_ptr[1];
7532         struct wireless_dev *wdev = dev->ieee80211_ptr;
7533         struct mesh_config cfg;
7534         u32 mask;
7535         int err;
7536
7537         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
7538                 return -EOPNOTSUPP;
7539
7540         if (!rdev->ops->update_mesh_config)
7541                 return -EOPNOTSUPP;
7542
7543         err = nl80211_parse_mesh_config(info, &cfg, &mask);
7544         if (err)
7545                 return err;
7546
7547         wdev_lock(wdev);
7548         if (!wdev->mesh_id_len)
7549                 err = -ENOLINK;
7550
7551         if (!err)
7552                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
7553
7554         wdev_unlock(wdev);
7555
7556         return err;
7557 }
7558
7559 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
7560                               struct sk_buff *msg)
7561 {
7562         struct nlattr *nl_reg_rules;
7563         unsigned int i;
7564
7565         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
7566             (regdom->dfs_region &&
7567              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
7568                 goto nla_put_failure;
7569
7570         nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES);
7571         if (!nl_reg_rules)
7572                 goto nla_put_failure;
7573
7574         for (i = 0; i < regdom->n_reg_rules; i++) {
7575                 struct nlattr *nl_reg_rule;
7576                 const struct ieee80211_reg_rule *reg_rule;
7577                 const struct ieee80211_freq_range *freq_range;
7578                 const struct ieee80211_power_rule *power_rule;
7579                 unsigned int max_bandwidth_khz;
7580
7581                 reg_rule = &regdom->reg_rules[i];
7582                 freq_range = &reg_rule->freq_range;
7583                 power_rule = &reg_rule->power_rule;
7584
7585                 nl_reg_rule = nla_nest_start_noflag(msg, i);
7586                 if (!nl_reg_rule)
7587                         goto nla_put_failure;
7588
7589                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
7590                 if (!max_bandwidth_khz)
7591                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
7592                                                                   reg_rule);
7593
7594                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
7595                                 reg_rule->flags) ||
7596                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
7597                                 freq_range->start_freq_khz) ||
7598                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
7599                                 freq_range->end_freq_khz) ||
7600                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
7601                                 max_bandwidth_khz) ||
7602                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
7603                                 power_rule->max_antenna_gain) ||
7604                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
7605                                 power_rule->max_eirp) ||
7606                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
7607                                 reg_rule->dfs_cac_ms))
7608                         goto nla_put_failure;
7609
7610                 nla_nest_end(msg, nl_reg_rule);
7611         }
7612
7613         nla_nest_end(msg, nl_reg_rules);
7614         return 0;
7615
7616 nla_put_failure:
7617         return -EMSGSIZE;
7618 }
7619
7620 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
7621 {
7622         const struct ieee80211_regdomain *regdom = NULL;
7623         struct cfg80211_registered_device *rdev;
7624         struct wiphy *wiphy = NULL;
7625         struct sk_buff *msg;
7626         void *hdr;
7627
7628         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7629         if (!msg)
7630                 return -ENOBUFS;
7631
7632         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7633                              NL80211_CMD_GET_REG);
7634         if (!hdr)
7635                 goto put_failure;
7636
7637         if (info->attrs[NL80211_ATTR_WIPHY]) {
7638                 bool self_managed;
7639
7640                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
7641                 if (IS_ERR(rdev)) {
7642                         nlmsg_free(msg);
7643                         return PTR_ERR(rdev);
7644                 }
7645
7646                 wiphy = &rdev->wiphy;
7647                 self_managed = wiphy->regulatory_flags &
7648                                REGULATORY_WIPHY_SELF_MANAGED;
7649                 regdom = get_wiphy_regdom(wiphy);
7650
7651                 /* a self-managed-reg device must have a private regdom */
7652                 if (WARN_ON(!regdom && self_managed)) {
7653                         nlmsg_free(msg);
7654                         return -EINVAL;
7655                 }
7656
7657                 if (regdom &&
7658                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
7659                         goto nla_put_failure;
7660         }
7661
7662         if (!wiphy && reg_last_request_cell_base() &&
7663             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
7664                         NL80211_USER_REG_HINT_CELL_BASE))
7665                 goto nla_put_failure;
7666
7667         rcu_read_lock();
7668
7669         if (!regdom)
7670                 regdom = rcu_dereference(cfg80211_regdomain);
7671
7672         if (nl80211_put_regdom(regdom, msg))
7673                 goto nla_put_failure_rcu;
7674
7675         rcu_read_unlock();
7676
7677         genlmsg_end(msg, hdr);
7678         return genlmsg_reply(msg, info);
7679
7680 nla_put_failure_rcu:
7681         rcu_read_unlock();
7682 nla_put_failure:
7683 put_failure:
7684         nlmsg_free(msg);
7685         return -EMSGSIZE;
7686 }
7687
7688 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
7689                                u32 seq, int flags, struct wiphy *wiphy,
7690                                const struct ieee80211_regdomain *regdom)
7691 {
7692         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
7693                                    NL80211_CMD_GET_REG);
7694
7695         if (!hdr)
7696                 return -1;
7697
7698         genl_dump_check_consistent(cb, hdr);
7699
7700         if (nl80211_put_regdom(regdom, msg))
7701                 goto nla_put_failure;
7702
7703         if (!wiphy && reg_last_request_cell_base() &&
7704             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
7705                         NL80211_USER_REG_HINT_CELL_BASE))
7706                 goto nla_put_failure;
7707
7708         if (wiphy &&
7709             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
7710                 goto nla_put_failure;
7711
7712         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
7713             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
7714                 goto nla_put_failure;
7715
7716         genlmsg_end(msg, hdr);
7717         return 0;
7718
7719 nla_put_failure:
7720         genlmsg_cancel(msg, hdr);
7721         return -EMSGSIZE;
7722 }
7723
7724 static int nl80211_get_reg_dump(struct sk_buff *skb,
7725                                 struct netlink_callback *cb)
7726 {
7727         const struct ieee80211_regdomain *regdom = NULL;
7728         struct cfg80211_registered_device *rdev;
7729         int err, reg_idx, start = cb->args[2];
7730
7731         rtnl_lock();
7732
7733         if (cfg80211_regdomain && start == 0) {
7734                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
7735                                           NLM_F_MULTI, NULL,
7736                                           rtnl_dereference(cfg80211_regdomain));
7737                 if (err < 0)
7738                         goto out_err;
7739         }
7740
7741         /* the global regdom is idx 0 */
7742         reg_idx = 1;
7743         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
7744                 regdom = get_wiphy_regdom(&rdev->wiphy);
7745                 if (!regdom)
7746                         continue;
7747
7748                 if (++reg_idx <= start)
7749                         continue;
7750
7751                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
7752                                           NLM_F_MULTI, &rdev->wiphy, regdom);
7753                 if (err < 0) {
7754                         reg_idx--;
7755                         break;
7756                 }
7757         }
7758
7759         cb->args[2] = reg_idx;
7760         err = skb->len;
7761 out_err:
7762         rtnl_unlock();
7763         return err;
7764 }
7765
7766 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
7767 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
7768         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
7769         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
7770         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
7771         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
7772         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
7773         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
7774         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
7775 };
7776
7777 static int parse_reg_rule(struct nlattr *tb[],
7778         struct ieee80211_reg_rule *reg_rule)
7779 {
7780         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
7781         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
7782
7783         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
7784                 return -EINVAL;
7785         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
7786                 return -EINVAL;
7787         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
7788                 return -EINVAL;
7789         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
7790                 return -EINVAL;
7791         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
7792                 return -EINVAL;
7793
7794         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
7795
7796         freq_range->start_freq_khz =
7797                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
7798         freq_range->end_freq_khz =
7799                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
7800         freq_range->max_bandwidth_khz =
7801                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
7802
7803         power_rule->max_eirp =
7804                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
7805
7806         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
7807                 power_rule->max_antenna_gain =
7808                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
7809
7810         if (tb[NL80211_ATTR_DFS_CAC_TIME])
7811                 reg_rule->dfs_cac_ms =
7812                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
7813
7814         return 0;
7815 }
7816
7817 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
7818 {
7819         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
7820         struct nlattr *nl_reg_rule;
7821         char *alpha2;
7822         int rem_reg_rules, r;
7823         u32 num_rules = 0, rule_idx = 0;
7824         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
7825         struct ieee80211_regdomain *rd;
7826
7827         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
7828                 return -EINVAL;
7829
7830         if (!info->attrs[NL80211_ATTR_REG_RULES])
7831                 return -EINVAL;
7832
7833         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
7834
7835         if (info->attrs[NL80211_ATTR_DFS_REGION])
7836                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
7837
7838         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
7839                             rem_reg_rules) {
7840                 num_rules++;
7841                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
7842                         return -EINVAL;
7843         }
7844
7845         if (!reg_is_valid_request(alpha2))
7846                 return -EINVAL;
7847
7848         rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL);
7849         if (!rd)
7850                 return -ENOMEM;
7851
7852         rd->n_reg_rules = num_rules;
7853         rd->alpha2[0] = alpha2[0];
7854         rd->alpha2[1] = alpha2[1];
7855
7856         /*
7857          * Disable DFS master mode if the DFS region was
7858          * not supported or known on this kernel.
7859          */
7860         if (reg_supported_dfs_region(dfs_region))
7861                 rd->dfs_region = dfs_region;
7862
7863         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
7864                             rem_reg_rules) {
7865                 r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX,
7866                                                 nl_reg_rule, reg_rule_policy,
7867                                                 info->extack);
7868                 if (r)
7869                         goto bad_reg;
7870                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
7871                 if (r)
7872                         goto bad_reg;
7873
7874                 rule_idx++;
7875
7876                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
7877                         r = -EINVAL;
7878                         goto bad_reg;
7879                 }
7880         }
7881
7882         /* set_regdom takes ownership of rd */
7883         return set_regdom(rd, REGD_SOURCE_CRDA);
7884  bad_reg:
7885         kfree(rd);
7886         return r;
7887 }
7888 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
7889
7890 static int validate_scan_freqs(struct nlattr *freqs)
7891 {
7892         struct nlattr *attr1, *attr2;
7893         int n_channels = 0, tmp1, tmp2;
7894
7895         nla_for_each_nested(attr1, freqs, tmp1)
7896                 if (nla_len(attr1) != sizeof(u32))
7897                         return 0;
7898
7899         nla_for_each_nested(attr1, freqs, tmp1) {
7900                 n_channels++;
7901                 /*
7902                  * Some hardware has a limited channel list for
7903                  * scanning, and it is pretty much nonsensical
7904                  * to scan for a channel twice, so disallow that
7905                  * and don't require drivers to check that the
7906                  * channel list they get isn't longer than what
7907                  * they can scan, as long as they can scan all
7908                  * the channels they registered at once.
7909                  */
7910                 nla_for_each_nested(attr2, freqs, tmp2)
7911                         if (attr1 != attr2 &&
7912                             nla_get_u32(attr1) == nla_get_u32(attr2))
7913                                 return 0;
7914         }
7915
7916         return n_channels;
7917 }
7918
7919 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
7920 {
7921         return b < NUM_NL80211_BANDS && wiphy->bands[b];
7922 }
7923
7924 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
7925                             struct cfg80211_bss_selection *bss_select)
7926 {
7927         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
7928         struct nlattr *nest;
7929         int err;
7930         bool found = false;
7931         int i;
7932
7933         /* only process one nested attribute */
7934         nest = nla_data(nla);
7935         if (!nla_ok(nest, nla_len(nest)))
7936                 return -EINVAL;
7937
7938         err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX,
7939                                           nest, nl80211_bss_select_policy,
7940                                           NULL);
7941         if (err)
7942                 return err;
7943
7944         /* only one attribute may be given */
7945         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
7946                 if (attr[i]) {
7947                         if (found)
7948                                 return -EINVAL;
7949                         found = true;
7950                 }
7951         }
7952
7953         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
7954
7955         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
7956                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
7957
7958         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
7959                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
7960                 bss_select->param.band_pref =
7961                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
7962                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
7963                         return -EINVAL;
7964         }
7965
7966         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
7967                 struct nl80211_bss_select_rssi_adjust *adj_param;
7968
7969                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
7970                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
7971                 bss_select->param.adjust.band = adj_param->band;
7972                 bss_select->param.adjust.delta = adj_param->delta;
7973                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
7974                         return -EINVAL;
7975         }
7976
7977         /* user-space did not provide behaviour attribute */
7978         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
7979                 return -EINVAL;
7980
7981         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
7982                 return -EINVAL;
7983
7984         return 0;
7985 }
7986
7987 int nl80211_parse_random_mac(struct nlattr **attrs,
7988                              u8 *mac_addr, u8 *mac_addr_mask)
7989 {
7990         int i;
7991
7992         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
7993                 eth_zero_addr(mac_addr);
7994                 eth_zero_addr(mac_addr_mask);
7995                 mac_addr[0] = 0x2;
7996                 mac_addr_mask[0] = 0x3;
7997
7998                 return 0;
7999         }
8000
8001         /* need both or none */
8002         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
8003                 return -EINVAL;
8004
8005         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
8006         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
8007
8008         /* don't allow or configure an mcast address */
8009         if (!is_multicast_ether_addr(mac_addr_mask) ||
8010             is_multicast_ether_addr(mac_addr))
8011                 return -EINVAL;
8012
8013         /*
8014          * allow users to pass a MAC address that has bits set outside
8015          * of the mask, but don't bother drivers with having to deal
8016          * with such bits
8017          */
8018         for (i = 0; i < ETH_ALEN; i++)
8019                 mac_addr[i] &= mac_addr_mask[i];
8020
8021         return 0;
8022 }
8023
8024 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev)
8025 {
8026         ASSERT_WDEV_LOCK(wdev);
8027
8028         if (!cfg80211_beaconing_iface_active(wdev))
8029                 return true;
8030
8031         if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR))
8032                 return true;
8033
8034         return regulatory_pre_cac_allowed(wdev->wiphy);
8035 }
8036
8037 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
8038                                     enum nl80211_ext_feature_index feat)
8039 {
8040         if (!(flags & flag))
8041                 return true;
8042         if (wiphy_ext_feature_isset(wiphy, feat))
8043                 return true;
8044         return false;
8045 }
8046
8047 static int
8048 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
8049                          void *request, struct nlattr **attrs,
8050                          bool is_sched_scan)
8051 {
8052         u8 *mac_addr, *mac_addr_mask;
8053         u32 *flags;
8054         enum nl80211_feature_flags randomness_flag;
8055
8056         if (!attrs[NL80211_ATTR_SCAN_FLAGS])
8057                 return 0;
8058
8059         if (is_sched_scan) {
8060                 struct cfg80211_sched_scan_request *req = request;
8061
8062                 randomness_flag = wdev ?
8063                                   NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
8064                                   NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
8065                 flags = &req->flags;
8066                 mac_addr = req->mac_addr;
8067                 mac_addr_mask = req->mac_addr_mask;
8068         } else {
8069                 struct cfg80211_scan_request *req = request;
8070
8071                 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
8072                 flags = &req->flags;
8073                 mac_addr = req->mac_addr;
8074                 mac_addr_mask = req->mac_addr_mask;
8075         }
8076
8077         *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
8078
8079         if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
8080              !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
8081             !nl80211_check_scan_feat(wiphy, *flags,
8082                                      NL80211_SCAN_FLAG_LOW_SPAN,
8083                                      NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
8084             !nl80211_check_scan_feat(wiphy, *flags,
8085                                      NL80211_SCAN_FLAG_LOW_POWER,
8086                                      NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
8087             !nl80211_check_scan_feat(wiphy, *flags,
8088                                      NL80211_SCAN_FLAG_HIGH_ACCURACY,
8089                                      NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
8090             !nl80211_check_scan_feat(wiphy, *flags,
8091                                      NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
8092                                      NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
8093             !nl80211_check_scan_feat(wiphy, *flags,
8094                                      NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
8095                                      NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
8096             !nl80211_check_scan_feat(wiphy, *flags,
8097                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
8098                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
8099             !nl80211_check_scan_feat(wiphy, *flags,
8100                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
8101                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
8102             !nl80211_check_scan_feat(wiphy, *flags,
8103                                      NL80211_SCAN_FLAG_RANDOM_SN,
8104                                      NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
8105             !nl80211_check_scan_feat(wiphy, *flags,
8106                                      NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
8107                                      NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
8108                 return -EOPNOTSUPP;
8109
8110         if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
8111                 int err;
8112
8113                 if (!(wiphy->features & randomness_flag) ||
8114                     (wdev && wdev->current_bss))
8115                         return -EOPNOTSUPP;
8116
8117                 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
8118                 if (err)
8119                         return err;
8120         }
8121
8122         return 0;
8123 }
8124
8125 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
8126 {
8127         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8128         struct wireless_dev *wdev = info->user_ptr[1];
8129         struct cfg80211_scan_request *request;
8130         struct nlattr *scan_freqs = NULL;
8131         bool scan_freqs_khz = false;
8132         struct nlattr *attr;
8133         struct wiphy *wiphy;
8134         int err, tmp, n_ssids = 0, n_channels, i;
8135         size_t ie_len;
8136
8137         wiphy = &rdev->wiphy;
8138
8139         if (wdev->iftype == NL80211_IFTYPE_NAN)
8140                 return -EOPNOTSUPP;
8141
8142         if (!rdev->ops->scan)
8143                 return -EOPNOTSUPP;
8144
8145         if (rdev->scan_req || rdev->scan_msg)
8146                 return -EBUSY;
8147
8148         if (info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]) {
8149                 if (!wiphy_ext_feature_isset(wiphy,
8150                                              NL80211_EXT_FEATURE_SCAN_FREQ_KHZ))
8151                         return -EOPNOTSUPP;
8152                 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ];
8153                 scan_freqs_khz = true;
8154         } else if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES])
8155                 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQUENCIES];
8156
8157         if (scan_freqs) {
8158                 n_channels = validate_scan_freqs(scan_freqs);
8159                 if (!n_channels)
8160                         return -EINVAL;
8161         } else {
8162                 n_channels = ieee80211_get_num_supported_channels(wiphy);
8163         }
8164
8165         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
8166                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
8167                         n_ssids++;
8168
8169         if (n_ssids > wiphy->max_scan_ssids)
8170                 return -EINVAL;
8171
8172         if (info->attrs[NL80211_ATTR_IE])
8173                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8174         else
8175                 ie_len = 0;
8176
8177         if (ie_len > wiphy->max_scan_ie_len)
8178                 return -EINVAL;
8179
8180         request = kzalloc(sizeof(*request)
8181                         + sizeof(*request->ssids) * n_ssids
8182                         + sizeof(*request->channels) * n_channels
8183                         + ie_len, GFP_KERNEL);
8184         if (!request)
8185                 return -ENOMEM;
8186
8187         if (n_ssids)
8188                 request->ssids = (void *)&request->channels[n_channels];
8189         request->n_ssids = n_ssids;
8190         if (ie_len) {
8191                 if (n_ssids)
8192                         request->ie = (void *)(request->ssids + n_ssids);
8193                 else
8194                         request->ie = (void *)(request->channels + n_channels);
8195         }
8196
8197         i = 0;
8198         if (scan_freqs) {
8199                 /* user specified, bail out if channel not found */
8200                 nla_for_each_nested(attr, scan_freqs, tmp) {
8201                         struct ieee80211_channel *chan;
8202                         int freq = nla_get_u32(attr);
8203
8204                         if (!scan_freqs_khz)
8205                                 freq = MHZ_TO_KHZ(freq);
8206
8207                         chan = ieee80211_get_channel_khz(wiphy, freq);
8208                         if (!chan) {
8209                                 err = -EINVAL;
8210                                 goto out_free;
8211                         }
8212
8213                         /* ignore disabled channels */
8214                         if (chan->flags & IEEE80211_CHAN_DISABLED)
8215                                 continue;
8216
8217                         request->channels[i] = chan;
8218                         i++;
8219                 }
8220         } else {
8221                 enum nl80211_band band;
8222
8223                 /* all channels */
8224                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
8225                         int j;
8226
8227                         if (!wiphy->bands[band])
8228                                 continue;
8229                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
8230                                 struct ieee80211_channel *chan;
8231
8232                                 chan = &wiphy->bands[band]->channels[j];
8233
8234                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
8235                                         continue;
8236
8237                                 request->channels[i] = chan;
8238                                 i++;
8239                         }
8240                 }
8241         }
8242
8243         if (!i) {
8244                 err = -EINVAL;
8245                 goto out_free;
8246         }
8247
8248         request->n_channels = i;
8249
8250         wdev_lock(wdev);
8251         if (!cfg80211_off_channel_oper_allowed(wdev)) {
8252                 struct ieee80211_channel *chan;
8253
8254                 if (request->n_channels != 1) {
8255                         wdev_unlock(wdev);
8256                         err = -EBUSY;
8257                         goto out_free;
8258                 }
8259
8260                 chan = request->channels[0];
8261                 if (chan->center_freq != wdev->chandef.chan->center_freq) {
8262                         wdev_unlock(wdev);
8263                         err = -EBUSY;
8264                         goto out_free;
8265                 }
8266         }
8267         wdev_unlock(wdev);
8268
8269         i = 0;
8270         if (n_ssids) {
8271                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
8272                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
8273                                 err = -EINVAL;
8274                                 goto out_free;
8275                         }
8276                         request->ssids[i].ssid_len = nla_len(attr);
8277                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
8278                         i++;
8279                 }
8280         }
8281
8282         if (info->attrs[NL80211_ATTR_IE]) {
8283                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8284                 memcpy((void *)request->ie,
8285                        nla_data(info->attrs[NL80211_ATTR_IE]),
8286                        request->ie_len);
8287         }
8288
8289         for (i = 0; i < NUM_NL80211_BANDS; i++)
8290                 if (wiphy->bands[i])
8291                         request->rates[i] =
8292                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
8293
8294         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
8295                 nla_for_each_nested(attr,
8296                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
8297                                     tmp) {
8298                         enum nl80211_band band = nla_type(attr);
8299
8300                         if (band < 0 || band >= NUM_NL80211_BANDS) {
8301                                 err = -EINVAL;
8302                                 goto out_free;
8303                         }
8304
8305                         if (!wiphy->bands[band])
8306                                 continue;
8307
8308                         err = ieee80211_get_ratemask(wiphy->bands[band],
8309                                                      nla_data(attr),
8310                                                      nla_len(attr),
8311                                                      &request->rates[band]);
8312                         if (err)
8313                                 goto out_free;
8314                 }
8315         }
8316
8317         if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
8318                 request->duration =
8319                         nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
8320                 request->duration_mandatory =
8321                         nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
8322         }
8323
8324         err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
8325                                        false);
8326         if (err)
8327                 goto out_free;
8328
8329         request->no_cck =
8330                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
8331
8332         /* Initial implementation used NL80211_ATTR_MAC to set the specific
8333          * BSSID to scan for. This was problematic because that same attribute
8334          * was already used for another purpose (local random MAC address). The
8335          * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
8336          * compatibility with older userspace components, also use the
8337          * NL80211_ATTR_MAC value here if it can be determined to be used for
8338          * the specific BSSID use case instead of the random MAC address
8339          * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
8340          */
8341         if (info->attrs[NL80211_ATTR_BSSID])
8342                 memcpy(request->bssid,
8343                        nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
8344         else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
8345                  info->attrs[NL80211_ATTR_MAC])
8346                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
8347                        ETH_ALEN);
8348         else
8349                 eth_broadcast_addr(request->bssid);
8350
8351         request->wdev = wdev;
8352         request->wiphy = &rdev->wiphy;
8353         request->scan_start = jiffies;
8354
8355         rdev->scan_req = request;
8356         err = cfg80211_scan(rdev);
8357
8358         if (err)
8359                 goto out_free;
8360
8361         nl80211_send_scan_start(rdev, wdev);
8362         if (wdev->netdev)
8363                 dev_hold(wdev->netdev);
8364
8365         return 0;
8366
8367  out_free:
8368         rdev->scan_req = NULL;
8369         kfree(request);
8370
8371         return err;
8372 }
8373
8374 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
8375 {
8376         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8377         struct wireless_dev *wdev = info->user_ptr[1];
8378
8379         if (!rdev->ops->abort_scan)
8380                 return -EOPNOTSUPP;
8381
8382         if (rdev->scan_msg)
8383                 return 0;
8384
8385         if (!rdev->scan_req)
8386                 return -ENOENT;
8387
8388         rdev_abort_scan(rdev, wdev);
8389         return 0;
8390 }
8391
8392 static int
8393 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
8394                                struct cfg80211_sched_scan_request *request,
8395                                struct nlattr **attrs)
8396 {
8397         int tmp, err, i = 0;
8398         struct nlattr *attr;
8399
8400         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
8401                 u32 interval;
8402
8403                 /*
8404                  * If scan plans are not specified,
8405                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
8406                  * case one scan plan will be set with the specified scan
8407                  * interval and infinite number of iterations.
8408                  */
8409                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
8410                 if (!interval)
8411                         return -EINVAL;
8412
8413                 request->scan_plans[0].interval =
8414                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
8415                 if (!request->scan_plans[0].interval)
8416                         return -EINVAL;
8417
8418                 if (request->scan_plans[0].interval >
8419                     wiphy->max_sched_scan_plan_interval)
8420                         request->scan_plans[0].interval =
8421                                 wiphy->max_sched_scan_plan_interval;
8422
8423                 return 0;
8424         }
8425
8426         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
8427                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
8428
8429                 if (WARN_ON(i >= n_plans))
8430                         return -EINVAL;
8431
8432                 err = nla_parse_nested_deprecated(plan,
8433                                                   NL80211_SCHED_SCAN_PLAN_MAX,
8434                                                   attr, nl80211_plan_policy,
8435                                                   NULL);
8436                 if (err)
8437                         return err;
8438
8439                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
8440                         return -EINVAL;
8441
8442                 request->scan_plans[i].interval =
8443                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
8444                 if (!request->scan_plans[i].interval ||
8445                     request->scan_plans[i].interval >
8446                     wiphy->max_sched_scan_plan_interval)
8447                         return -EINVAL;
8448
8449                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
8450                         request->scan_plans[i].iterations =
8451                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
8452                         if (!request->scan_plans[i].iterations ||
8453                             (request->scan_plans[i].iterations >
8454                              wiphy->max_sched_scan_plan_iterations))
8455                                 return -EINVAL;
8456                 } else if (i < n_plans - 1) {
8457                         /*
8458                          * All scan plans but the last one must specify
8459                          * a finite number of iterations
8460                          */
8461                         return -EINVAL;
8462                 }
8463
8464                 i++;
8465         }
8466
8467         /*
8468          * The last scan plan must not specify the number of
8469          * iterations, it is supposed to run infinitely
8470          */
8471         if (request->scan_plans[n_plans - 1].iterations)
8472                 return  -EINVAL;
8473
8474         return 0;
8475 }
8476
8477 static int
8478 nl80211_parse_sched_scan_per_band_rssi(struct wiphy *wiphy,
8479                                        struct cfg80211_match_set *match_sets,
8480                                        struct nlattr *tb_band_rssi,
8481                                        s32 rssi_thold)
8482 {
8483         struct nlattr *attr;
8484         int i, tmp, ret = 0;
8485
8486         if (!wiphy_ext_feature_isset(wiphy,
8487                     NL80211_EXT_FEATURE_SCHED_SCAN_BAND_SPECIFIC_RSSI_THOLD)) {
8488                 if (tb_band_rssi)
8489                         ret = -EOPNOTSUPP;
8490                 else
8491                         for (i = 0; i < NUM_NL80211_BANDS; i++)
8492                                 match_sets->per_band_rssi_thold[i] =
8493                                         NL80211_SCAN_RSSI_THOLD_OFF;
8494                 return ret;
8495         }
8496
8497         for (i = 0; i < NUM_NL80211_BANDS; i++)
8498                 match_sets->per_band_rssi_thold[i] = rssi_thold;
8499
8500         nla_for_each_nested(attr, tb_band_rssi, tmp) {
8501                 enum nl80211_band band = nla_type(attr);
8502
8503                 if (band < 0 || band >= NUM_NL80211_BANDS)
8504                         return -EINVAL;
8505
8506                 match_sets->per_band_rssi_thold[band] = nla_get_s32(attr);
8507         }
8508
8509         return 0;
8510 }
8511
8512 static struct cfg80211_sched_scan_request *
8513 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
8514                          struct nlattr **attrs, int max_match_sets)
8515 {
8516         struct cfg80211_sched_scan_request *request;
8517         struct nlattr *attr;
8518         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
8519         enum nl80211_band band;
8520         size_t ie_len;
8521         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
8522         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
8523
8524         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
8525                 n_channels = validate_scan_freqs(
8526                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
8527                 if (!n_channels)
8528                         return ERR_PTR(-EINVAL);
8529         } else {
8530                 n_channels = ieee80211_get_num_supported_channels(wiphy);
8531         }
8532
8533         if (attrs[NL80211_ATTR_SCAN_SSIDS])
8534                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
8535                                     tmp)
8536                         n_ssids++;
8537
8538         if (n_ssids > wiphy->max_sched_scan_ssids)
8539                 return ERR_PTR(-EINVAL);
8540
8541         /*
8542          * First, count the number of 'real' matchsets. Due to an issue with
8543          * the old implementation, matchsets containing only the RSSI attribute
8544          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
8545          * RSSI for all matchsets, rather than their own matchset for reporting
8546          * all APs with a strong RSSI. This is needed to be compatible with
8547          * older userspace that treated a matchset with only the RSSI as the
8548          * global RSSI for all other matchsets - if there are other matchsets.
8549          */
8550         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
8551                 nla_for_each_nested(attr,
8552                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
8553                                     tmp) {
8554                         struct nlattr *rssi;
8555
8556                         err = nla_parse_nested_deprecated(tb,
8557                                                           NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
8558                                                           attr,
8559                                                           nl80211_match_policy,
8560                                                           NULL);
8561                         if (err)
8562                                 return ERR_PTR(err);
8563
8564                         /* SSID and BSSID are mutually exclusive */
8565                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
8566                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
8567                                 return ERR_PTR(-EINVAL);
8568
8569                         /* add other standalone attributes here */
8570                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
8571                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
8572                                 n_match_sets++;
8573                                 continue;
8574                         }
8575                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
8576                         if (rssi)
8577                                 default_match_rssi = nla_get_s32(rssi);
8578                 }
8579         }
8580
8581         /* However, if there's no other matchset, add the RSSI one */
8582         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
8583                 n_match_sets = 1;
8584
8585         if (n_match_sets > max_match_sets)
8586                 return ERR_PTR(-EINVAL);
8587
8588         if (attrs[NL80211_ATTR_IE])
8589                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
8590         else
8591                 ie_len = 0;
8592
8593         if (ie_len > wiphy->max_sched_scan_ie_len)
8594                 return ERR_PTR(-EINVAL);
8595
8596         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
8597                 /*
8598                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
8599                  * each scan plan already specifies its own interval
8600                  */
8601                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
8602                         return ERR_PTR(-EINVAL);
8603
8604                 nla_for_each_nested(attr,
8605                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
8606                         n_plans++;
8607         } else {
8608                 /*
8609                  * The scan interval attribute is kept for backward
8610                  * compatibility. If no scan plans are specified and sched scan
8611                  * interval is specified, one scan plan will be set with this
8612                  * scan interval and infinite number of iterations.
8613                  */
8614                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
8615                         return ERR_PTR(-EINVAL);
8616
8617                 n_plans = 1;
8618         }
8619
8620         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
8621                 return ERR_PTR(-EINVAL);
8622
8623         if (!wiphy_ext_feature_isset(
8624                     wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
8625             (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
8626              attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
8627                 return ERR_PTR(-EINVAL);
8628
8629         request = kzalloc(sizeof(*request)
8630                         + sizeof(*request->ssids) * n_ssids
8631                         + sizeof(*request->match_sets) * n_match_sets
8632                         + sizeof(*request->scan_plans) * n_plans
8633                         + sizeof(*request->channels) * n_channels
8634                         + ie_len, GFP_KERNEL);
8635         if (!request)
8636                 return ERR_PTR(-ENOMEM);
8637
8638         if (n_ssids)
8639                 request->ssids = (void *)&request->channels[n_channels];
8640         request->n_ssids = n_ssids;
8641         if (ie_len) {
8642                 if (n_ssids)
8643                         request->ie = (void *)(request->ssids + n_ssids);
8644                 else
8645                         request->ie = (void *)(request->channels + n_channels);
8646         }
8647
8648         if (n_match_sets) {
8649                 if (request->ie)
8650                         request->match_sets = (void *)(request->ie + ie_len);
8651                 else if (n_ssids)
8652                         request->match_sets =
8653                                 (void *)(request->ssids + n_ssids);
8654                 else
8655                         request->match_sets =
8656                                 (void *)(request->channels + n_channels);
8657         }
8658         request->n_match_sets = n_match_sets;
8659
8660         if (n_match_sets)
8661                 request->scan_plans = (void *)(request->match_sets +
8662                                                n_match_sets);
8663         else if (request->ie)
8664                 request->scan_plans = (void *)(request->ie + ie_len);
8665         else if (n_ssids)
8666                 request->scan_plans = (void *)(request->ssids + n_ssids);
8667         else
8668                 request->scan_plans = (void *)(request->channels + n_channels);
8669
8670         request->n_scan_plans = n_plans;
8671
8672         i = 0;
8673         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
8674                 /* user specified, bail out if channel not found */
8675                 nla_for_each_nested(attr,
8676                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
8677                                     tmp) {
8678                         struct ieee80211_channel *chan;
8679
8680                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
8681
8682                         if (!chan) {
8683                                 err = -EINVAL;
8684                                 goto out_free;
8685                         }
8686
8687                         /* ignore disabled channels */
8688                         if (chan->flags & IEEE80211_CHAN_DISABLED)
8689                                 continue;
8690
8691                         request->channels[i] = chan;
8692                         i++;
8693                 }
8694         } else {
8695                 /* all channels */
8696                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
8697                         int j;
8698
8699                         if (!wiphy->bands[band])
8700                                 continue;
8701                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
8702                                 struct ieee80211_channel *chan;
8703
8704                                 chan = &wiphy->bands[band]->channels[j];
8705
8706                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
8707                                         continue;
8708
8709                                 request->channels[i] = chan;
8710                                 i++;
8711                         }
8712                 }
8713         }
8714
8715         if (!i) {
8716                 err = -EINVAL;
8717                 goto out_free;
8718         }
8719
8720         request->n_channels = i;
8721
8722         i = 0;
8723         if (n_ssids) {
8724                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
8725                                     tmp) {
8726                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
8727                                 err = -EINVAL;
8728                                 goto out_free;
8729                         }
8730                         request->ssids[i].ssid_len = nla_len(attr);
8731                         memcpy(request->ssids[i].ssid, nla_data(attr),
8732                                nla_len(attr));
8733                         i++;
8734                 }
8735         }
8736
8737         i = 0;
8738         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
8739                 nla_for_each_nested(attr,
8740                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
8741                                     tmp) {
8742                         struct nlattr *ssid, *bssid, *rssi;
8743
8744                         err = nla_parse_nested_deprecated(tb,
8745                                                           NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
8746                                                           attr,
8747                                                           nl80211_match_policy,
8748                                                           NULL);
8749                         if (err)
8750                                 goto out_free;
8751                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
8752                         bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
8753
8754                         if (!ssid && !bssid) {
8755                                 i++;
8756                                 continue;
8757                         }
8758
8759                         if (WARN_ON(i >= n_match_sets)) {
8760                                 /* this indicates a programming error,
8761                                  * the loop above should have verified
8762                                  * things properly
8763                                  */
8764                                 err = -EINVAL;
8765                                 goto out_free;
8766                         }
8767
8768                         if (ssid) {
8769                                 memcpy(request->match_sets[i].ssid.ssid,
8770                                        nla_data(ssid), nla_len(ssid));
8771                                 request->match_sets[i].ssid.ssid_len =
8772                                         nla_len(ssid);
8773                         }
8774                         if (bssid)
8775                                 memcpy(request->match_sets[i].bssid,
8776                                        nla_data(bssid), ETH_ALEN);
8777
8778                         /* special attribute - old implementation w/a */
8779                         request->match_sets[i].rssi_thold = default_match_rssi;
8780                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
8781                         if (rssi)
8782                                 request->match_sets[i].rssi_thold =
8783                                         nla_get_s32(rssi);
8784
8785                         /* Parse per band RSSI attribute */
8786                         err = nl80211_parse_sched_scan_per_band_rssi(wiphy,
8787                                 &request->match_sets[i],
8788                                 tb[NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI],
8789                                 request->match_sets[i].rssi_thold);
8790                         if (err)
8791                                 goto out_free;
8792
8793                         i++;
8794                 }
8795
8796                 /* there was no other matchset, so the RSSI one is alone */
8797                 if (i == 0 && n_match_sets)
8798                         request->match_sets[0].rssi_thold = default_match_rssi;
8799
8800                 request->min_rssi_thold = INT_MAX;
8801                 for (i = 0; i < n_match_sets; i++)
8802                         request->min_rssi_thold =
8803                                 min(request->match_sets[i].rssi_thold,
8804                                     request->min_rssi_thold);
8805         } else {
8806                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
8807         }
8808
8809         if (ie_len) {
8810                 request->ie_len = ie_len;
8811                 memcpy((void *)request->ie,
8812                        nla_data(attrs[NL80211_ATTR_IE]),
8813                        request->ie_len);
8814         }
8815
8816         err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
8817         if (err)
8818                 goto out_free;
8819
8820         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
8821                 request->delay =
8822                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
8823
8824         if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
8825                 request->relative_rssi = nla_get_s8(
8826                         attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
8827                 request->relative_rssi_set = true;
8828         }
8829
8830         if (request->relative_rssi_set &&
8831             attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
8832                 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
8833
8834                 rssi_adjust = nla_data(
8835                         attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
8836                 request->rssi_adjust.band = rssi_adjust->band;
8837                 request->rssi_adjust.delta = rssi_adjust->delta;
8838                 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
8839                         err = -EINVAL;
8840                         goto out_free;
8841                 }
8842         }
8843
8844         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
8845         if (err)
8846                 goto out_free;
8847
8848         request->scan_start = jiffies;
8849
8850         return request;
8851
8852 out_free:
8853         kfree(request);
8854         return ERR_PTR(err);
8855 }
8856
8857 static int nl80211_start_sched_scan(struct sk_buff *skb,
8858                                     struct genl_info *info)
8859 {
8860         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8861         struct net_device *dev = info->user_ptr[1];
8862         struct wireless_dev *wdev = dev->ieee80211_ptr;
8863         struct cfg80211_sched_scan_request *sched_scan_req;
8864         bool want_multi;
8865         int err;
8866
8867         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
8868                 return -EOPNOTSUPP;
8869
8870         want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
8871         err = cfg80211_sched_scan_req_possible(rdev, want_multi);
8872         if (err)
8873                 return err;
8874
8875         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
8876                                                   info->attrs,
8877                                                   rdev->wiphy.max_match_sets);
8878
8879         err = PTR_ERR_OR_ZERO(sched_scan_req);
8880         if (err)
8881                 goto out_err;
8882
8883         /* leave request id zero for legacy request
8884          * or if driver does not support multi-scheduled scan
8885          */
8886         if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1)
8887                 sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
8888
8889         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
8890         if (err)
8891                 goto out_free;
8892
8893         sched_scan_req->dev = dev;
8894         sched_scan_req->wiphy = &rdev->wiphy;
8895
8896         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
8897                 sched_scan_req->owner_nlportid = info->snd_portid;
8898
8899         cfg80211_add_sched_scan_req(rdev, sched_scan_req);
8900
8901         nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
8902         return 0;
8903
8904 out_free:
8905         kfree(sched_scan_req);
8906 out_err:
8907         return err;
8908 }
8909
8910 static int nl80211_stop_sched_scan(struct sk_buff *skb,
8911                                    struct genl_info *info)
8912 {
8913         struct cfg80211_sched_scan_request *req;
8914         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8915         u64 cookie;
8916
8917         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
8918                 return -EOPNOTSUPP;
8919
8920         if (info->attrs[NL80211_ATTR_COOKIE]) {
8921                 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
8922                 return __cfg80211_stop_sched_scan(rdev, cookie, false);
8923         }
8924
8925         req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
8926                                      struct cfg80211_sched_scan_request,
8927                                      list);
8928         if (!req || req->reqid ||
8929             (req->owner_nlportid &&
8930              req->owner_nlportid != info->snd_portid))
8931                 return -ENOENT;
8932
8933         return cfg80211_stop_sched_scan_req(rdev, req, false);
8934 }
8935
8936 static int nl80211_start_radar_detection(struct sk_buff *skb,
8937                                          struct genl_info *info)
8938 {
8939         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8940         struct net_device *dev = info->user_ptr[1];
8941         struct wireless_dev *wdev = dev->ieee80211_ptr;
8942         struct wiphy *wiphy = wdev->wiphy;
8943         struct cfg80211_chan_def chandef;
8944         enum nl80211_dfs_regions dfs_region;
8945         unsigned int cac_time_ms;
8946         int err;
8947
8948         dfs_region = reg_get_dfs_region(wiphy);
8949         if (dfs_region == NL80211_DFS_UNSET)
8950                 return -EINVAL;
8951
8952         err = nl80211_parse_chandef(rdev, info, &chandef);
8953         if (err)
8954                 return err;
8955
8956         if (netif_carrier_ok(dev))
8957                 return -EBUSY;
8958
8959         if (wdev->cac_started)
8960                 return -EBUSY;
8961
8962         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
8963         if (err < 0)
8964                 return err;
8965
8966         if (err == 0)
8967                 return -EINVAL;
8968
8969         if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
8970                 return -EINVAL;
8971
8972         /* CAC start is offloaded to HW and can't be started manually */
8973         if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
8974                 return -EOPNOTSUPP;
8975
8976         if (!rdev->ops->start_radar_detection)
8977                 return -EOPNOTSUPP;
8978
8979         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
8980         if (WARN_ON(!cac_time_ms))
8981                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
8982
8983         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
8984         if (!err) {
8985                 wdev->chandef = chandef;
8986                 wdev->cac_started = true;
8987                 wdev->cac_start_time = jiffies;
8988                 wdev->cac_time_ms = cac_time_ms;
8989         }
8990         return err;
8991 }
8992
8993 static int nl80211_notify_radar_detection(struct sk_buff *skb,
8994                                           struct genl_info *info)
8995 {
8996         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8997         struct net_device *dev = info->user_ptr[1];
8998         struct wireless_dev *wdev = dev->ieee80211_ptr;
8999         struct wiphy *wiphy = wdev->wiphy;
9000         struct cfg80211_chan_def chandef;
9001         enum nl80211_dfs_regions dfs_region;
9002         int err;
9003
9004         dfs_region = reg_get_dfs_region(wiphy);
9005         if (dfs_region == NL80211_DFS_UNSET) {
9006                 GENL_SET_ERR_MSG(info,
9007                                  "DFS Region is not set. Unexpected Radar indication");
9008                 return -EINVAL;
9009         }
9010
9011         err = nl80211_parse_chandef(rdev, info, &chandef);
9012         if (err) {
9013                 GENL_SET_ERR_MSG(info, "Unable to extract chandef info");
9014                 return err;
9015         }
9016
9017         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
9018         if (err < 0) {
9019                 GENL_SET_ERR_MSG(info, "chandef is invalid");
9020                 return err;
9021         }
9022
9023         if (err == 0) {
9024                 GENL_SET_ERR_MSG(info,
9025                                  "Unexpected Radar indication for chandef/iftype");
9026                 return -EINVAL;
9027         }
9028
9029         /* Do not process this notification if radar is already detected
9030          * by kernel on this channel, and return success.
9031          */
9032         if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE)
9033                 return 0;
9034
9035         cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE);
9036
9037         cfg80211_sched_dfs_chan_update(rdev);
9038
9039         rdev->radar_chandef = chandef;
9040
9041         /* Propagate this notification to other radios as well */
9042         queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
9043
9044         return 0;
9045 }
9046
9047 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
9048 {
9049         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9050         struct net_device *dev = info->user_ptr[1];
9051         struct wireless_dev *wdev = dev->ieee80211_ptr;
9052         struct cfg80211_csa_settings params;
9053         /* csa_attrs is defined static to avoid waste of stack size - this
9054          * function is called under RTNL lock, so this should not be a problem.
9055          */
9056         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
9057         int err;
9058         bool need_new_beacon = false;
9059         bool need_handle_dfs_flag = true;
9060         int len, i;
9061         u32 cs_count;
9062
9063         if (!rdev->ops->channel_switch ||
9064             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
9065                 return -EOPNOTSUPP;
9066
9067         switch (dev->ieee80211_ptr->iftype) {
9068         case NL80211_IFTYPE_AP:
9069         case NL80211_IFTYPE_P2P_GO:
9070                 need_new_beacon = true;
9071                 /* For all modes except AP the handle_dfs flag needs to be
9072                  * supplied to tell the kernel that userspace will handle radar
9073                  * events when they happen. Otherwise a switch to a channel
9074                  * requiring DFS will be rejected.
9075                  */
9076                 need_handle_dfs_flag = false;
9077
9078                 /* useless if AP is not running */
9079                 if (!wdev->beacon_interval)
9080                         return -ENOTCONN;
9081                 break;
9082         case NL80211_IFTYPE_ADHOC:
9083                 if (!wdev->ssid_len)
9084                         return -ENOTCONN;
9085                 break;
9086         case NL80211_IFTYPE_MESH_POINT:
9087                 if (!wdev->mesh_id_len)
9088                         return -ENOTCONN;
9089                 break;
9090         default:
9091                 return -EOPNOTSUPP;
9092         }
9093
9094         memset(&params, 0, sizeof(params));
9095         params.beacon_csa.ftm_responder = -1;
9096
9097         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
9098             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
9099                 return -EINVAL;
9100
9101         /* only important for AP, IBSS and mesh create IEs internally */
9102         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
9103                 return -EINVAL;
9104
9105         /* Even though the attribute is u32, the specification says
9106          * u8, so let's make sure we don't overflow.
9107          */
9108         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
9109         if (cs_count > 255)
9110                 return -EINVAL;
9111
9112         params.count = cs_count;
9113
9114         if (!need_new_beacon)
9115                 goto skip_beacons;
9116
9117         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_after);
9118         if (err)
9119                 return err;
9120
9121         err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
9122                                           info->attrs[NL80211_ATTR_CSA_IES],
9123                                           nl80211_policy, info->extack);
9124         if (err)
9125                 return err;
9126
9127         err = nl80211_parse_beacon(rdev, csa_attrs, &params.beacon_csa);
9128         if (err)
9129                 return err;
9130
9131         if (!csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON])
9132                 return -EINVAL;
9133
9134         len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
9135         if (!len || (len % sizeof(u16)))
9136                 return -EINVAL;
9137
9138         params.n_counter_offsets_beacon = len / sizeof(u16);
9139         if (rdev->wiphy.max_num_csa_counters &&
9140             (params.n_counter_offsets_beacon >
9141              rdev->wiphy.max_num_csa_counters))
9142                 return -EINVAL;
9143
9144         params.counter_offsets_beacon =
9145                 nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
9146
9147         /* sanity checks - counters should fit and be the same */
9148         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
9149                 u16 offset = params.counter_offsets_beacon[i];
9150
9151                 if (offset >= params.beacon_csa.tail_len)
9152                         return -EINVAL;
9153
9154                 if (params.beacon_csa.tail[offset] != params.count)
9155                         return -EINVAL;
9156         }
9157
9158         if (csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
9159                 len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
9160                 if (!len || (len % sizeof(u16)))
9161                         return -EINVAL;
9162
9163                 params.n_counter_offsets_presp = len / sizeof(u16);
9164                 if (rdev->wiphy.max_num_csa_counters &&
9165                     (params.n_counter_offsets_presp >
9166                      rdev->wiphy.max_num_csa_counters))
9167                         return -EINVAL;
9168
9169                 params.counter_offsets_presp =
9170                         nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
9171
9172                 /* sanity checks - counters should fit and be the same */
9173                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
9174                         u16 offset = params.counter_offsets_presp[i];
9175
9176                         if (offset >= params.beacon_csa.probe_resp_len)
9177                                 return -EINVAL;
9178
9179                         if (params.beacon_csa.probe_resp[offset] !=
9180                             params.count)
9181                                 return -EINVAL;
9182                 }
9183         }
9184
9185 skip_beacons:
9186         err = nl80211_parse_chandef(rdev, info, &params.chandef);
9187         if (err)
9188                 return err;
9189
9190         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
9191                                            wdev->iftype))
9192                 return -EINVAL;
9193
9194         err = cfg80211_chandef_dfs_required(wdev->wiphy,
9195                                             &params.chandef,
9196                                             wdev->iftype);
9197         if (err < 0)
9198                 return err;
9199
9200         if (err > 0) {
9201                 params.radar_required = true;
9202                 if (need_handle_dfs_flag &&
9203                     !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
9204                         return -EINVAL;
9205                 }
9206         }
9207
9208         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
9209                 params.block_tx = true;
9210
9211         wdev_lock(wdev);
9212         err = rdev_channel_switch(rdev, dev, &params);
9213         wdev_unlock(wdev);
9214
9215         return err;
9216 }
9217
9218 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
9219                             u32 seq, int flags,
9220                             struct cfg80211_registered_device *rdev,
9221                             struct wireless_dev *wdev,
9222                             struct cfg80211_internal_bss *intbss)
9223 {
9224         struct cfg80211_bss *res = &intbss->pub;
9225         const struct cfg80211_bss_ies *ies;
9226         void *hdr;
9227         struct nlattr *bss;
9228
9229         ASSERT_WDEV_LOCK(wdev);
9230
9231         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
9232                              NL80211_CMD_NEW_SCAN_RESULTS);
9233         if (!hdr)
9234                 return -1;
9235
9236         genl_dump_check_consistent(cb, hdr);
9237
9238         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
9239                 goto nla_put_failure;
9240         if (wdev->netdev &&
9241             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
9242                 goto nla_put_failure;
9243         if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
9244                               NL80211_ATTR_PAD))
9245                 goto nla_put_failure;
9246
9247         bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS);
9248         if (!bss)
9249                 goto nla_put_failure;
9250         if ((!is_zero_ether_addr(res->bssid) &&
9251              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
9252                 goto nla_put_failure;
9253
9254         rcu_read_lock();
9255         /* indicate whether we have probe response data or not */
9256         if (rcu_access_pointer(res->proberesp_ies) &&
9257             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
9258                 goto fail_unlock_rcu;
9259
9260         /* this pointer prefers to be pointed to probe response data
9261          * but is always valid
9262          */
9263         ies = rcu_dereference(res->ies);
9264         if (ies) {
9265                 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
9266                                       NL80211_BSS_PAD))
9267                         goto fail_unlock_rcu;
9268                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
9269                                         ies->len, ies->data))
9270                         goto fail_unlock_rcu;
9271         }
9272
9273         /* and this pointer is always (unless driver didn't know) beacon data */
9274         ies = rcu_dereference(res->beacon_ies);
9275         if (ies && ies->from_beacon) {
9276                 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
9277                                       NL80211_BSS_PAD))
9278                         goto fail_unlock_rcu;
9279                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
9280                                         ies->len, ies->data))
9281                         goto fail_unlock_rcu;
9282         }
9283         rcu_read_unlock();
9284
9285         if (res->beacon_interval &&
9286             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
9287                 goto nla_put_failure;
9288         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
9289             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
9290             nla_put_u32(msg, NL80211_BSS_FREQUENCY_OFFSET,
9291                         res->channel->freq_offset) ||
9292             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
9293             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
9294                         jiffies_to_msecs(jiffies - intbss->ts)))
9295                 goto nla_put_failure;
9296
9297         if (intbss->parent_tsf &&
9298             (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
9299                                intbss->parent_tsf, NL80211_BSS_PAD) ||
9300              nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
9301                      intbss->parent_bssid)))
9302                 goto nla_put_failure;
9303
9304         if (intbss->ts_boottime &&
9305             nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
9306                               intbss->ts_boottime, NL80211_BSS_PAD))
9307                 goto nla_put_failure;
9308
9309         if (!nl80211_put_signal(msg, intbss->pub.chains,
9310                                 intbss->pub.chain_signal,
9311                                 NL80211_BSS_CHAIN_SIGNAL))
9312                 goto nla_put_failure;
9313
9314         switch (rdev->wiphy.signal_type) {
9315         case CFG80211_SIGNAL_TYPE_MBM:
9316                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
9317                         goto nla_put_failure;
9318                 break;
9319         case CFG80211_SIGNAL_TYPE_UNSPEC:
9320                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
9321                         goto nla_put_failure;
9322                 break;
9323         default:
9324                 break;
9325         }
9326
9327         switch (wdev->iftype) {
9328         case NL80211_IFTYPE_P2P_CLIENT:
9329         case NL80211_IFTYPE_STATION:
9330                 if (intbss == wdev->current_bss &&
9331                     nla_put_u32(msg, NL80211_BSS_STATUS,
9332                                 NL80211_BSS_STATUS_ASSOCIATED))
9333                         goto nla_put_failure;
9334                 break;
9335         case NL80211_IFTYPE_ADHOC:
9336                 if (intbss == wdev->current_bss &&
9337                     nla_put_u32(msg, NL80211_BSS_STATUS,
9338                                 NL80211_BSS_STATUS_IBSS_JOINED))
9339                         goto nla_put_failure;
9340                 break;
9341         default:
9342                 break;
9343         }
9344
9345         nla_nest_end(msg, bss);
9346
9347         genlmsg_end(msg, hdr);
9348         return 0;
9349
9350  fail_unlock_rcu:
9351         rcu_read_unlock();
9352  nla_put_failure:
9353         genlmsg_cancel(msg, hdr);
9354         return -EMSGSIZE;
9355 }
9356
9357 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
9358 {
9359         struct cfg80211_registered_device *rdev;
9360         struct cfg80211_internal_bss *scan;
9361         struct wireless_dev *wdev;
9362         int start = cb->args[2], idx = 0;
9363         int err;
9364
9365         rtnl_lock();
9366         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
9367         if (err) {
9368                 rtnl_unlock();
9369                 return err;
9370         }
9371
9372         wdev_lock(wdev);
9373         spin_lock_bh(&rdev->bss_lock);
9374
9375         /*
9376          * dump_scan will be called multiple times to break up the scan results
9377          * into multiple messages.  It is unlikely that any more bss-es will be
9378          * expired after the first call, so only call only call this on the
9379          * first dump_scan invocation.
9380          */
9381         if (start == 0)
9382                 cfg80211_bss_expire(rdev);
9383
9384         cb->seq = rdev->bss_generation;
9385
9386         list_for_each_entry(scan, &rdev->bss_list, list) {
9387                 if (++idx <= start)
9388                         continue;
9389                 if (nl80211_send_bss(skb, cb,
9390                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
9391                                 rdev, wdev, scan) < 0) {
9392                         idx--;
9393                         break;
9394                 }
9395         }
9396
9397         spin_unlock_bh(&rdev->bss_lock);
9398         wdev_unlock(wdev);
9399
9400         cb->args[2] = idx;
9401         rtnl_unlock();
9402
9403         return skb->len;
9404 }
9405
9406 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
9407                                int flags, struct net_device *dev,
9408                                bool allow_radio_stats,
9409                                struct survey_info *survey)
9410 {
9411         void *hdr;
9412         struct nlattr *infoattr;
9413
9414         /* skip radio stats if userspace didn't request them */
9415         if (!survey->channel && !allow_radio_stats)
9416                 return 0;
9417
9418         hdr = nl80211hdr_put(msg, portid, seq, flags,
9419                              NL80211_CMD_NEW_SURVEY_RESULTS);
9420         if (!hdr)
9421                 return -ENOMEM;
9422
9423         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
9424                 goto nla_put_failure;
9425
9426         infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO);
9427         if (!infoattr)
9428                 goto nla_put_failure;
9429
9430         if (survey->channel &&
9431             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
9432                         survey->channel->center_freq))
9433                 goto nla_put_failure;
9434
9435         if (survey->channel && survey->channel->freq_offset &&
9436             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY_OFFSET,
9437                         survey->channel->freq_offset))
9438                 goto nla_put_failure;
9439
9440         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
9441             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
9442                 goto nla_put_failure;
9443         if ((survey->filled & SURVEY_INFO_IN_USE) &&
9444             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
9445                 goto nla_put_failure;
9446         if ((survey->filled & SURVEY_INFO_TIME) &&
9447             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
9448                         survey->time, NL80211_SURVEY_INFO_PAD))
9449                 goto nla_put_failure;
9450         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
9451             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
9452                               survey->time_busy, NL80211_SURVEY_INFO_PAD))
9453                 goto nla_put_failure;
9454         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
9455             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
9456                               survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
9457                 goto nla_put_failure;
9458         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
9459             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
9460                               survey->time_rx, NL80211_SURVEY_INFO_PAD))
9461                 goto nla_put_failure;
9462         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
9463             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
9464                               survey->time_tx, NL80211_SURVEY_INFO_PAD))
9465                 goto nla_put_failure;
9466         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
9467             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
9468                               survey->time_scan, NL80211_SURVEY_INFO_PAD))
9469                 goto nla_put_failure;
9470         if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) &&
9471             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX,
9472                               survey->time_bss_rx, NL80211_SURVEY_INFO_PAD))
9473                 goto nla_put_failure;
9474
9475         nla_nest_end(msg, infoattr);
9476
9477         genlmsg_end(msg, hdr);
9478         return 0;
9479
9480  nla_put_failure:
9481         genlmsg_cancel(msg, hdr);
9482         return -EMSGSIZE;
9483 }
9484
9485 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
9486 {
9487         struct nlattr **attrbuf;
9488         struct survey_info survey;
9489         struct cfg80211_registered_device *rdev;
9490         struct wireless_dev *wdev;
9491         int survey_idx = cb->args[2];
9492         int res;
9493         bool radio_stats;
9494
9495         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
9496         if (!attrbuf)
9497                 return -ENOMEM;
9498
9499         rtnl_lock();
9500         res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
9501         if (res)
9502                 goto out_err;
9503
9504         /* prepare_wdev_dump parsed the attributes */
9505         radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
9506
9507         if (!wdev->netdev) {
9508                 res = -EINVAL;
9509                 goto out_err;
9510         }
9511
9512         if (!rdev->ops->dump_survey) {
9513                 res = -EOPNOTSUPP;
9514                 goto out_err;
9515         }
9516
9517         while (1) {
9518                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
9519                 if (res == -ENOENT)
9520                         break;
9521                 if (res)
9522                         goto out_err;
9523
9524                 /* don't send disabled channels, but do send non-channel data */
9525                 if (survey.channel &&
9526                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
9527                         survey_idx++;
9528                         continue;
9529                 }
9530
9531                 if (nl80211_send_survey(skb,
9532                                 NETLINK_CB(cb->skb).portid,
9533                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
9534                                 wdev->netdev, radio_stats, &survey) < 0)
9535                         goto out;
9536                 survey_idx++;
9537         }
9538
9539  out:
9540         cb->args[2] = survey_idx;
9541         res = skb->len;
9542  out_err:
9543         kfree(attrbuf);
9544         rtnl_unlock();
9545         return res;
9546 }
9547
9548 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
9549 {
9550         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
9551                                   NL80211_WPA_VERSION_2 |
9552                                   NL80211_WPA_VERSION_3));
9553 }
9554
9555 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
9556 {
9557         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9558         struct net_device *dev = info->user_ptr[1];
9559         struct ieee80211_channel *chan;
9560         const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL;
9561         int err, ssid_len, ie_len = 0, auth_data_len = 0;
9562         enum nl80211_auth_type auth_type;
9563         struct key_parse key;
9564         bool local_state_change;
9565         u32 freq;
9566
9567         if (!info->attrs[NL80211_ATTR_MAC])
9568                 return -EINVAL;
9569
9570         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
9571                 return -EINVAL;
9572
9573         if (!info->attrs[NL80211_ATTR_SSID])
9574                 return -EINVAL;
9575
9576         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
9577                 return -EINVAL;
9578
9579         err = nl80211_parse_key(info, &key);
9580         if (err)
9581                 return err;
9582
9583         if (key.idx >= 0) {
9584                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
9585                         return -EINVAL;
9586                 if (!key.p.key || !key.p.key_len)
9587                         return -EINVAL;
9588                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
9589                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
9590                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
9591                      key.p.key_len != WLAN_KEY_LEN_WEP104))
9592                         return -EINVAL;
9593                 if (key.idx > 3)
9594                         return -EINVAL;
9595         } else {
9596                 key.p.key_len = 0;
9597                 key.p.key = NULL;
9598         }
9599
9600         if (key.idx >= 0) {
9601                 int i;
9602                 bool ok = false;
9603
9604                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
9605                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
9606                                 ok = true;
9607                                 break;
9608                         }
9609                 }
9610                 if (!ok)
9611                         return -EINVAL;
9612         }
9613
9614         if (!rdev->ops->auth)
9615                 return -EOPNOTSUPP;
9616
9617         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9618             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9619                 return -EOPNOTSUPP;
9620
9621         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9622         freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
9623         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
9624                 freq +=
9625                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
9626
9627         chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
9628         if (!chan)
9629                 return -EINVAL;
9630
9631         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9632         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9633
9634         if (info->attrs[NL80211_ATTR_IE]) {
9635                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9636                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9637         }
9638
9639         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9640         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
9641                 return -EINVAL;
9642
9643         if ((auth_type == NL80211_AUTHTYPE_SAE ||
9644              auth_type == NL80211_AUTHTYPE_FILS_SK ||
9645              auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
9646              auth_type == NL80211_AUTHTYPE_FILS_PK) &&
9647             !info->attrs[NL80211_ATTR_AUTH_DATA])
9648                 return -EINVAL;
9649
9650         if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
9651                 if (auth_type != NL80211_AUTHTYPE_SAE &&
9652                     auth_type != NL80211_AUTHTYPE_FILS_SK &&
9653                     auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
9654                     auth_type != NL80211_AUTHTYPE_FILS_PK)
9655                         return -EINVAL;
9656                 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
9657                 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
9658         }
9659
9660         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
9661
9662         /*
9663          * Since we no longer track auth state, ignore
9664          * requests to only change local state.
9665          */
9666         if (local_state_change)
9667                 return 0;
9668
9669         wdev_lock(dev->ieee80211_ptr);
9670         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
9671                                  ssid, ssid_len, ie, ie_len,
9672                                  key.p.key, key.p.key_len, key.idx,
9673                                  auth_data, auth_data_len);
9674         wdev_unlock(dev->ieee80211_ptr);
9675         return err;
9676 }
9677
9678 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
9679                                      struct genl_info *info)
9680 {
9681         if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9682                 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
9683                 return -EINVAL;
9684         }
9685
9686         if (!rdev->ops->tx_control_port ||
9687             !wiphy_ext_feature_isset(&rdev->wiphy,
9688                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
9689                 return -EOPNOTSUPP;
9690
9691         return 0;
9692 }
9693
9694 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
9695                                    struct genl_info *info,
9696                                    struct cfg80211_crypto_settings *settings,
9697                                    int cipher_limit)
9698 {
9699         memset(settings, 0, sizeof(*settings));
9700
9701         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
9702
9703         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
9704                 u16 proto;
9705
9706                 proto = nla_get_u16(
9707                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
9708                 settings->control_port_ethertype = cpu_to_be16(proto);
9709                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
9710                     proto != ETH_P_PAE)
9711                         return -EINVAL;
9712                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
9713                         settings->control_port_no_encrypt = true;
9714         } else
9715                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
9716
9717         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
9718                 int r = validate_pae_over_nl80211(rdev, info);
9719
9720                 if (r < 0)
9721                         return r;
9722
9723                 settings->control_port_over_nl80211 = true;
9724
9725                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH])
9726                         settings->control_port_no_preauth = true;
9727         }
9728
9729         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
9730                 void *data;
9731                 int len, i;
9732
9733                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
9734                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
9735                 settings->n_ciphers_pairwise = len / sizeof(u32);
9736
9737                 if (len % sizeof(u32))
9738                         return -EINVAL;
9739
9740                 if (settings->n_ciphers_pairwise > cipher_limit)
9741                         return -EINVAL;
9742
9743                 memcpy(settings->ciphers_pairwise, data, len);
9744
9745                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
9746                         if (!cfg80211_supported_cipher_suite(
9747                                         &rdev->wiphy,
9748                                         settings->ciphers_pairwise[i]))
9749                                 return -EINVAL;
9750         }
9751
9752         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
9753                 settings->cipher_group =
9754                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
9755                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
9756                                                      settings->cipher_group))
9757                         return -EINVAL;
9758         }
9759
9760         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
9761                 settings->wpa_versions =
9762                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
9763                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
9764                         return -EINVAL;
9765         }
9766
9767         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
9768                 void *data;
9769                 int len;
9770
9771                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
9772                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
9773                 settings->n_akm_suites = len / sizeof(u32);
9774
9775                 if (len % sizeof(u32))
9776                         return -EINVAL;
9777
9778                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
9779                         return -EINVAL;
9780
9781                 memcpy(settings->akm_suites, data, len);
9782         }
9783
9784         if (info->attrs[NL80211_ATTR_PMK]) {
9785                 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
9786                         return -EINVAL;
9787                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
9788                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK) &&
9789                     !wiphy_ext_feature_isset(&rdev->wiphy,
9790                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK))
9791                         return -EINVAL;
9792                 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
9793         }
9794
9795         if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) {
9796                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
9797                                              NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
9798                     !wiphy_ext_feature_isset(&rdev->wiphy,
9799                                              NL80211_EXT_FEATURE_SAE_OFFLOAD_AP))
9800                         return -EINVAL;
9801                 settings->sae_pwd =
9802                         nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
9803                 settings->sae_pwd_len =
9804                         nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
9805         }
9806
9807         if (info->attrs[NL80211_ATTR_SAE_PWE])
9808                 settings->sae_pwe =
9809                         nla_get_u8(info->attrs[NL80211_ATTR_SAE_PWE]);
9810         else
9811                 settings->sae_pwe = NL80211_SAE_PWE_UNSPECIFIED;
9812
9813         return 0;
9814 }
9815
9816 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
9817 {
9818         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9819         struct net_device *dev = info->user_ptr[1];
9820         struct ieee80211_channel *chan;
9821         struct cfg80211_assoc_request req = {};
9822         const u8 *bssid, *ssid;
9823         int err, ssid_len = 0;
9824         u32 freq;
9825
9826         if (dev->ieee80211_ptr->conn_owner_nlportid &&
9827             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9828                 return -EPERM;
9829
9830         if (!info->attrs[NL80211_ATTR_MAC] ||
9831             !info->attrs[NL80211_ATTR_SSID] ||
9832             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
9833                 return -EINVAL;
9834
9835         if (!rdev->ops->assoc)
9836                 return -EOPNOTSUPP;
9837
9838         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9839             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9840                 return -EOPNOTSUPP;
9841
9842         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9843
9844         freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
9845         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
9846                 freq +=
9847                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
9848         chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
9849         if (!chan)
9850                 return -EINVAL;
9851
9852         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9853         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9854
9855         if (info->attrs[NL80211_ATTR_IE]) {
9856                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9857                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9858         }
9859
9860         if (info->attrs[NL80211_ATTR_USE_MFP]) {
9861                 enum nl80211_mfp mfp =
9862                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
9863                 if (mfp == NL80211_MFP_REQUIRED)
9864                         req.use_mfp = true;
9865                 else if (mfp != NL80211_MFP_NO)
9866                         return -EINVAL;
9867         }
9868
9869         if (info->attrs[NL80211_ATTR_PREV_BSSID])
9870                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
9871
9872         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
9873                 req.flags |= ASSOC_REQ_DISABLE_HT;
9874
9875         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9876                 memcpy(&req.ht_capa_mask,
9877                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
9878                        sizeof(req.ht_capa_mask));
9879
9880         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9881                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9882                         return -EINVAL;
9883                 memcpy(&req.ht_capa,
9884                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9885                        sizeof(req.ht_capa));
9886         }
9887
9888         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
9889                 req.flags |= ASSOC_REQ_DISABLE_VHT;
9890
9891         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
9892                 memcpy(&req.vht_capa_mask,
9893                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
9894                        sizeof(req.vht_capa_mask));
9895
9896         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
9897                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
9898                         return -EINVAL;
9899                 memcpy(&req.vht_capa,
9900                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
9901                        sizeof(req.vht_capa));
9902         }
9903
9904         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
9905                 if (!((rdev->wiphy.features &
9906                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
9907                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
9908                     !wiphy_ext_feature_isset(&rdev->wiphy,
9909                                              NL80211_EXT_FEATURE_RRM))
9910                         return -EINVAL;
9911                 req.flags |= ASSOC_REQ_USE_RRM;
9912         }
9913
9914         if (info->attrs[NL80211_ATTR_FILS_KEK]) {
9915                 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
9916                 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
9917                 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
9918                         return -EINVAL;
9919                 req.fils_nonces =
9920                         nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
9921         }
9922
9923         if (info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) {
9924                 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY])
9925                         return -EINVAL;
9926                 memcpy(&req.s1g_capa_mask,
9927                        nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]),
9928                        sizeof(req.s1g_capa_mask));
9929         }
9930
9931         if (info->attrs[NL80211_ATTR_S1G_CAPABILITY]) {
9932                 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK])
9933                         return -EINVAL;
9934                 memcpy(&req.s1g_capa,
9935                        nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]),
9936                        sizeof(req.s1g_capa));
9937         }
9938
9939         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
9940         if (!err) {
9941                 wdev_lock(dev->ieee80211_ptr);
9942
9943                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
9944                                           ssid, ssid_len, &req);
9945
9946                 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9947                         dev->ieee80211_ptr->conn_owner_nlportid =
9948                                 info->snd_portid;
9949                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
9950                                bssid, ETH_ALEN);
9951                 }
9952
9953                 wdev_unlock(dev->ieee80211_ptr);
9954         }
9955
9956         return err;
9957 }
9958
9959 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
9960 {
9961         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9962         struct net_device *dev = info->user_ptr[1];
9963         const u8 *ie = NULL, *bssid;
9964         int ie_len = 0, err;
9965         u16 reason_code;
9966         bool local_state_change;
9967
9968         if (dev->ieee80211_ptr->conn_owner_nlportid &&
9969             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9970                 return -EPERM;
9971
9972         if (!info->attrs[NL80211_ATTR_MAC])
9973                 return -EINVAL;
9974
9975         if (!info->attrs[NL80211_ATTR_REASON_CODE])
9976                 return -EINVAL;
9977
9978         if (!rdev->ops->deauth)
9979                 return -EOPNOTSUPP;
9980
9981         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9982             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9983                 return -EOPNOTSUPP;
9984
9985         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9986
9987         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9988         if (reason_code == 0) {
9989                 /* Reason Code 0 is reserved */
9990                 return -EINVAL;
9991         }
9992
9993         if (info->attrs[NL80211_ATTR_IE]) {
9994                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9995                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9996         }
9997
9998         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
9999
10000         wdev_lock(dev->ieee80211_ptr);
10001         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
10002                                    local_state_change);
10003         wdev_unlock(dev->ieee80211_ptr);
10004         return err;
10005 }
10006
10007 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
10008 {
10009         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10010         struct net_device *dev = info->user_ptr[1];
10011         const u8 *ie = NULL, *bssid;
10012         int ie_len = 0, err;
10013         u16 reason_code;
10014         bool local_state_change;
10015
10016         if (dev->ieee80211_ptr->conn_owner_nlportid &&
10017             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
10018                 return -EPERM;
10019
10020         if (!info->attrs[NL80211_ATTR_MAC])
10021                 return -EINVAL;
10022
10023         if (!info->attrs[NL80211_ATTR_REASON_CODE])
10024                 return -EINVAL;
10025
10026         if (!rdev->ops->disassoc)
10027                 return -EOPNOTSUPP;
10028
10029         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10030             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10031                 return -EOPNOTSUPP;
10032
10033         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10034
10035         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
10036         if (reason_code == 0) {
10037                 /* Reason Code 0 is reserved */
10038                 return -EINVAL;
10039         }
10040
10041         if (info->attrs[NL80211_ATTR_IE]) {
10042                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10043                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10044         }
10045
10046         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
10047
10048         wdev_lock(dev->ieee80211_ptr);
10049         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
10050                                      local_state_change);
10051         wdev_unlock(dev->ieee80211_ptr);
10052         return err;
10053 }
10054
10055 static bool
10056 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
10057                          int mcast_rate[NUM_NL80211_BANDS],
10058                          int rateval)
10059 {
10060         struct wiphy *wiphy = &rdev->wiphy;
10061         bool found = false;
10062         int band, i;
10063
10064         for (band = 0; band < NUM_NL80211_BANDS; band++) {
10065                 struct ieee80211_supported_band *sband;
10066
10067                 sband = wiphy->bands[band];
10068                 if (!sband)
10069                         continue;
10070
10071                 for (i = 0; i < sband->n_bitrates; i++) {
10072                         if (sband->bitrates[i].bitrate == rateval) {
10073                                 mcast_rate[band] = i + 1;
10074                                 found = true;
10075                                 break;
10076                         }
10077                 }
10078         }
10079
10080         return found;
10081 }
10082
10083 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
10084 {
10085         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10086         struct net_device *dev = info->user_ptr[1];
10087         struct cfg80211_ibss_params ibss;
10088         struct wiphy *wiphy;
10089         struct cfg80211_cached_keys *connkeys = NULL;
10090         int err;
10091
10092         memset(&ibss, 0, sizeof(ibss));
10093
10094         if (!info->attrs[NL80211_ATTR_SSID] ||
10095             !nla_len(info->attrs[NL80211_ATTR_SSID]))
10096                 return -EINVAL;
10097
10098         ibss.beacon_interval = 100;
10099
10100         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
10101                 ibss.beacon_interval =
10102                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
10103
10104         err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
10105                                            ibss.beacon_interval);
10106         if (err)
10107                 return err;
10108
10109         if (!rdev->ops->join_ibss)
10110                 return -EOPNOTSUPP;
10111
10112         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
10113                 return -EOPNOTSUPP;
10114
10115         wiphy = &rdev->wiphy;
10116
10117         if (info->attrs[NL80211_ATTR_MAC]) {
10118                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10119
10120                 if (!is_valid_ether_addr(ibss.bssid))
10121                         return -EINVAL;
10122         }
10123         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10124         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10125
10126         if (info->attrs[NL80211_ATTR_IE]) {
10127                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10128                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10129         }
10130
10131         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
10132         if (err)
10133                 return err;
10134
10135         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
10136                                      NL80211_IFTYPE_ADHOC))
10137                 return -EINVAL;
10138
10139         switch (ibss.chandef.width) {
10140         case NL80211_CHAN_WIDTH_5:
10141         case NL80211_CHAN_WIDTH_10:
10142         case NL80211_CHAN_WIDTH_20_NOHT:
10143                 break;
10144         case NL80211_CHAN_WIDTH_20:
10145         case NL80211_CHAN_WIDTH_40:
10146                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
10147                         return -EINVAL;
10148                 break;
10149         case NL80211_CHAN_WIDTH_80:
10150         case NL80211_CHAN_WIDTH_80P80:
10151         case NL80211_CHAN_WIDTH_160:
10152                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
10153                         return -EINVAL;
10154                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
10155                                              NL80211_EXT_FEATURE_VHT_IBSS))
10156                         return -EINVAL;
10157                 break;
10158         default:
10159                 return -EINVAL;
10160         }
10161
10162         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
10163         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
10164
10165         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
10166                 u8 *rates =
10167                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10168                 int n_rates =
10169                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10170                 struct ieee80211_supported_band *sband =
10171                         wiphy->bands[ibss.chandef.chan->band];
10172
10173                 err = ieee80211_get_ratemask(sband, rates, n_rates,
10174                                              &ibss.basic_rates);
10175                 if (err)
10176                         return err;
10177         }
10178
10179         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10180                 memcpy(&ibss.ht_capa_mask,
10181                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
10182                        sizeof(ibss.ht_capa_mask));
10183
10184         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
10185                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10186                         return -EINVAL;
10187                 memcpy(&ibss.ht_capa,
10188                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
10189                        sizeof(ibss.ht_capa));
10190         }
10191
10192         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
10193             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
10194                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
10195                 return -EINVAL;
10196
10197         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
10198                 bool no_ht = false;
10199
10200                 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
10201                 if (IS_ERR(connkeys))
10202                         return PTR_ERR(connkeys);
10203
10204                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
10205                     no_ht) {
10206                         kfree_sensitive(connkeys);
10207                         return -EINVAL;
10208                 }
10209         }
10210
10211         ibss.control_port =
10212                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
10213
10214         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
10215                 int r = validate_pae_over_nl80211(rdev, info);
10216
10217                 if (r < 0) {
10218                         kfree_sensitive(connkeys);
10219                         return r;
10220                 }
10221
10222                 ibss.control_port_over_nl80211 = true;
10223         }
10224
10225         ibss.userspace_handles_dfs =
10226                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
10227
10228         wdev_lock(dev->ieee80211_ptr);
10229         err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
10230         if (err)
10231                 kfree_sensitive(connkeys);
10232         else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
10233                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
10234         wdev_unlock(dev->ieee80211_ptr);
10235
10236         return err;
10237 }
10238
10239 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
10240 {
10241         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10242         struct net_device *dev = info->user_ptr[1];
10243
10244         if (!rdev->ops->leave_ibss)
10245                 return -EOPNOTSUPP;
10246
10247         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
10248                 return -EOPNOTSUPP;
10249
10250         return cfg80211_leave_ibss(rdev, dev, false);
10251 }
10252
10253 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
10254 {
10255         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10256         struct net_device *dev = info->user_ptr[1];
10257         int mcast_rate[NUM_NL80211_BANDS];
10258         u32 nla_rate;
10259         int err;
10260
10261         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
10262             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
10263             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
10264                 return -EOPNOTSUPP;
10265
10266         if (!rdev->ops->set_mcast_rate)
10267                 return -EOPNOTSUPP;
10268
10269         memset(mcast_rate, 0, sizeof(mcast_rate));
10270
10271         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
10272                 return -EINVAL;
10273
10274         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
10275         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
10276                 return -EINVAL;
10277
10278         err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
10279
10280         return err;
10281 }
10282
10283 static struct sk_buff *
10284 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
10285                             struct wireless_dev *wdev, int approxlen,
10286                             u32 portid, u32 seq, enum nl80211_commands cmd,
10287                             enum nl80211_attrs attr,
10288                             const struct nl80211_vendor_cmd_info *info,
10289                             gfp_t gfp)
10290 {
10291         struct sk_buff *skb;
10292         void *hdr;
10293         struct nlattr *data;
10294
10295         skb = nlmsg_new(approxlen + 100, gfp);
10296         if (!skb)
10297                 return NULL;
10298
10299         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
10300         if (!hdr) {
10301                 kfree_skb(skb);
10302                 return NULL;
10303         }
10304
10305         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
10306                 goto nla_put_failure;
10307
10308         if (info) {
10309                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
10310                                 info->vendor_id))
10311                         goto nla_put_failure;
10312                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
10313                                 info->subcmd))
10314                         goto nla_put_failure;
10315         }
10316
10317         if (wdev) {
10318                 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
10319                                       wdev_id(wdev), NL80211_ATTR_PAD))
10320                         goto nla_put_failure;
10321                 if (wdev->netdev &&
10322                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
10323                                 wdev->netdev->ifindex))
10324                         goto nla_put_failure;
10325         }
10326
10327         data = nla_nest_start_noflag(skb, attr);
10328         if (!data)
10329                 goto nla_put_failure;
10330
10331         ((void **)skb->cb)[0] = rdev;
10332         ((void **)skb->cb)[1] = hdr;
10333         ((void **)skb->cb)[2] = data;
10334
10335         return skb;
10336
10337  nla_put_failure:
10338         kfree_skb(skb);
10339         return NULL;
10340 }
10341
10342 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
10343                                            struct wireless_dev *wdev,
10344                                            enum nl80211_commands cmd,
10345                                            enum nl80211_attrs attr,
10346                                            unsigned int portid,
10347                                            int vendor_event_idx,
10348                                            int approxlen, gfp_t gfp)
10349 {
10350         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10351         const struct nl80211_vendor_cmd_info *info;
10352
10353         switch (cmd) {
10354         case NL80211_CMD_TESTMODE:
10355                 if (WARN_ON(vendor_event_idx != -1))
10356                         return NULL;
10357                 info = NULL;
10358                 break;
10359         case NL80211_CMD_VENDOR:
10360                 if (WARN_ON(vendor_event_idx < 0 ||
10361                             vendor_event_idx >= wiphy->n_vendor_events))
10362                         return NULL;
10363                 info = &wiphy->vendor_events[vendor_event_idx];
10364                 break;
10365         default:
10366                 WARN_ON(1);
10367                 return NULL;
10368         }
10369
10370         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0,
10371                                            cmd, attr, info, gfp);
10372 }
10373 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
10374
10375 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
10376 {
10377         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
10378         void *hdr = ((void **)skb->cb)[1];
10379         struct nlmsghdr *nlhdr = nlmsg_hdr(skb);
10380         struct nlattr *data = ((void **)skb->cb)[2];
10381         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
10382
10383         /* clear CB data for netlink core to own from now on */
10384         memset(skb->cb, 0, sizeof(skb->cb));
10385
10386         nla_nest_end(skb, data);
10387         genlmsg_end(skb, hdr);
10388
10389         if (nlhdr->nlmsg_pid) {
10390                 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb,
10391                                 nlhdr->nlmsg_pid);
10392         } else {
10393                 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
10394                         mcgrp = NL80211_MCGRP_VENDOR;
10395
10396                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
10397                                         skb, 0, mcgrp, gfp);
10398         }
10399 }
10400 EXPORT_SYMBOL(__cfg80211_send_event_skb);
10401
10402 #ifdef CONFIG_NL80211_TESTMODE
10403 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
10404 {
10405         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10406         struct wireless_dev *wdev =
10407                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
10408         int err;
10409
10410         if (!rdev->ops->testmode_cmd)
10411                 return -EOPNOTSUPP;
10412
10413         if (IS_ERR(wdev)) {
10414                 err = PTR_ERR(wdev);
10415                 if (err != -EINVAL)
10416                         return err;
10417                 wdev = NULL;
10418         } else if (wdev->wiphy != &rdev->wiphy) {
10419                 return -EINVAL;
10420         }
10421
10422         if (!info->attrs[NL80211_ATTR_TESTDATA])
10423                 return -EINVAL;
10424
10425         rdev->cur_cmd_info = info;
10426         err = rdev_testmode_cmd(rdev, wdev,
10427                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
10428                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
10429         rdev->cur_cmd_info = NULL;
10430
10431         return err;
10432 }
10433
10434 static int nl80211_testmode_dump(struct sk_buff *skb,
10435                                  struct netlink_callback *cb)
10436 {
10437         struct cfg80211_registered_device *rdev;
10438         struct nlattr **attrbuf = NULL;
10439         int err;
10440         long phy_idx;
10441         void *data = NULL;
10442         int data_len = 0;
10443
10444         rtnl_lock();
10445
10446         if (cb->args[0]) {
10447                 /*
10448                  * 0 is a valid index, but not valid for args[0],
10449                  * so we need to offset by 1.
10450                  */
10451                 phy_idx = cb->args[0] - 1;
10452
10453                 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
10454                 if (!rdev) {
10455                         err = -ENOENT;
10456                         goto out_err;
10457                 }
10458         } else {
10459                 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
10460                                   GFP_KERNEL);
10461                 if (!attrbuf) {
10462                         err = -ENOMEM;
10463                         goto out_err;
10464                 }
10465
10466                 err = nlmsg_parse_deprecated(cb->nlh,
10467                                              GENL_HDRLEN + nl80211_fam.hdrsize,
10468                                              attrbuf, nl80211_fam.maxattr,
10469                                              nl80211_policy, NULL);
10470                 if (err)
10471                         goto out_err;
10472
10473                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
10474                 if (IS_ERR(rdev)) {
10475                         err = PTR_ERR(rdev);
10476                         goto out_err;
10477                 }
10478                 phy_idx = rdev->wiphy_idx;
10479
10480                 if (attrbuf[NL80211_ATTR_TESTDATA])
10481                         cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
10482         }
10483
10484         if (cb->args[1]) {
10485                 data = nla_data((void *)cb->args[1]);
10486                 data_len = nla_len((void *)cb->args[1]);
10487         }
10488
10489         if (!rdev->ops->testmode_dump) {
10490                 err = -EOPNOTSUPP;
10491                 goto out_err;
10492         }
10493
10494         while (1) {
10495                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
10496                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
10497                                            NL80211_CMD_TESTMODE);
10498                 struct nlattr *tmdata;
10499
10500                 if (!hdr)
10501                         break;
10502
10503                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
10504                         genlmsg_cancel(skb, hdr);
10505                         break;
10506                 }
10507
10508                 tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA);
10509                 if (!tmdata) {
10510                         genlmsg_cancel(skb, hdr);
10511                         break;
10512                 }
10513                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
10514                 nla_nest_end(skb, tmdata);
10515
10516                 if (err == -ENOBUFS || err == -ENOENT) {
10517                         genlmsg_cancel(skb, hdr);
10518                         break;
10519                 } else if (err) {
10520                         genlmsg_cancel(skb, hdr);
10521                         goto out_err;
10522                 }
10523
10524                 genlmsg_end(skb, hdr);
10525         }
10526
10527         err = skb->len;
10528         /* see above */
10529         cb->args[0] = phy_idx + 1;
10530  out_err:
10531         kfree(attrbuf);
10532         rtnl_unlock();
10533         return err;
10534 }
10535 #endif
10536
10537 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
10538 {
10539         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10540         struct net_device *dev = info->user_ptr[1];
10541         struct cfg80211_connect_params connect;
10542         struct wiphy *wiphy;
10543         struct cfg80211_cached_keys *connkeys = NULL;
10544         u32 freq = 0;
10545         int err;
10546
10547         memset(&connect, 0, sizeof(connect));
10548
10549         if (!info->attrs[NL80211_ATTR_SSID] ||
10550             !nla_len(info->attrs[NL80211_ATTR_SSID]))
10551                 return -EINVAL;
10552
10553         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
10554                 connect.auth_type =
10555                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
10556                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
10557                                              NL80211_CMD_CONNECT))
10558                         return -EINVAL;
10559         } else
10560                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
10561
10562         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
10563
10564         if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
10565             !wiphy_ext_feature_isset(&rdev->wiphy,
10566                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
10567                 return -EINVAL;
10568         connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
10569
10570         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
10571                                       NL80211_MAX_NR_CIPHER_SUITES);
10572         if (err)
10573                 return err;
10574
10575         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10576             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10577                 return -EOPNOTSUPP;
10578
10579         wiphy = &rdev->wiphy;
10580
10581         connect.bg_scan_period = -1;
10582         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
10583                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
10584                 connect.bg_scan_period =
10585                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
10586         }
10587
10588         if (info->attrs[NL80211_ATTR_MAC])
10589                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10590         else if (info->attrs[NL80211_ATTR_MAC_HINT])
10591                 connect.bssid_hint =
10592                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
10593         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10594         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10595
10596         if (info->attrs[NL80211_ATTR_IE]) {
10597                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10598                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10599         }
10600
10601         if (info->attrs[NL80211_ATTR_USE_MFP]) {
10602                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
10603                 if (connect.mfp == NL80211_MFP_OPTIONAL &&
10604                     !wiphy_ext_feature_isset(&rdev->wiphy,
10605                                              NL80211_EXT_FEATURE_MFP_OPTIONAL))
10606                         return -EOPNOTSUPP;
10607         } else {
10608                 connect.mfp = NL80211_MFP_NO;
10609         }
10610
10611         if (info->attrs[NL80211_ATTR_PREV_BSSID])
10612                 connect.prev_bssid =
10613                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
10614
10615         if (info->attrs[NL80211_ATTR_WIPHY_FREQ])
10616                 freq = MHZ_TO_KHZ(nla_get_u32(
10617                                         info->attrs[NL80211_ATTR_WIPHY_FREQ]));
10618         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
10619                 freq +=
10620                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
10621
10622         if (freq) {
10623                 connect.channel = nl80211_get_valid_chan(wiphy, freq);
10624                 if (!connect.channel)
10625                         return -EINVAL;
10626         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
10627                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
10628                 freq = MHZ_TO_KHZ(freq);
10629                 connect.channel_hint = nl80211_get_valid_chan(wiphy, freq);
10630                 if (!connect.channel_hint)
10631                         return -EINVAL;
10632         }
10633
10634         if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
10635                 connect.edmg.channels =
10636                       nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
10637
10638                 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
10639                         connect.edmg.bw_config =
10640                                 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
10641         }
10642
10643         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
10644                 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
10645                 if (IS_ERR(connkeys))
10646                         return PTR_ERR(connkeys);
10647         }
10648
10649         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
10650                 connect.flags |= ASSOC_REQ_DISABLE_HT;
10651
10652         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10653                 memcpy(&connect.ht_capa_mask,
10654                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
10655                        sizeof(connect.ht_capa_mask));
10656
10657         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
10658                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
10659                         kfree_sensitive(connkeys);
10660                         return -EINVAL;
10661                 }
10662                 memcpy(&connect.ht_capa,
10663                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
10664                        sizeof(connect.ht_capa));
10665         }
10666
10667         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
10668                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
10669
10670         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
10671                 memcpy(&connect.vht_capa_mask,
10672                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
10673                        sizeof(connect.vht_capa_mask));
10674
10675         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
10676                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
10677                         kfree_sensitive(connkeys);
10678                         return -EINVAL;
10679                 }
10680                 memcpy(&connect.vht_capa,
10681                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
10682                        sizeof(connect.vht_capa));
10683         }
10684
10685         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
10686                 if (!((rdev->wiphy.features &
10687                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
10688                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
10689                     !wiphy_ext_feature_isset(&rdev->wiphy,
10690                                              NL80211_EXT_FEATURE_RRM)) {
10691                         kfree_sensitive(connkeys);
10692                         return -EINVAL;
10693                 }
10694                 connect.flags |= ASSOC_REQ_USE_RRM;
10695         }
10696
10697         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
10698         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
10699                 kfree_sensitive(connkeys);
10700                 return -EOPNOTSUPP;
10701         }
10702
10703         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
10704                 /* bss selection makes no sense if bssid is set */
10705                 if (connect.bssid) {
10706                         kfree_sensitive(connkeys);
10707                         return -EINVAL;
10708                 }
10709
10710                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
10711                                        wiphy, &connect.bss_select);
10712                 if (err) {
10713                         kfree_sensitive(connkeys);
10714                         return err;
10715                 }
10716         }
10717
10718         if (wiphy_ext_feature_isset(&rdev->wiphy,
10719                                     NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
10720             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
10721             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
10722             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
10723             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
10724                 connect.fils_erp_username =
10725                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
10726                 connect.fils_erp_username_len =
10727                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
10728                 connect.fils_erp_realm =
10729                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
10730                 connect.fils_erp_realm_len =
10731                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
10732                 connect.fils_erp_next_seq_num =
10733                         nla_get_u16(
10734                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
10735                 connect.fils_erp_rrk =
10736                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
10737                 connect.fils_erp_rrk_len =
10738                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
10739         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
10740                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
10741                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
10742                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
10743                 kfree_sensitive(connkeys);
10744                 return -EINVAL;
10745         }
10746
10747         if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
10748                 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10749                         kfree_sensitive(connkeys);
10750                         GENL_SET_ERR_MSG(info,
10751                                          "external auth requires connection ownership");
10752                         return -EINVAL;
10753                 }
10754                 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
10755         }
10756
10757         wdev_lock(dev->ieee80211_ptr);
10758
10759         err = cfg80211_connect(rdev, dev, &connect, connkeys,
10760                                connect.prev_bssid);
10761         if (err)
10762                 kfree_sensitive(connkeys);
10763
10764         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10765                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
10766                 if (connect.bssid)
10767                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
10768                                connect.bssid, ETH_ALEN);
10769                 else
10770                         eth_zero_addr(dev->ieee80211_ptr->disconnect_bssid);
10771         }
10772
10773         wdev_unlock(dev->ieee80211_ptr);
10774
10775         return err;
10776 }
10777
10778 static int nl80211_update_connect_params(struct sk_buff *skb,
10779                                          struct genl_info *info)
10780 {
10781         struct cfg80211_connect_params connect = {};
10782         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10783         struct net_device *dev = info->user_ptr[1];
10784         struct wireless_dev *wdev = dev->ieee80211_ptr;
10785         bool fils_sk_offload;
10786         u32 auth_type;
10787         u32 changed = 0;
10788         int ret;
10789
10790         if (!rdev->ops->update_connect_params)
10791                 return -EOPNOTSUPP;
10792
10793         if (info->attrs[NL80211_ATTR_IE]) {
10794                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10795                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10796                 changed |= UPDATE_ASSOC_IES;
10797         }
10798
10799         fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
10800                                                   NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
10801
10802         /*
10803          * when driver supports fils-sk offload all attributes must be
10804          * provided. So the else covers "fils-sk-not-all" and
10805          * "no-fils-sk-any".
10806          */
10807         if (fils_sk_offload &&
10808             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
10809             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
10810             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
10811             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
10812                 connect.fils_erp_username =
10813                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
10814                 connect.fils_erp_username_len =
10815                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
10816                 connect.fils_erp_realm =
10817                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
10818                 connect.fils_erp_realm_len =
10819                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
10820                 connect.fils_erp_next_seq_num =
10821                         nla_get_u16(
10822                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
10823                 connect.fils_erp_rrk =
10824                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
10825                 connect.fils_erp_rrk_len =
10826                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
10827                 changed |= UPDATE_FILS_ERP_INFO;
10828         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
10829                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
10830                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
10831                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
10832                 return -EINVAL;
10833         }
10834
10835         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
10836                 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
10837                 if (!nl80211_valid_auth_type(rdev, auth_type,
10838                                              NL80211_CMD_CONNECT))
10839                         return -EINVAL;
10840
10841                 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
10842                     fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
10843                         return -EINVAL;
10844
10845                 connect.auth_type = auth_type;
10846                 changed |= UPDATE_AUTH_TYPE;
10847         }
10848
10849         wdev_lock(dev->ieee80211_ptr);
10850         if (!wdev->current_bss)
10851                 ret = -ENOLINK;
10852         else
10853                 ret = rdev_update_connect_params(rdev, dev, &connect, changed);
10854         wdev_unlock(dev->ieee80211_ptr);
10855
10856         return ret;
10857 }
10858
10859 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
10860 {
10861         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10862         struct net_device *dev = info->user_ptr[1];
10863         u16 reason;
10864         int ret;
10865
10866         if (dev->ieee80211_ptr->conn_owner_nlportid &&
10867             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
10868                 return -EPERM;
10869
10870         if (!info->attrs[NL80211_ATTR_REASON_CODE])
10871                 reason = WLAN_REASON_DEAUTH_LEAVING;
10872         else
10873                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
10874
10875         if (reason == 0)
10876                 return -EINVAL;
10877
10878         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10879             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10880                 return -EOPNOTSUPP;
10881
10882         wdev_lock(dev->ieee80211_ptr);
10883         ret = cfg80211_disconnect(rdev, dev, reason, true);
10884         wdev_unlock(dev->ieee80211_ptr);
10885         return ret;
10886 }
10887
10888 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
10889 {
10890         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10891         struct net *net;
10892         int err;
10893
10894         if (info->attrs[NL80211_ATTR_PID]) {
10895                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
10896
10897                 net = get_net_ns_by_pid(pid);
10898         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
10899                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
10900
10901                 net = get_net_ns_by_fd(fd);
10902         } else {
10903                 return -EINVAL;
10904         }
10905
10906         if (IS_ERR(net))
10907                 return PTR_ERR(net);
10908
10909         err = 0;
10910
10911         /* check if anything to do */
10912         if (!net_eq(wiphy_net(&rdev->wiphy), net))
10913                 err = cfg80211_switch_netns(rdev, net);
10914
10915         put_net(net);
10916         return err;
10917 }
10918
10919 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
10920 {
10921         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10922         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
10923                         struct cfg80211_pmksa *pmksa) = NULL;
10924         struct net_device *dev = info->user_ptr[1];
10925         struct cfg80211_pmksa pmksa;
10926
10927         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
10928
10929         if (!info->attrs[NL80211_ATTR_PMKID])
10930                 return -EINVAL;
10931
10932         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
10933
10934         if (info->attrs[NL80211_ATTR_MAC]) {
10935                 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10936         } else if (info->attrs[NL80211_ATTR_SSID] &&
10937                    info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
10938                    (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
10939                     info->attrs[NL80211_ATTR_PMK])) {
10940                 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10941                 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10942                 pmksa.cache_id =
10943                         nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
10944         } else {
10945                 return -EINVAL;
10946         }
10947         if (info->attrs[NL80211_ATTR_PMK]) {
10948                 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
10949                 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
10950         }
10951
10952         if (info->attrs[NL80211_ATTR_PMK_LIFETIME])
10953                 pmksa.pmk_lifetime =
10954                         nla_get_u32(info->attrs[NL80211_ATTR_PMK_LIFETIME]);
10955
10956         if (info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD])
10957                 pmksa.pmk_reauth_threshold =
10958                         nla_get_u8(
10959                                 info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]);
10960
10961         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10962             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
10963             !(dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP &&
10964               wiphy_ext_feature_isset(&rdev->wiphy,
10965                                       NL80211_EXT_FEATURE_AP_PMKSA_CACHING)))
10966                 return -EOPNOTSUPP;
10967
10968         switch (info->genlhdr->cmd) {
10969         case NL80211_CMD_SET_PMKSA:
10970                 rdev_ops = rdev->ops->set_pmksa;
10971                 break;
10972         case NL80211_CMD_DEL_PMKSA:
10973                 rdev_ops = rdev->ops->del_pmksa;
10974                 break;
10975         default:
10976                 WARN_ON(1);
10977                 break;
10978         }
10979
10980         if (!rdev_ops)
10981                 return -EOPNOTSUPP;
10982
10983         return rdev_ops(&rdev->wiphy, dev, &pmksa);
10984 }
10985
10986 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
10987 {
10988         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10989         struct net_device *dev = info->user_ptr[1];
10990
10991         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10992             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10993                 return -EOPNOTSUPP;
10994
10995         if (!rdev->ops->flush_pmksa)
10996                 return -EOPNOTSUPP;
10997
10998         return rdev_flush_pmksa(rdev, dev);
10999 }
11000
11001 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
11002 {
11003         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11004         struct net_device *dev = info->user_ptr[1];
11005         u8 action_code, dialog_token;
11006         u32 peer_capability = 0;
11007         u16 status_code;
11008         u8 *peer;
11009         bool initiator;
11010
11011         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
11012             !rdev->ops->tdls_mgmt)
11013                 return -EOPNOTSUPP;
11014
11015         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
11016             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
11017             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
11018             !info->attrs[NL80211_ATTR_IE] ||
11019             !info->attrs[NL80211_ATTR_MAC])
11020                 return -EINVAL;
11021
11022         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
11023         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
11024         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
11025         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
11026         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
11027         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
11028                 peer_capability =
11029                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
11030
11031         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
11032                               dialog_token, status_code, peer_capability,
11033                               initiator,
11034                               nla_data(info->attrs[NL80211_ATTR_IE]),
11035                               nla_len(info->attrs[NL80211_ATTR_IE]));
11036 }
11037
11038 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
11039 {
11040         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11041         struct net_device *dev = info->user_ptr[1];
11042         enum nl80211_tdls_operation operation;
11043         u8 *peer;
11044
11045         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
11046             !rdev->ops->tdls_oper)
11047                 return -EOPNOTSUPP;
11048
11049         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
11050             !info->attrs[NL80211_ATTR_MAC])
11051                 return -EINVAL;
11052
11053         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
11054         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
11055
11056         return rdev_tdls_oper(rdev, dev, peer, operation);
11057 }
11058
11059 static int nl80211_remain_on_channel(struct sk_buff *skb,
11060                                      struct genl_info *info)
11061 {
11062         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11063         struct wireless_dev *wdev = info->user_ptr[1];
11064         struct cfg80211_chan_def chandef;
11065         const struct cfg80211_chan_def *compat_chandef;
11066         struct sk_buff *msg;
11067         void *hdr;
11068         u64 cookie;
11069         u32 duration;
11070         int err;
11071
11072         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
11073             !info->attrs[NL80211_ATTR_DURATION])
11074                 return -EINVAL;
11075
11076         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
11077
11078         if (!rdev->ops->remain_on_channel ||
11079             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
11080                 return -EOPNOTSUPP;
11081
11082         /*
11083          * We should be on that channel for at least a minimum amount of
11084          * time (10ms) but no longer than the driver supports.
11085          */
11086         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
11087             duration > rdev->wiphy.max_remain_on_channel_duration)
11088                 return -EINVAL;
11089
11090         err = nl80211_parse_chandef(rdev, info, &chandef);
11091         if (err)
11092                 return err;
11093
11094         wdev_lock(wdev);
11095         if (!cfg80211_off_channel_oper_allowed(wdev) &&
11096             !cfg80211_chandef_identical(&wdev->chandef, &chandef)) {
11097                 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef,
11098                                                              &chandef);
11099                 if (compat_chandef != &chandef) {
11100                         wdev_unlock(wdev);
11101                         return -EBUSY;
11102                 }
11103         }
11104         wdev_unlock(wdev);
11105
11106         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11107         if (!msg)
11108                 return -ENOMEM;
11109
11110         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11111                              NL80211_CMD_REMAIN_ON_CHANNEL);
11112         if (!hdr) {
11113                 err = -ENOBUFS;
11114                 goto free_msg;
11115         }
11116
11117         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
11118                                      duration, &cookie);
11119
11120         if (err)
11121                 goto free_msg;
11122
11123         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11124                               NL80211_ATTR_PAD))
11125                 goto nla_put_failure;
11126
11127         genlmsg_end(msg, hdr);
11128
11129         return genlmsg_reply(msg, info);
11130
11131  nla_put_failure:
11132         err = -ENOBUFS;
11133  free_msg:
11134         nlmsg_free(msg);
11135         return err;
11136 }
11137
11138 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
11139                                             struct genl_info *info)
11140 {
11141         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11142         struct wireless_dev *wdev = info->user_ptr[1];
11143         u64 cookie;
11144
11145         if (!info->attrs[NL80211_ATTR_COOKIE])
11146                 return -EINVAL;
11147
11148         if (!rdev->ops->cancel_remain_on_channel)
11149                 return -EOPNOTSUPP;
11150
11151         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
11152
11153         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
11154 }
11155
11156 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
11157                                        struct genl_info *info)
11158 {
11159         struct cfg80211_bitrate_mask mask;
11160         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11161         struct net_device *dev = info->user_ptr[1];
11162         int err;
11163
11164         if (!rdev->ops->set_bitrate_mask)
11165                 return -EOPNOTSUPP;
11166
11167         err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
11168                                             NL80211_ATTR_TX_RATES, &mask,
11169                                             dev, true);
11170         if (err)
11171                 return err;
11172
11173         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
11174 }
11175
11176 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
11177 {
11178         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11179         struct wireless_dev *wdev = info->user_ptr[1];
11180         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
11181
11182         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
11183                 return -EINVAL;
11184
11185         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
11186                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
11187
11188         switch (wdev->iftype) {
11189         case NL80211_IFTYPE_STATION:
11190         case NL80211_IFTYPE_ADHOC:
11191         case NL80211_IFTYPE_P2P_CLIENT:
11192         case NL80211_IFTYPE_AP:
11193         case NL80211_IFTYPE_AP_VLAN:
11194         case NL80211_IFTYPE_MESH_POINT:
11195         case NL80211_IFTYPE_P2P_GO:
11196         case NL80211_IFTYPE_P2P_DEVICE:
11197                 break;
11198         case NL80211_IFTYPE_NAN:
11199         default:
11200                 return -EOPNOTSUPP;
11201         }
11202
11203         /* not much point in registering if we can't reply */
11204         if (!rdev->ops->mgmt_tx)
11205                 return -EOPNOTSUPP;
11206
11207         if (info->attrs[NL80211_ATTR_RECEIVE_MULTICAST] &&
11208             !wiphy_ext_feature_isset(&rdev->wiphy,
11209                                      NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS)) {
11210                 GENL_SET_ERR_MSG(info,
11211                                  "multicast RX registrations are not supported");
11212                 return -EOPNOTSUPP;
11213         }
11214
11215         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
11216                                            nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
11217                                            nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]),
11218                                            info->attrs[NL80211_ATTR_RECEIVE_MULTICAST],
11219                                            info->extack);
11220 }
11221
11222 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
11223 {
11224         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11225         struct wireless_dev *wdev = info->user_ptr[1];
11226         struct cfg80211_chan_def chandef;
11227         int err;
11228         void *hdr = NULL;
11229         u64 cookie;
11230         struct sk_buff *msg = NULL;
11231         struct cfg80211_mgmt_tx_params params = {
11232                 .dont_wait_for_ack =
11233                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
11234         };
11235
11236         if (!info->attrs[NL80211_ATTR_FRAME])
11237                 return -EINVAL;
11238
11239         if (!rdev->ops->mgmt_tx)
11240                 return -EOPNOTSUPP;
11241
11242         switch (wdev->iftype) {
11243         case NL80211_IFTYPE_P2P_DEVICE:
11244                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
11245                         return -EINVAL;
11246                 break;
11247         case NL80211_IFTYPE_STATION:
11248         case NL80211_IFTYPE_ADHOC:
11249         case NL80211_IFTYPE_P2P_CLIENT:
11250         case NL80211_IFTYPE_AP:
11251         case NL80211_IFTYPE_AP_VLAN:
11252         case NL80211_IFTYPE_MESH_POINT:
11253         case NL80211_IFTYPE_P2P_GO:
11254                 break;
11255         case NL80211_IFTYPE_NAN:
11256         default:
11257                 return -EOPNOTSUPP;
11258         }
11259
11260         if (info->attrs[NL80211_ATTR_DURATION]) {
11261                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
11262                         return -EINVAL;
11263                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
11264
11265                 /*
11266                  * We should wait on the channel for at least a minimum amount
11267                  * of time (10ms) but no longer than the driver supports.
11268                  */
11269                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
11270                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
11271                         return -EINVAL;
11272         }
11273
11274         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
11275
11276         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
11277                 return -EINVAL;
11278
11279         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
11280
11281         /* get the channel if any has been specified, otherwise pass NULL to
11282          * the driver. The latter will use the current one
11283          */
11284         chandef.chan = NULL;
11285         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
11286                 err = nl80211_parse_chandef(rdev, info, &chandef);
11287                 if (err)
11288                         return err;
11289         }
11290
11291         if (!chandef.chan && params.offchan)
11292                 return -EINVAL;
11293
11294         wdev_lock(wdev);
11295         if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) {
11296                 wdev_unlock(wdev);
11297                 return -EBUSY;
11298         }
11299         wdev_unlock(wdev);
11300
11301         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
11302         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
11303
11304         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
11305                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
11306                 int i;
11307
11308                 if (len % sizeof(u16))
11309                         return -EINVAL;
11310
11311                 params.n_csa_offsets = len / sizeof(u16);
11312                 params.csa_offsets =
11313                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
11314
11315                 /* check that all the offsets fit the frame */
11316                 for (i = 0; i < params.n_csa_offsets; i++) {
11317                         if (params.csa_offsets[i] >= params.len)
11318                                 return -EINVAL;
11319                 }
11320         }
11321
11322         if (!params.dont_wait_for_ack) {
11323                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11324                 if (!msg)
11325                         return -ENOMEM;
11326
11327                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11328                                      NL80211_CMD_FRAME);
11329                 if (!hdr) {
11330                         err = -ENOBUFS;
11331                         goto free_msg;
11332                 }
11333         }
11334
11335         params.chan = chandef.chan;
11336         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
11337         if (err)
11338                 goto free_msg;
11339
11340         if (msg) {
11341                 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11342                                       NL80211_ATTR_PAD))
11343                         goto nla_put_failure;
11344
11345                 genlmsg_end(msg, hdr);
11346                 return genlmsg_reply(msg, info);
11347         }
11348
11349         return 0;
11350
11351  nla_put_failure:
11352         err = -ENOBUFS;
11353  free_msg:
11354         nlmsg_free(msg);
11355         return err;
11356 }
11357
11358 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
11359 {
11360         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11361         struct wireless_dev *wdev = info->user_ptr[1];
11362         u64 cookie;
11363
11364         if (!info->attrs[NL80211_ATTR_COOKIE])
11365                 return -EINVAL;
11366
11367         if (!rdev->ops->mgmt_tx_cancel_wait)
11368                 return -EOPNOTSUPP;
11369
11370         switch (wdev->iftype) {
11371         case NL80211_IFTYPE_STATION:
11372         case NL80211_IFTYPE_ADHOC:
11373         case NL80211_IFTYPE_P2P_CLIENT:
11374         case NL80211_IFTYPE_AP:
11375         case NL80211_IFTYPE_AP_VLAN:
11376         case NL80211_IFTYPE_P2P_GO:
11377         case NL80211_IFTYPE_P2P_DEVICE:
11378                 break;
11379         case NL80211_IFTYPE_NAN:
11380         default:
11381                 return -EOPNOTSUPP;
11382         }
11383
11384         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
11385
11386         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
11387 }
11388
11389 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
11390 {
11391         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11392         struct wireless_dev *wdev;
11393         struct net_device *dev = info->user_ptr[1];
11394         u8 ps_state;
11395         bool state;
11396         int err;
11397
11398         if (!info->attrs[NL80211_ATTR_PS_STATE])
11399                 return -EINVAL;
11400
11401         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
11402
11403         wdev = dev->ieee80211_ptr;
11404
11405         if (!rdev->ops->set_power_mgmt)
11406                 return -EOPNOTSUPP;
11407
11408         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
11409
11410         if (state == wdev->ps)
11411                 return 0;
11412
11413         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
11414         if (!err)
11415                 wdev->ps = state;
11416         return err;
11417 }
11418
11419 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
11420 {
11421         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11422         enum nl80211_ps_state ps_state;
11423         struct wireless_dev *wdev;
11424         struct net_device *dev = info->user_ptr[1];
11425         struct sk_buff *msg;
11426         void *hdr;
11427         int err;
11428
11429         wdev = dev->ieee80211_ptr;
11430
11431         if (!rdev->ops->set_power_mgmt)
11432                 return -EOPNOTSUPP;
11433
11434         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11435         if (!msg)
11436                 return -ENOMEM;
11437
11438         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11439                              NL80211_CMD_GET_POWER_SAVE);
11440         if (!hdr) {
11441                 err = -ENOBUFS;
11442                 goto free_msg;
11443         }
11444
11445         if (wdev->ps)
11446                 ps_state = NL80211_PS_ENABLED;
11447         else
11448                 ps_state = NL80211_PS_DISABLED;
11449
11450         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
11451                 goto nla_put_failure;
11452
11453         genlmsg_end(msg, hdr);
11454         return genlmsg_reply(msg, info);
11455
11456  nla_put_failure:
11457         err = -ENOBUFS;
11458  free_msg:
11459         nlmsg_free(msg);
11460         return err;
11461 }
11462
11463 static const struct nla_policy
11464 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
11465         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
11466         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
11467         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
11468         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
11469         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
11470         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
11471         [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
11472 };
11473
11474 static int nl80211_set_cqm_txe(struct genl_info *info,
11475                                u32 rate, u32 pkts, u32 intvl)
11476 {
11477         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11478         struct net_device *dev = info->user_ptr[1];
11479         struct wireless_dev *wdev = dev->ieee80211_ptr;
11480
11481         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
11482                 return -EINVAL;
11483
11484         if (!rdev->ops->set_cqm_txe_config)
11485                 return -EOPNOTSUPP;
11486
11487         if (wdev->iftype != NL80211_IFTYPE_STATION &&
11488             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
11489                 return -EOPNOTSUPP;
11490
11491         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
11492 }
11493
11494 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
11495                                     struct net_device *dev)
11496 {
11497         struct wireless_dev *wdev = dev->ieee80211_ptr;
11498         s32 last, low, high;
11499         u32 hyst;
11500         int i, n, low_index;
11501         int err;
11502
11503         /* RSSI reporting disabled? */
11504         if (!wdev->cqm_config)
11505                 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
11506
11507         /*
11508          * Obtain current RSSI value if possible, if not and no RSSI threshold
11509          * event has been received yet, we should receive an event after a
11510          * connection is established and enough beacons received to calculate
11511          * the average.
11512          */
11513         if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss &&
11514             rdev->ops->get_station) {
11515                 struct station_info sinfo = {};
11516                 u8 *mac_addr;
11517
11518                 mac_addr = wdev->current_bss->pub.bssid;
11519
11520                 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
11521                 if (err)
11522                         return err;
11523
11524                 cfg80211_sinfo_release_content(&sinfo);
11525                 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
11526                         wdev->cqm_config->last_rssi_event_value =
11527                                 (s8) sinfo.rx_beacon_signal_avg;
11528         }
11529
11530         last = wdev->cqm_config->last_rssi_event_value;
11531         hyst = wdev->cqm_config->rssi_hyst;
11532         n = wdev->cqm_config->n_rssi_thresholds;
11533
11534         for (i = 0; i < n; i++) {
11535                 i = array_index_nospec(i, n);
11536                 if (last < wdev->cqm_config->rssi_thresholds[i])
11537                         break;
11538         }
11539
11540         low_index = i - 1;
11541         if (low_index >= 0) {
11542                 low_index = array_index_nospec(low_index, n);
11543                 low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;
11544         } else {
11545                 low = S32_MIN;
11546         }
11547         if (i < n) {
11548                 i = array_index_nospec(i, n);
11549                 high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;
11550         } else {
11551                 high = S32_MAX;
11552         }
11553
11554         return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
11555 }
11556
11557 static int nl80211_set_cqm_rssi(struct genl_info *info,
11558                                 const s32 *thresholds, int n_thresholds,
11559                                 u32 hysteresis)
11560 {
11561         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11562         struct net_device *dev = info->user_ptr[1];
11563         struct wireless_dev *wdev = dev->ieee80211_ptr;
11564         int i, err;
11565         s32 prev = S32_MIN;
11566
11567         /* Check all values negative and sorted */
11568         for (i = 0; i < n_thresholds; i++) {
11569                 if (thresholds[i] > 0 || thresholds[i] <= prev)
11570                         return -EINVAL;
11571
11572                 prev = thresholds[i];
11573         }
11574
11575         if (wdev->iftype != NL80211_IFTYPE_STATION &&
11576             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
11577                 return -EOPNOTSUPP;
11578
11579         wdev_lock(wdev);
11580         cfg80211_cqm_config_free(wdev);
11581         wdev_unlock(wdev);
11582
11583         if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
11584                 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
11585                         return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
11586
11587                 return rdev_set_cqm_rssi_config(rdev, dev,
11588                                                 thresholds[0], hysteresis);
11589         }
11590
11591         if (!wiphy_ext_feature_isset(&rdev->wiphy,
11592                                      NL80211_EXT_FEATURE_CQM_RSSI_LIST))
11593                 return -EOPNOTSUPP;
11594
11595         if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
11596                 n_thresholds = 0;
11597
11598         wdev_lock(wdev);
11599         if (n_thresholds) {
11600                 struct cfg80211_cqm_config *cqm_config;
11601
11602                 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) +
11603                                      n_thresholds * sizeof(s32), GFP_KERNEL);
11604                 if (!cqm_config) {
11605                         err = -ENOMEM;
11606                         goto unlock;
11607                 }
11608
11609                 cqm_config->rssi_hyst = hysteresis;
11610                 cqm_config->n_rssi_thresholds = n_thresholds;
11611                 memcpy(cqm_config->rssi_thresholds, thresholds,
11612                        n_thresholds * sizeof(s32));
11613
11614                 wdev->cqm_config = cqm_config;
11615         }
11616
11617         err = cfg80211_cqm_rssi_update(rdev, dev);
11618
11619 unlock:
11620         wdev_unlock(wdev);
11621
11622         return err;
11623 }
11624
11625 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
11626 {
11627         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
11628         struct nlattr *cqm;
11629         int err;
11630
11631         cqm = info->attrs[NL80211_ATTR_CQM];
11632         if (!cqm)
11633                 return -EINVAL;
11634
11635         err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm,
11636                                           nl80211_attr_cqm_policy,
11637                                           info->extack);
11638         if (err)
11639                 return err;
11640
11641         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
11642             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
11643                 const s32 *thresholds =
11644                         nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
11645                 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
11646                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
11647
11648                 if (len % 4)
11649                         return -EINVAL;
11650
11651                 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
11652                                             hysteresis);
11653         }
11654
11655         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
11656             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
11657             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
11658                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
11659                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
11660                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
11661
11662                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
11663         }
11664
11665         return -EINVAL;
11666 }
11667
11668 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
11669 {
11670         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11671         struct net_device *dev = info->user_ptr[1];
11672         struct ocb_setup setup = {};
11673         int err;
11674
11675         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
11676         if (err)
11677                 return err;
11678
11679         return cfg80211_join_ocb(rdev, dev, &setup);
11680 }
11681
11682 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
11683 {
11684         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11685         struct net_device *dev = info->user_ptr[1];
11686
11687         return cfg80211_leave_ocb(rdev, dev);
11688 }
11689
11690 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
11691 {
11692         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11693         struct net_device *dev = info->user_ptr[1];
11694         struct mesh_config cfg;
11695         struct mesh_setup setup;
11696         int err;
11697
11698         /* start with default */
11699         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
11700         memcpy(&setup, &default_mesh_setup, sizeof(setup));
11701
11702         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
11703                 /* and parse parameters if given */
11704                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
11705                 if (err)
11706                         return err;
11707         }
11708
11709         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
11710             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
11711                 return -EINVAL;
11712
11713         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
11714         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
11715
11716         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
11717             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
11718                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
11719                         return -EINVAL;
11720
11721         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
11722                 setup.beacon_interval =
11723                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
11724
11725                 err = cfg80211_validate_beacon_int(rdev,
11726                                                    NL80211_IFTYPE_MESH_POINT,
11727                                                    setup.beacon_interval);
11728                 if (err)
11729                         return err;
11730         }
11731
11732         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
11733                 setup.dtim_period =
11734                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
11735                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
11736                         return -EINVAL;
11737         }
11738
11739         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
11740                 /* parse additional setup parameters if given */
11741                 err = nl80211_parse_mesh_setup(info, &setup);
11742                 if (err)
11743                         return err;
11744         }
11745
11746         if (setup.user_mpm)
11747                 cfg.auto_open_plinks = false;
11748
11749         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
11750                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
11751                 if (err)
11752                         return err;
11753         } else {
11754                 /* __cfg80211_join_mesh() will sort it out */
11755                 setup.chandef.chan = NULL;
11756         }
11757
11758         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
11759                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11760                 int n_rates =
11761                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11762                 struct ieee80211_supported_band *sband;
11763
11764                 if (!setup.chandef.chan)
11765                         return -EINVAL;
11766
11767                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
11768
11769                 err = ieee80211_get_ratemask(sband, rates, n_rates,
11770                                              &setup.basic_rates);
11771                 if (err)
11772                         return err;
11773         }
11774
11775         if (info->attrs[NL80211_ATTR_TX_RATES]) {
11776                 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
11777                                                     NL80211_ATTR_TX_RATES,
11778                                                     &setup.beacon_rate,
11779                                                     dev, false);
11780                 if (err)
11781                         return err;
11782
11783                 if (!setup.chandef.chan)
11784                         return -EINVAL;
11785
11786                 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
11787                                               &setup.beacon_rate);
11788                 if (err)
11789                         return err;
11790         }
11791
11792         setup.userspace_handles_dfs =
11793                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
11794
11795         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
11796                 int r = validate_pae_over_nl80211(rdev, info);
11797
11798                 if (r < 0)
11799                         return r;
11800
11801                 setup.control_port_over_nl80211 = true;
11802         }
11803
11804         wdev_lock(dev->ieee80211_ptr);
11805         err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
11806         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
11807                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
11808         wdev_unlock(dev->ieee80211_ptr);
11809
11810         return err;
11811 }
11812
11813 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
11814 {
11815         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11816         struct net_device *dev = info->user_ptr[1];
11817
11818         return cfg80211_leave_mesh(rdev, dev);
11819 }
11820
11821 #ifdef CONFIG_PM
11822 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
11823                                         struct cfg80211_registered_device *rdev)
11824 {
11825         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
11826         struct nlattr *nl_pats, *nl_pat;
11827         int i, pat_len;
11828
11829         if (!wowlan->n_patterns)
11830                 return 0;
11831
11832         nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
11833         if (!nl_pats)
11834                 return -ENOBUFS;
11835
11836         for (i = 0; i < wowlan->n_patterns; i++) {
11837                 nl_pat = nla_nest_start_noflag(msg, i + 1);
11838                 if (!nl_pat)
11839                         return -ENOBUFS;
11840                 pat_len = wowlan->patterns[i].pattern_len;
11841                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
11842                             wowlan->patterns[i].mask) ||
11843                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
11844                             wowlan->patterns[i].pattern) ||
11845                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
11846                                 wowlan->patterns[i].pkt_offset))
11847                         return -ENOBUFS;
11848                 nla_nest_end(msg, nl_pat);
11849         }
11850         nla_nest_end(msg, nl_pats);
11851
11852         return 0;
11853 }
11854
11855 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
11856                                    struct cfg80211_wowlan_tcp *tcp)
11857 {
11858         struct nlattr *nl_tcp;
11859
11860         if (!tcp)
11861                 return 0;
11862
11863         nl_tcp = nla_nest_start_noflag(msg,
11864                                        NL80211_WOWLAN_TRIG_TCP_CONNECTION);
11865         if (!nl_tcp)
11866                 return -ENOBUFS;
11867
11868         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
11869             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
11870             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
11871             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
11872             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
11873             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
11874                     tcp->payload_len, tcp->payload) ||
11875             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
11876                         tcp->data_interval) ||
11877             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
11878                     tcp->wake_len, tcp->wake_data) ||
11879             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
11880                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
11881                 return -ENOBUFS;
11882
11883         if (tcp->payload_seq.len &&
11884             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
11885                     sizeof(tcp->payload_seq), &tcp->payload_seq))
11886                 return -ENOBUFS;
11887
11888         if (tcp->payload_tok.len &&
11889             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
11890                     sizeof(tcp->payload_tok) + tcp->tokens_size,
11891                     &tcp->payload_tok))
11892                 return -ENOBUFS;
11893
11894         nla_nest_end(msg, nl_tcp);
11895
11896         return 0;
11897 }
11898
11899 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
11900                                   struct cfg80211_sched_scan_request *req)
11901 {
11902         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
11903         int i;
11904
11905         if (!req)
11906                 return 0;
11907
11908         nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
11909         if (!nd)
11910                 return -ENOBUFS;
11911
11912         if (req->n_scan_plans == 1 &&
11913             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
11914                         req->scan_plans[0].interval * 1000))
11915                 return -ENOBUFS;
11916
11917         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
11918                 return -ENOBUFS;
11919
11920         if (req->relative_rssi_set) {
11921                 struct nl80211_bss_select_rssi_adjust rssi_adjust;
11922
11923                 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
11924                                req->relative_rssi))
11925                         return -ENOBUFS;
11926
11927                 rssi_adjust.band = req->rssi_adjust.band;
11928                 rssi_adjust.delta = req->rssi_adjust.delta;
11929                 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
11930                             sizeof(rssi_adjust), &rssi_adjust))
11931                         return -ENOBUFS;
11932         }
11933
11934         freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
11935         if (!freqs)
11936                 return -ENOBUFS;
11937
11938         for (i = 0; i < req->n_channels; i++) {
11939                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
11940                         return -ENOBUFS;
11941         }
11942
11943         nla_nest_end(msg, freqs);
11944
11945         if (req->n_match_sets) {
11946                 matches = nla_nest_start_noflag(msg,
11947                                                 NL80211_ATTR_SCHED_SCAN_MATCH);
11948                 if (!matches)
11949                         return -ENOBUFS;
11950
11951                 for (i = 0; i < req->n_match_sets; i++) {
11952                         match = nla_nest_start_noflag(msg, i);
11953                         if (!match)
11954                                 return -ENOBUFS;
11955
11956                         if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
11957                                     req->match_sets[i].ssid.ssid_len,
11958                                     req->match_sets[i].ssid.ssid))
11959                                 return -ENOBUFS;
11960                         nla_nest_end(msg, match);
11961                 }
11962                 nla_nest_end(msg, matches);
11963         }
11964
11965         scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
11966         if (!scan_plans)
11967                 return -ENOBUFS;
11968
11969         for (i = 0; i < req->n_scan_plans; i++) {
11970                 scan_plan = nla_nest_start_noflag(msg, i + 1);
11971                 if (!scan_plan)
11972                         return -ENOBUFS;
11973
11974                 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
11975                                 req->scan_plans[i].interval) ||
11976                     (req->scan_plans[i].iterations &&
11977                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
11978                                  req->scan_plans[i].iterations)))
11979                         return -ENOBUFS;
11980                 nla_nest_end(msg, scan_plan);
11981         }
11982         nla_nest_end(msg, scan_plans);
11983
11984         nla_nest_end(msg, nd);
11985
11986         return 0;
11987 }
11988
11989 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
11990 {
11991         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11992         struct sk_buff *msg;
11993         void *hdr;
11994         u32 size = NLMSG_DEFAULT_SIZE;
11995
11996         if (!rdev->wiphy.wowlan)
11997                 return -EOPNOTSUPP;
11998
11999         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
12000                 /* adjust size to have room for all the data */
12001                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
12002                         rdev->wiphy.wowlan_config->tcp->payload_len +
12003                         rdev->wiphy.wowlan_config->tcp->wake_len +
12004                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
12005         }
12006
12007         msg = nlmsg_new(size, GFP_KERNEL);
12008         if (!msg)
12009                 return -ENOMEM;
12010
12011         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12012                              NL80211_CMD_GET_WOWLAN);
12013         if (!hdr)
12014                 goto nla_put_failure;
12015
12016         if (rdev->wiphy.wowlan_config) {
12017                 struct nlattr *nl_wowlan;
12018
12019                 nl_wowlan = nla_nest_start_noflag(msg,
12020                                                   NL80211_ATTR_WOWLAN_TRIGGERS);
12021                 if (!nl_wowlan)
12022                         goto nla_put_failure;
12023
12024                 if ((rdev->wiphy.wowlan_config->any &&
12025                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
12026                     (rdev->wiphy.wowlan_config->disconnect &&
12027                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
12028                     (rdev->wiphy.wowlan_config->magic_pkt &&
12029                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
12030                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
12031                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
12032                     (rdev->wiphy.wowlan_config->eap_identity_req &&
12033                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
12034                     (rdev->wiphy.wowlan_config->four_way_handshake &&
12035                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
12036                     (rdev->wiphy.wowlan_config->rfkill_release &&
12037                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
12038                         goto nla_put_failure;
12039
12040                 if (nl80211_send_wowlan_patterns(msg, rdev))
12041                         goto nla_put_failure;
12042
12043                 if (nl80211_send_wowlan_tcp(msg,
12044                                             rdev->wiphy.wowlan_config->tcp))
12045                         goto nla_put_failure;
12046
12047                 if (nl80211_send_wowlan_nd(
12048                             msg,
12049                             rdev->wiphy.wowlan_config->nd_config))
12050                         goto nla_put_failure;
12051
12052                 nla_nest_end(msg, nl_wowlan);
12053         }
12054
12055         genlmsg_end(msg, hdr);
12056         return genlmsg_reply(msg, info);
12057
12058 nla_put_failure:
12059         nlmsg_free(msg);
12060         return -ENOBUFS;
12061 }
12062
12063 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
12064                                     struct nlattr *attr,
12065                                     struct cfg80211_wowlan *trig)
12066 {
12067         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
12068         struct cfg80211_wowlan_tcp *cfg;
12069         struct nl80211_wowlan_tcp_data_token *tok = NULL;
12070         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
12071         u32 size;
12072         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
12073         int err, port;
12074
12075         if (!rdev->wiphy.wowlan->tcp)
12076                 return -EINVAL;
12077
12078         err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr,
12079                                           nl80211_wowlan_tcp_policy, NULL);
12080         if (err)
12081                 return err;
12082
12083         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
12084             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
12085             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
12086             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
12087             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
12088             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
12089             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
12090             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
12091                 return -EINVAL;
12092
12093         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
12094         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
12095                 return -EINVAL;
12096
12097         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
12098                         rdev->wiphy.wowlan->tcp->data_interval_max ||
12099             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
12100                 return -EINVAL;
12101
12102         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
12103         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
12104                 return -EINVAL;
12105
12106         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
12107         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
12108                 return -EINVAL;
12109
12110         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
12111                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
12112
12113                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
12114                 tokens_size = tokln - sizeof(*tok);
12115
12116                 if (!tok->len || tokens_size % tok->len)
12117                         return -EINVAL;
12118                 if (!rdev->wiphy.wowlan->tcp->tok)
12119                         return -EINVAL;
12120                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
12121                         return -EINVAL;
12122                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
12123                         return -EINVAL;
12124                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
12125                         return -EINVAL;
12126                 if (tok->offset + tok->len > data_size)
12127                         return -EINVAL;
12128         }
12129
12130         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
12131                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
12132                 if (!rdev->wiphy.wowlan->tcp->seq)
12133                         return -EINVAL;
12134                 if (seq->len == 0 || seq->len > 4)
12135                         return -EINVAL;
12136                 if (seq->len + seq->offset > data_size)
12137                         return -EINVAL;
12138         }
12139
12140         size = sizeof(*cfg);
12141         size += data_size;
12142         size += wake_size + wake_mask_size;
12143         size += tokens_size;
12144
12145         cfg = kzalloc(size, GFP_KERNEL);
12146         if (!cfg)
12147                 return -ENOMEM;
12148         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
12149         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
12150         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
12151                ETH_ALEN);
12152         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
12153                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
12154         else
12155                 port = 0;
12156 #ifdef CONFIG_INET
12157         /* allocate a socket and port for it and use it */
12158         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
12159                             IPPROTO_TCP, &cfg->sock, 1);
12160         if (err) {
12161                 kfree(cfg);
12162                 return err;
12163         }
12164         if (inet_csk_get_port(cfg->sock->sk, port)) {
12165                 sock_release(cfg->sock);
12166                 kfree(cfg);
12167                 return -EADDRINUSE;
12168         }
12169         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
12170 #else
12171         if (!port) {
12172                 kfree(cfg);
12173                 return -EINVAL;
12174         }
12175         cfg->src_port = port;
12176 #endif
12177
12178         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
12179         cfg->payload_len = data_size;
12180         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
12181         memcpy((void *)cfg->payload,
12182                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
12183                data_size);
12184         if (seq)
12185                 cfg->payload_seq = *seq;
12186         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
12187         cfg->wake_len = wake_size;
12188         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
12189         memcpy((void *)cfg->wake_data,
12190                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
12191                wake_size);
12192         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
12193                          data_size + wake_size;
12194         memcpy((void *)cfg->wake_mask,
12195                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
12196                wake_mask_size);
12197         if (tok) {
12198                 cfg->tokens_size = tokens_size;
12199                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
12200         }
12201
12202         trig->tcp = cfg;
12203
12204         return 0;
12205 }
12206
12207 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
12208                                    const struct wiphy_wowlan_support *wowlan,
12209                                    struct nlattr *attr,
12210                                    struct cfg80211_wowlan *trig)
12211 {
12212         struct nlattr **tb;
12213         int err;
12214
12215         tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
12216         if (!tb)
12217                 return -ENOMEM;
12218
12219         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
12220                 err = -EOPNOTSUPP;
12221                 goto out;
12222         }
12223
12224         err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr,
12225                                           nl80211_policy, NULL);
12226         if (err)
12227                 goto out;
12228
12229         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
12230                                                    wowlan->max_nd_match_sets);
12231         err = PTR_ERR_OR_ZERO(trig->nd_config);
12232         if (err)
12233                 trig->nd_config = NULL;
12234
12235 out:
12236         kfree(tb);
12237         return err;
12238 }
12239
12240 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
12241 {
12242         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12243         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
12244         struct cfg80211_wowlan new_triggers = {};
12245         struct cfg80211_wowlan *ntrig;
12246         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
12247         int err, i;
12248         bool prev_enabled = rdev->wiphy.wowlan_config;
12249         bool regular = false;
12250
12251         if (!wowlan)
12252                 return -EOPNOTSUPP;
12253
12254         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
12255                 cfg80211_rdev_free_wowlan(rdev);
12256                 rdev->wiphy.wowlan_config = NULL;
12257                 goto set_wakeup;
12258         }
12259
12260         err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG,
12261                                           info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
12262                                           nl80211_wowlan_policy, info->extack);
12263         if (err)
12264                 return err;
12265
12266         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
12267                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
12268                         return -EINVAL;
12269                 new_triggers.any = true;
12270         }
12271
12272         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
12273                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
12274                         return -EINVAL;
12275                 new_triggers.disconnect = true;
12276                 regular = true;
12277         }
12278
12279         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
12280                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
12281                         return -EINVAL;
12282                 new_triggers.magic_pkt = true;
12283                 regular = true;
12284         }
12285
12286         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
12287                 return -EINVAL;
12288
12289         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
12290                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
12291                         return -EINVAL;
12292                 new_triggers.gtk_rekey_failure = true;
12293                 regular = true;
12294         }
12295
12296         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
12297                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
12298                         return -EINVAL;
12299                 new_triggers.eap_identity_req = true;
12300                 regular = true;
12301         }
12302
12303         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
12304                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
12305                         return -EINVAL;
12306                 new_triggers.four_way_handshake = true;
12307                 regular = true;
12308         }
12309
12310         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
12311                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
12312                         return -EINVAL;
12313                 new_triggers.rfkill_release = true;
12314                 regular = true;
12315         }
12316
12317         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
12318                 struct nlattr *pat;
12319                 int n_patterns = 0;
12320                 int rem, pat_len, mask_len, pkt_offset;
12321                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
12322
12323                 regular = true;
12324
12325                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
12326                                     rem)
12327                         n_patterns++;
12328                 if (n_patterns > wowlan->n_patterns)
12329                         return -EINVAL;
12330
12331                 new_triggers.patterns = kcalloc(n_patterns,
12332                                                 sizeof(new_triggers.patterns[0]),
12333                                                 GFP_KERNEL);
12334                 if (!new_triggers.patterns)
12335                         return -ENOMEM;
12336
12337                 new_triggers.n_patterns = n_patterns;
12338                 i = 0;
12339
12340                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
12341                                     rem) {
12342                         u8 *mask_pat;
12343
12344                         err = nla_parse_nested_deprecated(pat_tb,
12345                                                           MAX_NL80211_PKTPAT,
12346                                                           pat,
12347                                                           nl80211_packet_pattern_policy,
12348                                                           info->extack);
12349                         if (err)
12350                                 goto error;
12351
12352                         err = -EINVAL;
12353                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
12354                             !pat_tb[NL80211_PKTPAT_PATTERN])
12355                                 goto error;
12356                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
12357                         mask_len = DIV_ROUND_UP(pat_len, 8);
12358                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
12359                                 goto error;
12360                         if (pat_len > wowlan->pattern_max_len ||
12361                             pat_len < wowlan->pattern_min_len)
12362                                 goto error;
12363
12364                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
12365                                 pkt_offset = 0;
12366                         else
12367                                 pkt_offset = nla_get_u32(
12368                                         pat_tb[NL80211_PKTPAT_OFFSET]);
12369                         if (pkt_offset > wowlan->max_pkt_offset)
12370                                 goto error;
12371                         new_triggers.patterns[i].pkt_offset = pkt_offset;
12372
12373                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
12374                         if (!mask_pat) {
12375                                 err = -ENOMEM;
12376                                 goto error;
12377                         }
12378                         new_triggers.patterns[i].mask = mask_pat;
12379                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
12380                                mask_len);
12381                         mask_pat += mask_len;
12382                         new_triggers.patterns[i].pattern = mask_pat;
12383                         new_triggers.patterns[i].pattern_len = pat_len;
12384                         memcpy(mask_pat,
12385                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
12386                                pat_len);
12387                         i++;
12388                 }
12389         }
12390
12391         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
12392                 regular = true;
12393                 err = nl80211_parse_wowlan_tcp(
12394                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
12395                         &new_triggers);
12396                 if (err)
12397                         goto error;
12398         }
12399
12400         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
12401                 regular = true;
12402                 err = nl80211_parse_wowlan_nd(
12403                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
12404                         &new_triggers);
12405                 if (err)
12406                         goto error;
12407         }
12408
12409         /* The 'any' trigger means the device continues operating more or less
12410          * as in its normal operation mode and wakes up the host on most of the
12411          * normal interrupts (like packet RX, ...)
12412          * It therefore makes little sense to combine with the more constrained
12413          * wakeup trigger modes.
12414          */
12415         if (new_triggers.any && regular) {
12416                 err = -EINVAL;
12417                 goto error;
12418         }
12419
12420         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
12421         if (!ntrig) {
12422                 err = -ENOMEM;
12423                 goto error;
12424         }
12425         cfg80211_rdev_free_wowlan(rdev);
12426         rdev->wiphy.wowlan_config = ntrig;
12427
12428  set_wakeup:
12429         if (rdev->ops->set_wakeup &&
12430             prev_enabled != !!rdev->wiphy.wowlan_config)
12431                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
12432
12433         return 0;
12434  error:
12435         for (i = 0; i < new_triggers.n_patterns; i++)
12436                 kfree(new_triggers.patterns[i].mask);
12437         kfree(new_triggers.patterns);
12438         if (new_triggers.tcp && new_triggers.tcp->sock)
12439                 sock_release(new_triggers.tcp->sock);
12440         kfree(new_triggers.tcp);
12441         kfree(new_triggers.nd_config);
12442         return err;
12443 }
12444 #endif
12445
12446 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
12447                                        struct cfg80211_registered_device *rdev)
12448 {
12449         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
12450         int i, j, pat_len;
12451         struct cfg80211_coalesce_rules *rule;
12452
12453         if (!rdev->coalesce->n_rules)
12454                 return 0;
12455
12456         nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE);
12457         if (!nl_rules)
12458                 return -ENOBUFS;
12459
12460         for (i = 0; i < rdev->coalesce->n_rules; i++) {
12461                 nl_rule = nla_nest_start_noflag(msg, i + 1);
12462                 if (!nl_rule)
12463                         return -ENOBUFS;
12464
12465                 rule = &rdev->coalesce->rules[i];
12466                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
12467                                 rule->delay))
12468                         return -ENOBUFS;
12469
12470                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
12471                                 rule->condition))
12472                         return -ENOBUFS;
12473
12474                 nl_pats = nla_nest_start_noflag(msg,
12475                                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
12476                 if (!nl_pats)
12477                         return -ENOBUFS;
12478
12479                 for (j = 0; j < rule->n_patterns; j++) {
12480                         nl_pat = nla_nest_start_noflag(msg, j + 1);
12481                         if (!nl_pat)
12482                                 return -ENOBUFS;
12483                         pat_len = rule->patterns[j].pattern_len;
12484                         if (nla_put(msg, NL80211_PKTPAT_MASK,
12485                                     DIV_ROUND_UP(pat_len, 8),
12486                                     rule->patterns[j].mask) ||
12487                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
12488                                     rule->patterns[j].pattern) ||
12489                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
12490                                         rule->patterns[j].pkt_offset))
12491                                 return -ENOBUFS;
12492                         nla_nest_end(msg, nl_pat);
12493                 }
12494                 nla_nest_end(msg, nl_pats);
12495                 nla_nest_end(msg, nl_rule);
12496         }
12497         nla_nest_end(msg, nl_rules);
12498
12499         return 0;
12500 }
12501
12502 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
12503 {
12504         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12505         struct sk_buff *msg;
12506         void *hdr;
12507
12508         if (!rdev->wiphy.coalesce)
12509                 return -EOPNOTSUPP;
12510
12511         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12512         if (!msg)
12513                 return -ENOMEM;
12514
12515         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12516                              NL80211_CMD_GET_COALESCE);
12517         if (!hdr)
12518                 goto nla_put_failure;
12519
12520         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
12521                 goto nla_put_failure;
12522
12523         genlmsg_end(msg, hdr);
12524         return genlmsg_reply(msg, info);
12525
12526 nla_put_failure:
12527         nlmsg_free(msg);
12528         return -ENOBUFS;
12529 }
12530
12531 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
12532 {
12533         struct cfg80211_coalesce *coalesce = rdev->coalesce;
12534         int i, j;
12535         struct cfg80211_coalesce_rules *rule;
12536
12537         if (!coalesce)
12538                 return;
12539
12540         for (i = 0; i < coalesce->n_rules; i++) {
12541                 rule = &coalesce->rules[i];
12542                 for (j = 0; j < rule->n_patterns; j++)
12543                         kfree(rule->patterns[j].mask);
12544                 kfree(rule->patterns);
12545         }
12546         kfree(coalesce->rules);
12547         kfree(coalesce);
12548         rdev->coalesce = NULL;
12549 }
12550
12551 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
12552                                        struct nlattr *rule,
12553                                        struct cfg80211_coalesce_rules *new_rule)
12554 {
12555         int err, i;
12556         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
12557         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
12558         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
12559         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
12560
12561         err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX,
12562                                           rule, nl80211_coalesce_policy, NULL);
12563         if (err)
12564                 return err;
12565
12566         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
12567                 new_rule->delay =
12568                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
12569         if (new_rule->delay > coalesce->max_delay)
12570                 return -EINVAL;
12571
12572         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
12573                 new_rule->condition =
12574                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
12575
12576         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
12577                 return -EINVAL;
12578
12579         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
12580                             rem)
12581                 n_patterns++;
12582         if (n_patterns > coalesce->n_patterns)
12583                 return -EINVAL;
12584
12585         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
12586                                      GFP_KERNEL);
12587         if (!new_rule->patterns)
12588                 return -ENOMEM;
12589
12590         new_rule->n_patterns = n_patterns;
12591         i = 0;
12592
12593         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
12594                             rem) {
12595                 u8 *mask_pat;
12596
12597                 err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT,
12598                                                   pat,
12599                                                   nl80211_packet_pattern_policy,
12600                                                   NULL);
12601                 if (err)
12602                         return err;
12603
12604                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
12605                     !pat_tb[NL80211_PKTPAT_PATTERN])
12606                         return -EINVAL;
12607                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
12608                 mask_len = DIV_ROUND_UP(pat_len, 8);
12609                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
12610                         return -EINVAL;
12611                 if (pat_len > coalesce->pattern_max_len ||
12612                     pat_len < coalesce->pattern_min_len)
12613                         return -EINVAL;
12614
12615                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
12616                         pkt_offset = 0;
12617                 else
12618                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
12619                 if (pkt_offset > coalesce->max_pkt_offset)
12620                         return -EINVAL;
12621                 new_rule->patterns[i].pkt_offset = pkt_offset;
12622
12623                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
12624                 if (!mask_pat)
12625                         return -ENOMEM;
12626
12627                 new_rule->patterns[i].mask = mask_pat;
12628                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
12629                        mask_len);
12630
12631                 mask_pat += mask_len;
12632                 new_rule->patterns[i].pattern = mask_pat;
12633                 new_rule->patterns[i].pattern_len = pat_len;
12634                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
12635                        pat_len);
12636                 i++;
12637         }
12638
12639         return 0;
12640 }
12641
12642 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
12643 {
12644         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12645         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
12646         struct cfg80211_coalesce new_coalesce = {};
12647         struct cfg80211_coalesce *n_coalesce;
12648         int err, rem_rule, n_rules = 0, i, j;
12649         struct nlattr *rule;
12650         struct cfg80211_coalesce_rules *tmp_rule;
12651
12652         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
12653                 return -EOPNOTSUPP;
12654
12655         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
12656                 cfg80211_rdev_free_coalesce(rdev);
12657                 rdev_set_coalesce(rdev, NULL);
12658                 return 0;
12659         }
12660
12661         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
12662                             rem_rule)
12663                 n_rules++;
12664         if (n_rules > coalesce->n_rules)
12665                 return -EINVAL;
12666
12667         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
12668                                      GFP_KERNEL);
12669         if (!new_coalesce.rules)
12670                 return -ENOMEM;
12671
12672         new_coalesce.n_rules = n_rules;
12673         i = 0;
12674
12675         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
12676                             rem_rule) {
12677                 err = nl80211_parse_coalesce_rule(rdev, rule,
12678                                                   &new_coalesce.rules[i]);
12679                 if (err)
12680                         goto error;
12681
12682                 i++;
12683         }
12684
12685         err = rdev_set_coalesce(rdev, &new_coalesce);
12686         if (err)
12687                 goto error;
12688
12689         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
12690         if (!n_coalesce) {
12691                 err = -ENOMEM;
12692                 goto error;
12693         }
12694         cfg80211_rdev_free_coalesce(rdev);
12695         rdev->coalesce = n_coalesce;
12696
12697         return 0;
12698 error:
12699         for (i = 0; i < new_coalesce.n_rules; i++) {
12700                 tmp_rule = &new_coalesce.rules[i];
12701                 for (j = 0; j < tmp_rule->n_patterns; j++)
12702                         kfree(tmp_rule->patterns[j].mask);
12703                 kfree(tmp_rule->patterns);
12704         }
12705         kfree(new_coalesce.rules);
12706
12707         return err;
12708 }
12709
12710 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
12711 {
12712         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12713         struct net_device *dev = info->user_ptr[1];
12714         struct wireless_dev *wdev = dev->ieee80211_ptr;
12715         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
12716         struct cfg80211_gtk_rekey_data rekey_data = {};
12717         int err;
12718
12719         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
12720                 return -EINVAL;
12721
12722         err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA,
12723                                           info->attrs[NL80211_ATTR_REKEY_DATA],
12724                                           nl80211_rekey_policy, info->extack);
12725         if (err)
12726                 return err;
12727
12728         if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
12729             !tb[NL80211_REKEY_DATA_KCK])
12730                 return -EINVAL;
12731         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN &&
12732             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
12733               nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KEK_EXT_LEN))
12734                 return -ERANGE;
12735         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN &&
12736             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
12737               nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KCK_EXT_LEN))
12738                 return -ERANGE;
12739
12740         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
12741         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
12742         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
12743         rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]);
12744         rekey_data.kck_len = nla_len(tb[NL80211_REKEY_DATA_KCK]);
12745         if (tb[NL80211_REKEY_DATA_AKM])
12746                 rekey_data.akm = nla_get_u32(tb[NL80211_REKEY_DATA_AKM]);
12747
12748         wdev_lock(wdev);
12749         if (!wdev->current_bss) {
12750                 err = -ENOTCONN;
12751                 goto out;
12752         }
12753
12754         if (!rdev->ops->set_rekey_data) {
12755                 err = -EOPNOTSUPP;
12756                 goto out;
12757         }
12758
12759         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
12760  out:
12761         wdev_unlock(wdev);
12762         return err;
12763 }
12764
12765 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
12766                                              struct genl_info *info)
12767 {
12768         struct net_device *dev = info->user_ptr[1];
12769         struct wireless_dev *wdev = dev->ieee80211_ptr;
12770
12771         if (wdev->iftype != NL80211_IFTYPE_AP &&
12772             wdev->iftype != NL80211_IFTYPE_P2P_GO)
12773                 return -EINVAL;
12774
12775         if (wdev->ap_unexpected_nlportid)
12776                 return -EBUSY;
12777
12778         wdev->ap_unexpected_nlportid = info->snd_portid;
12779         return 0;
12780 }
12781
12782 static int nl80211_probe_client(struct sk_buff *skb,
12783                                 struct genl_info *info)
12784 {
12785         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12786         struct net_device *dev = info->user_ptr[1];
12787         struct wireless_dev *wdev = dev->ieee80211_ptr;
12788         struct sk_buff *msg;
12789         void *hdr;
12790         const u8 *addr;
12791         u64 cookie;
12792         int err;
12793
12794         if (wdev->iftype != NL80211_IFTYPE_AP &&
12795             wdev->iftype != NL80211_IFTYPE_P2P_GO)
12796                 return -EOPNOTSUPP;
12797
12798         if (!info->attrs[NL80211_ATTR_MAC])
12799                 return -EINVAL;
12800
12801         if (!rdev->ops->probe_client)
12802                 return -EOPNOTSUPP;
12803
12804         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12805         if (!msg)
12806                 return -ENOMEM;
12807
12808         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12809                              NL80211_CMD_PROBE_CLIENT);
12810         if (!hdr) {
12811                 err = -ENOBUFS;
12812                 goto free_msg;
12813         }
12814
12815         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12816
12817         err = rdev_probe_client(rdev, dev, addr, &cookie);
12818         if (err)
12819                 goto free_msg;
12820
12821         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12822                               NL80211_ATTR_PAD))
12823                 goto nla_put_failure;
12824
12825         genlmsg_end(msg, hdr);
12826
12827         return genlmsg_reply(msg, info);
12828
12829  nla_put_failure:
12830         err = -ENOBUFS;
12831  free_msg:
12832         nlmsg_free(msg);
12833         return err;
12834 }
12835
12836 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
12837 {
12838         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12839         struct cfg80211_beacon_registration *reg, *nreg;
12840         int rv;
12841
12842         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
12843                 return -EOPNOTSUPP;
12844
12845         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
12846         if (!nreg)
12847                 return -ENOMEM;
12848
12849         /* First, check if already registered. */
12850         spin_lock_bh(&rdev->beacon_registrations_lock);
12851         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
12852                 if (reg->nlportid == info->snd_portid) {
12853                         rv = -EALREADY;
12854                         goto out_err;
12855                 }
12856         }
12857         /* Add it to the list */
12858         nreg->nlportid = info->snd_portid;
12859         list_add(&nreg->list, &rdev->beacon_registrations);
12860
12861         spin_unlock_bh(&rdev->beacon_registrations_lock);
12862
12863         return 0;
12864 out_err:
12865         spin_unlock_bh(&rdev->beacon_registrations_lock);
12866         kfree(nreg);
12867         return rv;
12868 }
12869
12870 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
12871 {
12872         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12873         struct wireless_dev *wdev = info->user_ptr[1];
12874         int err;
12875
12876         if (!rdev->ops->start_p2p_device)
12877                 return -EOPNOTSUPP;
12878
12879         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
12880                 return -EOPNOTSUPP;
12881
12882         if (wdev_running(wdev))
12883                 return 0;
12884
12885         if (rfkill_blocked(rdev->rfkill))
12886                 return -ERFKILL;
12887
12888         err = rdev_start_p2p_device(rdev, wdev);
12889         if (err)
12890                 return err;
12891
12892         wdev->is_running = true;
12893         rdev->opencount++;
12894
12895         return 0;
12896 }
12897
12898 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
12899 {
12900         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12901         struct wireless_dev *wdev = info->user_ptr[1];
12902
12903         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
12904                 return -EOPNOTSUPP;
12905
12906         if (!rdev->ops->stop_p2p_device)
12907                 return -EOPNOTSUPP;
12908
12909         cfg80211_stop_p2p_device(rdev, wdev);
12910
12911         return 0;
12912 }
12913
12914 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
12915 {
12916         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12917         struct wireless_dev *wdev = info->user_ptr[1];
12918         struct cfg80211_nan_conf conf = {};
12919         int err;
12920
12921         if (wdev->iftype != NL80211_IFTYPE_NAN)
12922                 return -EOPNOTSUPP;
12923
12924         if (wdev_running(wdev))
12925                 return -EEXIST;
12926
12927         if (rfkill_blocked(rdev->rfkill))
12928                 return -ERFKILL;
12929
12930         if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
12931                 return -EINVAL;
12932
12933         conf.master_pref =
12934                 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
12935
12936         if (info->attrs[NL80211_ATTR_BANDS]) {
12937                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
12938
12939                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
12940                         return -EOPNOTSUPP;
12941
12942                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
12943                         return -EINVAL;
12944
12945                 conf.bands = bands;
12946         }
12947
12948         err = rdev_start_nan(rdev, wdev, &conf);
12949         if (err)
12950                 return err;
12951
12952         wdev->is_running = true;
12953         rdev->opencount++;
12954
12955         return 0;
12956 }
12957
12958 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
12959 {
12960         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12961         struct wireless_dev *wdev = info->user_ptr[1];
12962
12963         if (wdev->iftype != NL80211_IFTYPE_NAN)
12964                 return -EOPNOTSUPP;
12965
12966         cfg80211_stop_nan(rdev, wdev);
12967
12968         return 0;
12969 }
12970
12971 static int validate_nan_filter(struct nlattr *filter_attr)
12972 {
12973         struct nlattr *attr;
12974         int len = 0, n_entries = 0, rem;
12975
12976         nla_for_each_nested(attr, filter_attr, rem) {
12977                 len += nla_len(attr);
12978                 n_entries++;
12979         }
12980
12981         if (len >= U8_MAX)
12982                 return -EINVAL;
12983
12984         return n_entries;
12985 }
12986
12987 static int handle_nan_filter(struct nlattr *attr_filter,
12988                              struct cfg80211_nan_func *func,
12989                              bool tx)
12990 {
12991         struct nlattr *attr;
12992         int n_entries, rem, i;
12993         struct cfg80211_nan_func_filter *filter;
12994
12995         n_entries = validate_nan_filter(attr_filter);
12996         if (n_entries < 0)
12997                 return n_entries;
12998
12999         BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
13000
13001         filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
13002         if (!filter)
13003                 return -ENOMEM;
13004
13005         i = 0;
13006         nla_for_each_nested(attr, attr_filter, rem) {
13007                 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
13008                 filter[i].len = nla_len(attr);
13009                 i++;
13010         }
13011         if (tx) {
13012                 func->num_tx_filters = n_entries;
13013                 func->tx_filters = filter;
13014         } else {
13015                 func->num_rx_filters = n_entries;
13016                 func->rx_filters = filter;
13017         }
13018
13019         return 0;
13020 }
13021
13022 static int nl80211_nan_add_func(struct sk_buff *skb,
13023                                 struct genl_info *info)
13024 {
13025         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13026         struct wireless_dev *wdev = info->user_ptr[1];
13027         struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
13028         struct cfg80211_nan_func *func;
13029         struct sk_buff *msg = NULL;
13030         void *hdr = NULL;
13031         int err = 0;
13032
13033         if (wdev->iftype != NL80211_IFTYPE_NAN)
13034                 return -EOPNOTSUPP;
13035
13036         if (!wdev_running(wdev))
13037                 return -ENOTCONN;
13038
13039         if (!info->attrs[NL80211_ATTR_NAN_FUNC])
13040                 return -EINVAL;
13041
13042         err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX,
13043                                           info->attrs[NL80211_ATTR_NAN_FUNC],
13044                                           nl80211_nan_func_policy,
13045                                           info->extack);
13046         if (err)
13047                 return err;
13048
13049         func = kzalloc(sizeof(*func), GFP_KERNEL);
13050         if (!func)
13051                 return -ENOMEM;
13052
13053         func->cookie = cfg80211_assign_cookie(rdev);
13054
13055         if (!tb[NL80211_NAN_FUNC_TYPE]) {
13056                 err = -EINVAL;
13057                 goto out;
13058         }
13059
13060
13061         func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
13062
13063         if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
13064                 err = -EINVAL;
13065                 goto out;
13066         }
13067
13068         memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
13069                sizeof(func->service_id));
13070
13071         func->close_range =
13072                 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
13073
13074         if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
13075                 func->serv_spec_info_len =
13076                         nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
13077                 func->serv_spec_info =
13078                         kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
13079                                 func->serv_spec_info_len,
13080                                 GFP_KERNEL);
13081                 if (!func->serv_spec_info) {
13082                         err = -ENOMEM;
13083                         goto out;
13084                 }
13085         }
13086
13087         if (tb[NL80211_NAN_FUNC_TTL])
13088                 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
13089
13090         switch (func->type) {
13091         case NL80211_NAN_FUNC_PUBLISH:
13092                 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
13093                         err = -EINVAL;
13094                         goto out;
13095                 }
13096
13097                 func->publish_type =
13098                         nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
13099                 func->publish_bcast =
13100                         nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
13101
13102                 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
13103                         func->publish_bcast) {
13104                         err = -EINVAL;
13105                         goto out;
13106                 }
13107                 break;
13108         case NL80211_NAN_FUNC_SUBSCRIBE:
13109                 func->subscribe_active =
13110                         nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
13111                 break;
13112         case NL80211_NAN_FUNC_FOLLOW_UP:
13113                 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
13114                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
13115                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
13116                         err = -EINVAL;
13117                         goto out;
13118                 }
13119
13120                 func->followup_id =
13121                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
13122                 func->followup_reqid =
13123                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
13124                 memcpy(func->followup_dest.addr,
13125                        nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
13126                        sizeof(func->followup_dest.addr));
13127                 if (func->ttl) {
13128                         err = -EINVAL;
13129                         goto out;
13130                 }
13131                 break;
13132         default:
13133                 err = -EINVAL;
13134                 goto out;
13135         }
13136
13137         if (tb[NL80211_NAN_FUNC_SRF]) {
13138                 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
13139
13140                 err = nla_parse_nested_deprecated(srf_tb,
13141                                                   NL80211_NAN_SRF_ATTR_MAX,
13142                                                   tb[NL80211_NAN_FUNC_SRF],
13143                                                   nl80211_nan_srf_policy,
13144                                                   info->extack);
13145                 if (err)
13146                         goto out;
13147
13148                 func->srf_include =
13149                         nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
13150
13151                 if (srf_tb[NL80211_NAN_SRF_BF]) {
13152                         if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
13153                             !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
13154                                 err = -EINVAL;
13155                                 goto out;
13156                         }
13157
13158                         func->srf_bf_len =
13159                                 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
13160                         func->srf_bf =
13161                                 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
13162                                         func->srf_bf_len, GFP_KERNEL);
13163                         if (!func->srf_bf) {
13164                                 err = -ENOMEM;
13165                                 goto out;
13166                         }
13167
13168                         func->srf_bf_idx =
13169                                 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
13170                 } else {
13171                         struct nlattr *attr, *mac_attr =
13172                                 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
13173                         int n_entries, rem, i = 0;
13174
13175                         if (!mac_attr) {
13176                                 err = -EINVAL;
13177                                 goto out;
13178                         }
13179
13180                         n_entries = validate_acl_mac_addrs(mac_attr);
13181                         if (n_entries <= 0) {
13182                                 err = -EINVAL;
13183                                 goto out;
13184                         }
13185
13186                         func->srf_num_macs = n_entries;
13187                         func->srf_macs =
13188                                 kcalloc(n_entries, sizeof(*func->srf_macs),
13189                                         GFP_KERNEL);
13190                         if (!func->srf_macs) {
13191                                 err = -ENOMEM;
13192                                 goto out;
13193                         }
13194
13195                         nla_for_each_nested(attr, mac_attr, rem)
13196                                 memcpy(func->srf_macs[i++].addr, nla_data(attr),
13197                                        sizeof(*func->srf_macs));
13198                 }
13199         }
13200
13201         if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
13202                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
13203                                         func, true);
13204                 if (err)
13205                         goto out;
13206         }
13207
13208         if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
13209                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
13210                                         func, false);
13211                 if (err)
13212                         goto out;
13213         }
13214
13215         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13216         if (!msg) {
13217                 err = -ENOMEM;
13218                 goto out;
13219         }
13220
13221         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13222                              NL80211_CMD_ADD_NAN_FUNCTION);
13223         /* This can't really happen - we just allocated 4KB */
13224         if (WARN_ON(!hdr)) {
13225                 err = -ENOMEM;
13226                 goto out;
13227         }
13228
13229         err = rdev_add_nan_func(rdev, wdev, func);
13230 out:
13231         if (err < 0) {
13232                 cfg80211_free_nan_func(func);
13233                 nlmsg_free(msg);
13234                 return err;
13235         }
13236
13237         /* propagate the instance id and cookie to userspace  */
13238         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
13239                               NL80211_ATTR_PAD))
13240                 goto nla_put_failure;
13241
13242         func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
13243         if (!func_attr)
13244                 goto nla_put_failure;
13245
13246         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
13247                        func->instance_id))
13248                 goto nla_put_failure;
13249
13250         nla_nest_end(msg, func_attr);
13251
13252         genlmsg_end(msg, hdr);
13253         return genlmsg_reply(msg, info);
13254
13255 nla_put_failure:
13256         nlmsg_free(msg);
13257         return -ENOBUFS;
13258 }
13259
13260 static int nl80211_nan_del_func(struct sk_buff *skb,
13261                                struct genl_info *info)
13262 {
13263         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13264         struct wireless_dev *wdev = info->user_ptr[1];
13265         u64 cookie;
13266
13267         if (wdev->iftype != NL80211_IFTYPE_NAN)
13268                 return -EOPNOTSUPP;
13269
13270         if (!wdev_running(wdev))
13271                 return -ENOTCONN;
13272
13273         if (!info->attrs[NL80211_ATTR_COOKIE])
13274                 return -EINVAL;
13275
13276         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
13277
13278         rdev_del_nan_func(rdev, wdev, cookie);
13279
13280         return 0;
13281 }
13282
13283 static int nl80211_nan_change_config(struct sk_buff *skb,
13284                                      struct genl_info *info)
13285 {
13286         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13287         struct wireless_dev *wdev = info->user_ptr[1];
13288         struct cfg80211_nan_conf conf = {};
13289         u32 changed = 0;
13290
13291         if (wdev->iftype != NL80211_IFTYPE_NAN)
13292                 return -EOPNOTSUPP;
13293
13294         if (!wdev_running(wdev))
13295                 return -ENOTCONN;
13296
13297         if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
13298                 conf.master_pref =
13299                         nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
13300                 if (conf.master_pref <= 1 || conf.master_pref == 255)
13301                         return -EINVAL;
13302
13303                 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
13304         }
13305
13306         if (info->attrs[NL80211_ATTR_BANDS]) {
13307                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
13308
13309                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
13310                         return -EOPNOTSUPP;
13311
13312                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
13313                         return -EINVAL;
13314
13315                 conf.bands = bands;
13316                 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
13317         }
13318
13319         if (!changed)
13320                 return -EINVAL;
13321
13322         return rdev_nan_change_conf(rdev, wdev, &conf, changed);
13323 }
13324
13325 void cfg80211_nan_match(struct wireless_dev *wdev,
13326                         struct cfg80211_nan_match_params *match, gfp_t gfp)
13327 {
13328         struct wiphy *wiphy = wdev->wiphy;
13329         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13330         struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
13331         struct sk_buff *msg;
13332         void *hdr;
13333
13334         if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
13335                 return;
13336
13337         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13338         if (!msg)
13339                 return;
13340
13341         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
13342         if (!hdr) {
13343                 nlmsg_free(msg);
13344                 return;
13345         }
13346
13347         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13348             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13349                                          wdev->netdev->ifindex)) ||
13350             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13351                               NL80211_ATTR_PAD))
13352                 goto nla_put_failure;
13353
13354         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
13355                               NL80211_ATTR_PAD) ||
13356             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
13357                 goto nla_put_failure;
13358
13359         match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH);
13360         if (!match_attr)
13361                 goto nla_put_failure;
13362
13363         local_func_attr = nla_nest_start_noflag(msg,
13364                                                 NL80211_NAN_MATCH_FUNC_LOCAL);
13365         if (!local_func_attr)
13366                 goto nla_put_failure;
13367
13368         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
13369                 goto nla_put_failure;
13370
13371         nla_nest_end(msg, local_func_attr);
13372
13373         peer_func_attr = nla_nest_start_noflag(msg,
13374                                                NL80211_NAN_MATCH_FUNC_PEER);
13375         if (!peer_func_attr)
13376                 goto nla_put_failure;
13377
13378         if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
13379             nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
13380                 goto nla_put_failure;
13381
13382         if (match->info && match->info_len &&
13383             nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
13384                     match->info))
13385                 goto nla_put_failure;
13386
13387         nla_nest_end(msg, peer_func_attr);
13388         nla_nest_end(msg, match_attr);
13389         genlmsg_end(msg, hdr);
13390
13391         if (!wdev->owner_nlportid)
13392                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
13393                                         msg, 0, NL80211_MCGRP_NAN, gfp);
13394         else
13395                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
13396                                 wdev->owner_nlportid);
13397
13398         return;
13399
13400 nla_put_failure:
13401         nlmsg_free(msg);
13402 }
13403 EXPORT_SYMBOL(cfg80211_nan_match);
13404
13405 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
13406                                   u8 inst_id,
13407                                   enum nl80211_nan_func_term_reason reason,
13408                                   u64 cookie, gfp_t gfp)
13409 {
13410         struct wiphy *wiphy = wdev->wiphy;
13411         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13412         struct sk_buff *msg;
13413         struct nlattr *func_attr;
13414         void *hdr;
13415
13416         if (WARN_ON(!inst_id))
13417                 return;
13418
13419         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13420         if (!msg)
13421                 return;
13422
13423         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
13424         if (!hdr) {
13425                 nlmsg_free(msg);
13426                 return;
13427         }
13428
13429         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13430             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13431                                          wdev->netdev->ifindex)) ||
13432             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13433                               NL80211_ATTR_PAD))
13434                 goto nla_put_failure;
13435
13436         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
13437                               NL80211_ATTR_PAD))
13438                 goto nla_put_failure;
13439
13440         func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
13441         if (!func_attr)
13442                 goto nla_put_failure;
13443
13444         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
13445             nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
13446                 goto nla_put_failure;
13447
13448         nla_nest_end(msg, func_attr);
13449         genlmsg_end(msg, hdr);
13450
13451         if (!wdev->owner_nlportid)
13452                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
13453                                         msg, 0, NL80211_MCGRP_NAN, gfp);
13454         else
13455                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
13456                                 wdev->owner_nlportid);
13457
13458         return;
13459
13460 nla_put_failure:
13461         nlmsg_free(msg);
13462 }
13463 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
13464
13465 static int nl80211_get_protocol_features(struct sk_buff *skb,
13466                                          struct genl_info *info)
13467 {
13468         void *hdr;
13469         struct sk_buff *msg;
13470
13471         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13472         if (!msg)
13473                 return -ENOMEM;
13474
13475         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13476                              NL80211_CMD_GET_PROTOCOL_FEATURES);
13477         if (!hdr)
13478                 goto nla_put_failure;
13479
13480         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
13481                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
13482                 goto nla_put_failure;
13483
13484         genlmsg_end(msg, hdr);
13485         return genlmsg_reply(msg, info);
13486
13487  nla_put_failure:
13488         kfree_skb(msg);
13489         return -ENOBUFS;
13490 }
13491
13492 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
13493 {
13494         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13495         struct cfg80211_update_ft_ies_params ft_params;
13496         struct net_device *dev = info->user_ptr[1];
13497
13498         if (!rdev->ops->update_ft_ies)
13499                 return -EOPNOTSUPP;
13500
13501         if (!info->attrs[NL80211_ATTR_MDID] ||
13502             !info->attrs[NL80211_ATTR_IE])
13503                 return -EINVAL;
13504
13505         memset(&ft_params, 0, sizeof(ft_params));
13506         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
13507         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
13508         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
13509
13510         return rdev_update_ft_ies(rdev, dev, &ft_params);
13511 }
13512
13513 static int nl80211_crit_protocol_start(struct sk_buff *skb,
13514                                        struct genl_info *info)
13515 {
13516         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13517         struct wireless_dev *wdev = info->user_ptr[1];
13518         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
13519         u16 duration;
13520         int ret;
13521
13522         if (!rdev->ops->crit_proto_start)
13523                 return -EOPNOTSUPP;
13524
13525         if (WARN_ON(!rdev->ops->crit_proto_stop))
13526                 return -EINVAL;
13527
13528         if (rdev->crit_proto_nlportid)
13529                 return -EBUSY;
13530
13531         /* determine protocol if provided */
13532         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
13533                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
13534
13535         if (proto >= NUM_NL80211_CRIT_PROTO)
13536                 return -EINVAL;
13537
13538         /* timeout must be provided */
13539         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
13540                 return -EINVAL;
13541
13542         duration =
13543                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
13544
13545         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
13546         if (!ret)
13547                 rdev->crit_proto_nlportid = info->snd_portid;
13548
13549         return ret;
13550 }
13551
13552 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
13553                                       struct genl_info *info)
13554 {
13555         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13556         struct wireless_dev *wdev = info->user_ptr[1];
13557
13558         if (!rdev->ops->crit_proto_stop)
13559                 return -EOPNOTSUPP;
13560
13561         if (rdev->crit_proto_nlportid) {
13562                 rdev->crit_proto_nlportid = 0;
13563                 rdev_crit_proto_stop(rdev, wdev);
13564         }
13565         return 0;
13566 }
13567
13568 static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd,
13569                                        struct nlattr *attr,
13570                                        struct netlink_ext_ack *extack)
13571 {
13572         if (vcmd->policy == VENDOR_CMD_RAW_DATA) {
13573                 if (attr->nla_type & NLA_F_NESTED) {
13574                         NL_SET_ERR_MSG_ATTR(extack, attr,
13575                                             "unexpected nested data");
13576                         return -EINVAL;
13577                 }
13578
13579                 return 0;
13580         }
13581
13582         if (!(attr->nla_type & NLA_F_NESTED)) {
13583                 NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data");
13584                 return -EINVAL;
13585         }
13586
13587         return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack);
13588 }
13589
13590 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
13591 {
13592         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13593         struct wireless_dev *wdev =
13594                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
13595         int i, err;
13596         u32 vid, subcmd;
13597
13598         if (!rdev->wiphy.vendor_commands)
13599                 return -EOPNOTSUPP;
13600
13601         if (IS_ERR(wdev)) {
13602                 err = PTR_ERR(wdev);
13603                 if (err != -EINVAL)
13604                         return err;
13605                 wdev = NULL;
13606         } else if (wdev->wiphy != &rdev->wiphy) {
13607                 return -EINVAL;
13608         }
13609
13610         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
13611             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
13612                 return -EINVAL;
13613
13614         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
13615         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
13616         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
13617                 const struct wiphy_vendor_command *vcmd;
13618                 void *data = NULL;
13619                 int len = 0;
13620
13621                 vcmd = &rdev->wiphy.vendor_commands[i];
13622
13623                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
13624                         continue;
13625
13626                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
13627                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
13628                         if (!wdev)
13629                                 return -EINVAL;
13630                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
13631                             !wdev->netdev)
13632                                 return -EINVAL;
13633
13634                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
13635                                 if (!wdev_running(wdev))
13636                                         return -ENETDOWN;
13637                         }
13638                 } else {
13639                         wdev = NULL;
13640                 }
13641
13642                 if (!vcmd->doit)
13643                         return -EOPNOTSUPP;
13644
13645                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
13646                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
13647                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
13648
13649                         err = nl80211_vendor_check_policy(vcmd,
13650                                         info->attrs[NL80211_ATTR_VENDOR_DATA],
13651                                         info->extack);
13652                         if (err)
13653                                 return err;
13654                 }
13655
13656                 rdev->cur_cmd_info = info;
13657                 err = vcmd->doit(&rdev->wiphy, wdev, data, len);
13658                 rdev->cur_cmd_info = NULL;
13659                 return err;
13660         }
13661
13662         return -EOPNOTSUPP;
13663 }
13664
13665 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
13666                                        struct netlink_callback *cb,
13667                                        struct cfg80211_registered_device **rdev,
13668                                        struct wireless_dev **wdev)
13669 {
13670         struct nlattr **attrbuf;
13671         u32 vid, subcmd;
13672         unsigned int i;
13673         int vcmd_idx = -1;
13674         int err;
13675         void *data = NULL;
13676         unsigned int data_len = 0;
13677
13678         if (cb->args[0]) {
13679                 /* subtract the 1 again here */
13680                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
13681                 struct wireless_dev *tmp;
13682
13683                 if (!wiphy)
13684                         return -ENODEV;
13685                 *rdev = wiphy_to_rdev(wiphy);
13686                 *wdev = NULL;
13687
13688                 if (cb->args[1]) {
13689                         list_for_each_entry(tmp, &wiphy->wdev_list, list) {
13690                                 if (tmp->identifier == cb->args[1] - 1) {
13691                                         *wdev = tmp;
13692                                         break;
13693                                 }
13694                         }
13695                 }
13696
13697                 /* keep rtnl locked in successful case */
13698                 return 0;
13699         }
13700
13701         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
13702         if (!attrbuf)
13703                 return -ENOMEM;
13704
13705         err = nlmsg_parse_deprecated(cb->nlh,
13706                                      GENL_HDRLEN + nl80211_fam.hdrsize,
13707                                      attrbuf, nl80211_fam.maxattr,
13708                                      nl80211_policy, NULL);
13709         if (err)
13710                 goto out;
13711
13712         if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
13713             !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
13714                 err = -EINVAL;
13715                 goto out;
13716         }
13717
13718         *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf);
13719         if (IS_ERR(*wdev))
13720                 *wdev = NULL;
13721
13722         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
13723         if (IS_ERR(*rdev)) {
13724                 err = PTR_ERR(*rdev);
13725                 goto out;
13726         }
13727
13728         vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
13729         subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
13730
13731         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
13732                 const struct wiphy_vendor_command *vcmd;
13733
13734                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
13735
13736                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
13737                         continue;
13738
13739                 if (!vcmd->dumpit) {
13740                         err = -EOPNOTSUPP;
13741                         goto out;
13742                 }
13743
13744                 vcmd_idx = i;
13745                 break;
13746         }
13747
13748         if (vcmd_idx < 0) {
13749                 err = -EOPNOTSUPP;
13750                 goto out;
13751         }
13752
13753         if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
13754                 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
13755                 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
13756
13757                 err = nl80211_vendor_check_policy(
13758                                 &(*rdev)->wiphy.vendor_commands[vcmd_idx],
13759                                 attrbuf[NL80211_ATTR_VENDOR_DATA],
13760                                 cb->extack);
13761                 if (err)
13762                         goto out;
13763         }
13764
13765         /* 0 is the first index - add 1 to parse only once */
13766         cb->args[0] = (*rdev)->wiphy_idx + 1;
13767         /* add 1 to know if it was NULL */
13768         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
13769         cb->args[2] = vcmd_idx;
13770         cb->args[3] = (unsigned long)data;
13771         cb->args[4] = data_len;
13772
13773         /* keep rtnl locked in successful case */
13774         err = 0;
13775 out:
13776         kfree(attrbuf);
13777         return err;
13778 }
13779
13780 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
13781                                    struct netlink_callback *cb)
13782 {
13783         struct cfg80211_registered_device *rdev;
13784         struct wireless_dev *wdev;
13785         unsigned int vcmd_idx;
13786         const struct wiphy_vendor_command *vcmd;
13787         void *data;
13788         int data_len;
13789         int err;
13790         struct nlattr *vendor_data;
13791
13792         rtnl_lock();
13793         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
13794         if (err)
13795                 goto out;
13796
13797         vcmd_idx = cb->args[2];
13798         data = (void *)cb->args[3];
13799         data_len = cb->args[4];
13800         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
13801
13802         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
13803                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
13804                 if (!wdev) {
13805                         err = -EINVAL;
13806                         goto out;
13807                 }
13808                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
13809                     !wdev->netdev) {
13810                         err = -EINVAL;
13811                         goto out;
13812                 }
13813
13814                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
13815                         if (!wdev_running(wdev)) {
13816                                 err = -ENETDOWN;
13817                                 goto out;
13818                         }
13819                 }
13820         }
13821
13822         while (1) {
13823                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
13824                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
13825                                            NL80211_CMD_VENDOR);
13826                 if (!hdr)
13827                         break;
13828
13829                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13830                     (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
13831                                                wdev_id(wdev),
13832                                                NL80211_ATTR_PAD))) {
13833                         genlmsg_cancel(skb, hdr);
13834                         break;
13835                 }
13836
13837                 vendor_data = nla_nest_start_noflag(skb,
13838                                                     NL80211_ATTR_VENDOR_DATA);
13839                 if (!vendor_data) {
13840                         genlmsg_cancel(skb, hdr);
13841                         break;
13842                 }
13843
13844                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
13845                                    (unsigned long *)&cb->args[5]);
13846                 nla_nest_end(skb, vendor_data);
13847
13848                 if (err == -ENOBUFS || err == -ENOENT) {
13849                         genlmsg_cancel(skb, hdr);
13850                         break;
13851                 } else if (err <= 0) {
13852                         genlmsg_cancel(skb, hdr);
13853                         goto out;
13854                 }
13855
13856                 genlmsg_end(skb, hdr);
13857         }
13858
13859         err = skb->len;
13860  out:
13861         rtnl_unlock();
13862         return err;
13863 }
13864
13865 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
13866                                            enum nl80211_commands cmd,
13867                                            enum nl80211_attrs attr,
13868                                            int approxlen)
13869 {
13870         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13871
13872         if (WARN_ON(!rdev->cur_cmd_info))
13873                 return NULL;
13874
13875         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
13876                                            rdev->cur_cmd_info->snd_portid,
13877                                            rdev->cur_cmd_info->snd_seq,
13878                                            cmd, attr, NULL, GFP_KERNEL);
13879 }
13880 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
13881
13882 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
13883 {
13884         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
13885         void *hdr = ((void **)skb->cb)[1];
13886         struct nlattr *data = ((void **)skb->cb)[2];
13887
13888         /* clear CB data for netlink core to own from now on */
13889         memset(skb->cb, 0, sizeof(skb->cb));
13890
13891         if (WARN_ON(!rdev->cur_cmd_info)) {
13892                 kfree_skb(skb);
13893                 return -EINVAL;
13894         }
13895
13896         nla_nest_end(skb, data);
13897         genlmsg_end(skb, hdr);
13898         return genlmsg_reply(skb, rdev->cur_cmd_info);
13899 }
13900 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
13901
13902 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy)
13903 {
13904         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13905
13906         if (WARN_ON(!rdev->cur_cmd_info))
13907                 return 0;
13908
13909         return rdev->cur_cmd_info->snd_portid;
13910 }
13911 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender);
13912
13913 static int nl80211_set_qos_map(struct sk_buff *skb,
13914                                struct genl_info *info)
13915 {
13916         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13917         struct cfg80211_qos_map *qos_map = NULL;
13918         struct net_device *dev = info->user_ptr[1];
13919         u8 *pos, len, num_des, des_len, des;
13920         int ret;
13921
13922         if (!rdev->ops->set_qos_map)
13923                 return -EOPNOTSUPP;
13924
13925         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
13926                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
13927                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
13928
13929                 if (len % 2)
13930                         return -EINVAL;
13931
13932                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
13933                 if (!qos_map)
13934                         return -ENOMEM;
13935
13936                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
13937                 if (num_des) {
13938                         des_len = num_des *
13939                                 sizeof(struct cfg80211_dscp_exception);
13940                         memcpy(qos_map->dscp_exception, pos, des_len);
13941                         qos_map->num_des = num_des;
13942                         for (des = 0; des < num_des; des++) {
13943                                 if (qos_map->dscp_exception[des].up > 7) {
13944                                         kfree(qos_map);
13945                                         return -EINVAL;
13946                                 }
13947                         }
13948                         pos += des_len;
13949                 }
13950                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
13951         }
13952
13953         wdev_lock(dev->ieee80211_ptr);
13954         ret = nl80211_key_allowed(dev->ieee80211_ptr);
13955         if (!ret)
13956                 ret = rdev_set_qos_map(rdev, dev, qos_map);
13957         wdev_unlock(dev->ieee80211_ptr);
13958
13959         kfree(qos_map);
13960         return ret;
13961 }
13962
13963 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
13964 {
13965         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13966         struct net_device *dev = info->user_ptr[1];
13967         struct wireless_dev *wdev = dev->ieee80211_ptr;
13968         const u8 *peer;
13969         u8 tsid, up;
13970         u16 admitted_time = 0;
13971         int err;
13972
13973         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
13974                 return -EOPNOTSUPP;
13975
13976         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
13977             !info->attrs[NL80211_ATTR_USER_PRIO])
13978                 return -EINVAL;
13979
13980         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
13981         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
13982
13983         /* WMM uses TIDs 0-7 even for TSPEC */
13984         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
13985                 /* TODO: handle 802.11 TSPEC/admission control
13986                  * need more attributes for that (e.g. BA session requirement);
13987                  * change the WMM adminssion test above to allow both then
13988                  */
13989                 return -EINVAL;
13990         }
13991
13992         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
13993
13994         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
13995                 admitted_time =
13996                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
13997                 if (!admitted_time)
13998                         return -EINVAL;
13999         }
14000
14001         wdev_lock(wdev);
14002         switch (wdev->iftype) {
14003         case NL80211_IFTYPE_STATION:
14004         case NL80211_IFTYPE_P2P_CLIENT:
14005                 if (wdev->current_bss)
14006                         break;
14007                 err = -ENOTCONN;
14008                 goto out;
14009         default:
14010                 err = -EOPNOTSUPP;
14011                 goto out;
14012         }
14013
14014         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
14015
14016  out:
14017         wdev_unlock(wdev);
14018         return err;
14019 }
14020
14021 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
14022 {
14023         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14024         struct net_device *dev = info->user_ptr[1];
14025         struct wireless_dev *wdev = dev->ieee80211_ptr;
14026         const u8 *peer;
14027         u8 tsid;
14028         int err;
14029
14030         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
14031                 return -EINVAL;
14032
14033         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
14034         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
14035
14036         wdev_lock(wdev);
14037         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
14038         wdev_unlock(wdev);
14039
14040         return err;
14041 }
14042
14043 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
14044                                        struct genl_info *info)
14045 {
14046         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14047         struct net_device *dev = info->user_ptr[1];
14048         struct wireless_dev *wdev = dev->ieee80211_ptr;
14049         struct cfg80211_chan_def chandef = {};
14050         const u8 *addr;
14051         u8 oper_class;
14052         int err;
14053
14054         if (!rdev->ops->tdls_channel_switch ||
14055             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
14056                 return -EOPNOTSUPP;
14057
14058         switch (dev->ieee80211_ptr->iftype) {
14059         case NL80211_IFTYPE_STATION:
14060         case NL80211_IFTYPE_P2P_CLIENT:
14061                 break;
14062         default:
14063                 return -EOPNOTSUPP;
14064         }
14065
14066         if (!info->attrs[NL80211_ATTR_MAC] ||
14067             !info->attrs[NL80211_ATTR_OPER_CLASS])
14068                 return -EINVAL;
14069
14070         err = nl80211_parse_chandef(rdev, info, &chandef);
14071         if (err)
14072                 return err;
14073
14074         /*
14075          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
14076          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
14077          * specification is not defined for them.
14078          */
14079         if (chandef.chan->band == NL80211_BAND_2GHZ &&
14080             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
14081             chandef.width != NL80211_CHAN_WIDTH_20)
14082                 return -EINVAL;
14083
14084         /* we will be active on the TDLS link */
14085         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
14086                                            wdev->iftype))
14087                 return -EINVAL;
14088
14089         /* don't allow switching to DFS channels */
14090         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
14091                 return -EINVAL;
14092
14093         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
14094         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
14095
14096         wdev_lock(wdev);
14097         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
14098         wdev_unlock(wdev);
14099
14100         return err;
14101 }
14102
14103 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
14104                                               struct genl_info *info)
14105 {
14106         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14107         struct net_device *dev = info->user_ptr[1];
14108         struct wireless_dev *wdev = dev->ieee80211_ptr;
14109         const u8 *addr;
14110
14111         if (!rdev->ops->tdls_channel_switch ||
14112             !rdev->ops->tdls_cancel_channel_switch ||
14113             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
14114                 return -EOPNOTSUPP;
14115
14116         switch (dev->ieee80211_ptr->iftype) {
14117         case NL80211_IFTYPE_STATION:
14118         case NL80211_IFTYPE_P2P_CLIENT:
14119                 break;
14120         default:
14121                 return -EOPNOTSUPP;
14122         }
14123
14124         if (!info->attrs[NL80211_ATTR_MAC])
14125                 return -EINVAL;
14126
14127         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
14128
14129         wdev_lock(wdev);
14130         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
14131         wdev_unlock(wdev);
14132
14133         return 0;
14134 }
14135
14136 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
14137                                             struct genl_info *info)
14138 {
14139         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14140         struct net_device *dev = info->user_ptr[1];
14141         struct wireless_dev *wdev = dev->ieee80211_ptr;
14142         const struct nlattr *nla;
14143         bool enabled;
14144
14145         if (!rdev->ops->set_multicast_to_unicast)
14146                 return -EOPNOTSUPP;
14147
14148         if (wdev->iftype != NL80211_IFTYPE_AP &&
14149             wdev->iftype != NL80211_IFTYPE_P2P_GO)
14150                 return -EOPNOTSUPP;
14151
14152         nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
14153         enabled = nla_get_flag(nla);
14154
14155         return rdev_set_multicast_to_unicast(rdev, dev, enabled);
14156 }
14157
14158 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
14159 {
14160         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14161         struct net_device *dev = info->user_ptr[1];
14162         struct wireless_dev *wdev = dev->ieee80211_ptr;
14163         struct cfg80211_pmk_conf pmk_conf = {};
14164         int ret;
14165
14166         if (wdev->iftype != NL80211_IFTYPE_STATION &&
14167             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
14168                 return -EOPNOTSUPP;
14169
14170         if (!wiphy_ext_feature_isset(&rdev->wiphy,
14171                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
14172                 return -EOPNOTSUPP;
14173
14174         if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
14175                 return -EINVAL;
14176
14177         wdev_lock(wdev);
14178         if (!wdev->current_bss) {
14179                 ret = -ENOTCONN;
14180                 goto out;
14181         }
14182
14183         pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
14184         if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) {
14185                 ret = -EINVAL;
14186                 goto out;
14187         }
14188
14189         pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
14190         pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
14191         if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
14192             pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
14193                 ret = -EINVAL;
14194                 goto out;
14195         }
14196
14197         if (info->attrs[NL80211_ATTR_PMKR0_NAME])
14198                 pmk_conf.pmk_r0_name =
14199                         nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
14200
14201         ret = rdev_set_pmk(rdev, dev, &pmk_conf);
14202 out:
14203         wdev_unlock(wdev);
14204         return ret;
14205 }
14206
14207 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
14208 {
14209         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14210         struct net_device *dev = info->user_ptr[1];
14211         struct wireless_dev *wdev = dev->ieee80211_ptr;
14212         const u8 *aa;
14213         int ret;
14214
14215         if (wdev->iftype != NL80211_IFTYPE_STATION &&
14216             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
14217                 return -EOPNOTSUPP;
14218
14219         if (!wiphy_ext_feature_isset(&rdev->wiphy,
14220                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
14221                 return -EOPNOTSUPP;
14222
14223         if (!info->attrs[NL80211_ATTR_MAC])
14224                 return -EINVAL;
14225
14226         wdev_lock(wdev);
14227         aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
14228         ret = rdev_del_pmk(rdev, dev, aa);
14229         wdev_unlock(wdev);
14230
14231         return ret;
14232 }
14233
14234 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
14235 {
14236         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14237         struct net_device *dev = info->user_ptr[1];
14238         struct cfg80211_external_auth_params params;
14239
14240         if (!rdev->ops->external_auth)
14241                 return -EOPNOTSUPP;
14242
14243         if (!info->attrs[NL80211_ATTR_SSID] &&
14244             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
14245             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
14246                 return -EINVAL;
14247
14248         if (!info->attrs[NL80211_ATTR_BSSID])
14249                 return -EINVAL;
14250
14251         if (!info->attrs[NL80211_ATTR_STATUS_CODE])
14252                 return -EINVAL;
14253
14254         memset(&params, 0, sizeof(params));
14255
14256         if (info->attrs[NL80211_ATTR_SSID]) {
14257                 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
14258                 if (params.ssid.ssid_len == 0)
14259                         return -EINVAL;
14260                 memcpy(params.ssid.ssid,
14261                        nla_data(info->attrs[NL80211_ATTR_SSID]),
14262                        params.ssid.ssid_len);
14263         }
14264
14265         memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
14266                ETH_ALEN);
14267
14268         params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
14269
14270         if (info->attrs[NL80211_ATTR_PMKID])
14271                 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
14272
14273         return rdev_external_auth(rdev, dev, &params);
14274 }
14275
14276 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
14277 {
14278         bool dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
14279         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14280         struct net_device *dev = info->user_ptr[1];
14281         struct wireless_dev *wdev = dev->ieee80211_ptr;
14282         const u8 *buf;
14283         size_t len;
14284         u8 *dest;
14285         u16 proto;
14286         bool noencrypt;
14287         u64 cookie = 0;
14288         int err;
14289
14290         if (!wiphy_ext_feature_isset(&rdev->wiphy,
14291                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
14292                 return -EOPNOTSUPP;
14293
14294         if (!rdev->ops->tx_control_port)
14295                 return -EOPNOTSUPP;
14296
14297         if (!info->attrs[NL80211_ATTR_FRAME] ||
14298             !info->attrs[NL80211_ATTR_MAC] ||
14299             !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
14300                 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
14301                 return -EINVAL;
14302         }
14303
14304         wdev_lock(wdev);
14305
14306         switch (wdev->iftype) {
14307         case NL80211_IFTYPE_AP:
14308         case NL80211_IFTYPE_P2P_GO:
14309         case NL80211_IFTYPE_MESH_POINT:
14310                 break;
14311         case NL80211_IFTYPE_ADHOC:
14312         case NL80211_IFTYPE_STATION:
14313         case NL80211_IFTYPE_P2P_CLIENT:
14314                 if (wdev->current_bss)
14315                         break;
14316                 err = -ENOTCONN;
14317                 goto out;
14318         default:
14319                 err = -EOPNOTSUPP;
14320                 goto out;
14321         }
14322
14323         wdev_unlock(wdev);
14324
14325         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
14326         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
14327         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
14328         proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
14329         noencrypt =
14330                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
14331
14332         err = rdev_tx_control_port(rdev, dev, buf, len,
14333                                    dest, cpu_to_be16(proto), noencrypt,
14334                                    dont_wait_for_ack ? NULL : &cookie);
14335         if (!err && !dont_wait_for_ack)
14336                 nl_set_extack_cookie_u64(info->extack, cookie);
14337         return err;
14338  out:
14339         wdev_unlock(wdev);
14340         return err;
14341 }
14342
14343 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
14344                                            struct genl_info *info)
14345 {
14346         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14347         struct net_device *dev = info->user_ptr[1];
14348         struct wireless_dev *wdev = dev->ieee80211_ptr;
14349         struct cfg80211_ftm_responder_stats ftm_stats = {};
14350         struct sk_buff *msg;
14351         void *hdr;
14352         struct nlattr *ftm_stats_attr;
14353         int err;
14354
14355         if (wdev->iftype != NL80211_IFTYPE_AP || !wdev->beacon_interval)
14356                 return -EOPNOTSUPP;
14357
14358         err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
14359         if (err)
14360                 return err;
14361
14362         if (!ftm_stats.filled)
14363                 return -ENODATA;
14364
14365         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14366         if (!msg)
14367                 return -ENOMEM;
14368
14369         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14370                              NL80211_CMD_GET_FTM_RESPONDER_STATS);
14371         if (!hdr)
14372                 goto nla_put_failure;
14373
14374         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
14375                 goto nla_put_failure;
14376
14377         ftm_stats_attr = nla_nest_start_noflag(msg,
14378                                                NL80211_ATTR_FTM_RESPONDER_STATS);
14379         if (!ftm_stats_attr)
14380                 goto nla_put_failure;
14381
14382 #define SET_FTM(field, name, type)                                       \
14383         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
14384             nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name,            \
14385                              ftm_stats.field))                           \
14386                 goto nla_put_failure; } while (0)
14387 #define SET_FTM_U64(field, name)                                         \
14388         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
14389             nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name,           \
14390                               ftm_stats.field, NL80211_FTM_STATS_PAD))   \
14391                 goto nla_put_failure; } while (0)
14392
14393         SET_FTM(success_num, SUCCESS_NUM, u32);
14394         SET_FTM(partial_num, PARTIAL_NUM, u32);
14395         SET_FTM(failed_num, FAILED_NUM, u32);
14396         SET_FTM(asap_num, ASAP_NUM, u32);
14397         SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
14398         SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
14399         SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
14400         SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
14401         SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
14402 #undef SET_FTM
14403
14404         nla_nest_end(msg, ftm_stats_attr);
14405
14406         genlmsg_end(msg, hdr);
14407         return genlmsg_reply(msg, info);
14408
14409 nla_put_failure:
14410         nlmsg_free(msg);
14411         return -ENOBUFS;
14412 }
14413
14414 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info)
14415 {
14416         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14417         struct cfg80211_update_owe_info owe_info;
14418         struct net_device *dev = info->user_ptr[1];
14419
14420         if (!rdev->ops->update_owe_info)
14421                 return -EOPNOTSUPP;
14422
14423         if (!info->attrs[NL80211_ATTR_STATUS_CODE] ||
14424             !info->attrs[NL80211_ATTR_MAC])
14425                 return -EINVAL;
14426
14427         memset(&owe_info, 0, sizeof(owe_info));
14428         owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
14429         nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN);
14430
14431         if (info->attrs[NL80211_ATTR_IE]) {
14432                 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
14433                 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
14434         }
14435
14436         return rdev_update_owe_info(rdev, dev, &owe_info);
14437 }
14438
14439 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info)
14440 {
14441         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14442         struct net_device *dev = info->user_ptr[1];
14443         struct wireless_dev *wdev = dev->ieee80211_ptr;
14444         struct station_info sinfo = {};
14445         const u8 *buf;
14446         size_t len;
14447         u8 *dest;
14448         int err;
14449
14450         if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station)
14451                 return -EOPNOTSUPP;
14452
14453         if (!info->attrs[NL80211_ATTR_MAC] ||
14454             !info->attrs[NL80211_ATTR_FRAME]) {
14455                 GENL_SET_ERR_MSG(info, "Frame or MAC missing");
14456                 return -EINVAL;
14457         }
14458
14459         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
14460                 return -EOPNOTSUPP;
14461
14462         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
14463         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
14464         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
14465
14466         if (len < sizeof(struct ethhdr))
14467                 return -EINVAL;
14468
14469         if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) ||
14470             !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr))
14471                 return -EINVAL;
14472
14473         err = rdev_get_station(rdev, dev, dest, &sinfo);
14474         if (err)
14475                 return err;
14476
14477         cfg80211_sinfo_release_content(&sinfo);
14478
14479         return rdev_probe_mesh_link(rdev, dev, dest, buf, len);
14480 }
14481
14482 static int parse_tid_conf(struct cfg80211_registered_device *rdev,
14483                           struct nlattr *attrs[], struct net_device *dev,
14484                           struct cfg80211_tid_cfg *tid_conf,
14485                           struct genl_info *info, const u8 *peer)
14486 {
14487         struct netlink_ext_ack *extack = info->extack;
14488         u64 mask;
14489         int err;
14490
14491         if (!attrs[NL80211_TID_CONFIG_ATTR_TIDS])
14492                 return -EINVAL;
14493
14494         tid_conf->config_override =
14495                         nla_get_flag(attrs[NL80211_TID_CONFIG_ATTR_OVERRIDE]);
14496         tid_conf->tids = nla_get_u16(attrs[NL80211_TID_CONFIG_ATTR_TIDS]);
14497
14498         if (tid_conf->config_override) {
14499                 if (rdev->ops->reset_tid_config) {
14500                         err = rdev_reset_tid_config(rdev, dev, peer,
14501                                                     tid_conf->tids);
14502                         if (err)
14503                                 return err;
14504                 } else {
14505                         return -EINVAL;
14506                 }
14507         }
14508
14509         if (attrs[NL80211_TID_CONFIG_ATTR_NOACK]) {
14510                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_NOACK);
14511                 tid_conf->noack =
14512                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_NOACK]);
14513         }
14514
14515         if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]) {
14516                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_SHORT);
14517                 tid_conf->retry_short =
14518                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]);
14519
14520                 if (tid_conf->retry_short > rdev->wiphy.max_data_retry_count)
14521                         return -EINVAL;
14522         }
14523
14524         if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]) {
14525                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_LONG);
14526                 tid_conf->retry_long =
14527                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]);
14528
14529                 if (tid_conf->retry_long > rdev->wiphy.max_data_retry_count)
14530                         return -EINVAL;
14531         }
14532
14533         if (attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]) {
14534                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL);
14535                 tid_conf->ampdu =
14536                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]);
14537         }
14538
14539         if (attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]) {
14540                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL);
14541                 tid_conf->rtscts =
14542                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]);
14543         }
14544
14545         if (attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]) {
14546                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL);
14547                 tid_conf->amsdu =
14548                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]);
14549         }
14550
14551         if (attrs[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE]) {
14552                 u32 idx = NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE, attr;
14553
14554                 tid_conf->txrate_type = nla_get_u8(attrs[idx]);
14555
14556                 if (tid_conf->txrate_type != NL80211_TX_RATE_AUTOMATIC) {
14557                         attr = NL80211_TID_CONFIG_ATTR_TX_RATE;
14558                         err = nl80211_parse_tx_bitrate_mask(info, attrs, attr,
14559                                                     &tid_conf->txrate_mask, dev,
14560                                                     true);
14561                         if (err)
14562                                 return err;
14563
14564                         tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE);
14565                 }
14566                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE);
14567         }
14568
14569         if (peer)
14570                 mask = rdev->wiphy.tid_config_support.peer;
14571         else
14572                 mask = rdev->wiphy.tid_config_support.vif;
14573
14574         if (tid_conf->mask & ~mask) {
14575                 NL_SET_ERR_MSG(extack, "unsupported TID configuration");
14576                 return -ENOTSUPP;
14577         }
14578
14579         return 0;
14580 }
14581
14582 static int nl80211_set_tid_config(struct sk_buff *skb,
14583                                   struct genl_info *info)
14584 {
14585         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14586         struct nlattr *attrs[NL80211_TID_CONFIG_ATTR_MAX + 1];
14587         struct net_device *dev = info->user_ptr[1];
14588         struct cfg80211_tid_config *tid_config;
14589         struct nlattr *tid;
14590         int conf_idx = 0, rem_conf;
14591         int ret = -EINVAL;
14592         u32 num_conf = 0;
14593
14594         if (!info->attrs[NL80211_ATTR_TID_CONFIG])
14595                 return -EINVAL;
14596
14597         if (!rdev->ops->set_tid_config)
14598                 return -EOPNOTSUPP;
14599
14600         nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
14601                             rem_conf)
14602                 num_conf++;
14603
14604         tid_config = kzalloc(struct_size(tid_config, tid_conf, num_conf),
14605                              GFP_KERNEL);
14606         if (!tid_config)
14607                 return -ENOMEM;
14608
14609         tid_config->n_tid_conf = num_conf;
14610
14611         if (info->attrs[NL80211_ATTR_MAC])
14612                 tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
14613
14614         nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
14615                             rem_conf) {
14616                 ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX,
14617                                        tid, NULL, NULL);
14618
14619                 if (ret)
14620                         goto bad_tid_conf;
14621
14622                 ret = parse_tid_conf(rdev, attrs, dev,
14623                                      &tid_config->tid_conf[conf_idx],
14624                                      info, tid_config->peer);
14625                 if (ret)
14626                         goto bad_tid_conf;
14627
14628                 conf_idx++;
14629         }
14630
14631         ret = rdev_set_tid_config(rdev, dev, tid_config);
14632
14633 bad_tid_conf:
14634         kfree(tid_config);
14635         return ret;
14636 }
14637
14638 #define NL80211_FLAG_NEED_WIPHY         0x01
14639 #define NL80211_FLAG_NEED_NETDEV        0x02
14640 #define NL80211_FLAG_NEED_RTNL          0x04
14641 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
14642 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
14643                                          NL80211_FLAG_CHECK_NETDEV_UP)
14644 #define NL80211_FLAG_NEED_WDEV          0x10
14645 /* If a netdev is associated, it must be UP, P2P must be started */
14646 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
14647                                          NL80211_FLAG_CHECK_NETDEV_UP)
14648 #define NL80211_FLAG_CLEAR_SKB          0x20
14649
14650 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
14651                             struct genl_info *info)
14652 {
14653         struct cfg80211_registered_device *rdev;
14654         struct wireless_dev *wdev;
14655         struct net_device *dev;
14656         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
14657
14658         if (rtnl)
14659                 rtnl_lock();
14660
14661         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
14662                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
14663                 if (IS_ERR(rdev)) {
14664                         if (rtnl)
14665                                 rtnl_unlock();
14666                         return PTR_ERR(rdev);
14667                 }
14668                 info->user_ptr[0] = rdev;
14669         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
14670                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
14671                 ASSERT_RTNL();
14672
14673                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
14674                                                   info->attrs);
14675                 if (IS_ERR(wdev)) {
14676                         if (rtnl)
14677                                 rtnl_unlock();
14678                         return PTR_ERR(wdev);
14679                 }
14680
14681                 dev = wdev->netdev;
14682                 rdev = wiphy_to_rdev(wdev->wiphy);
14683
14684                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
14685                         if (!dev) {
14686                                 if (rtnl)
14687                                         rtnl_unlock();
14688                                 return -EINVAL;
14689                         }
14690
14691                         info->user_ptr[1] = dev;
14692                 } else {
14693                         info->user_ptr[1] = wdev;
14694                 }
14695
14696                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
14697                     !wdev_running(wdev)) {
14698                         if (rtnl)
14699                                 rtnl_unlock();
14700                         return -ENETDOWN;
14701                 }
14702
14703                 if (dev)
14704                         dev_hold(dev);
14705
14706                 info->user_ptr[0] = rdev;
14707         }
14708
14709         return 0;
14710 }
14711
14712 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
14713                               struct genl_info *info)
14714 {
14715         if (info->user_ptr[1]) {
14716                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
14717                         struct wireless_dev *wdev = info->user_ptr[1];
14718
14719                         if (wdev->netdev)
14720                                 dev_put(wdev->netdev);
14721                 } else {
14722                         dev_put(info->user_ptr[1]);
14723                 }
14724         }
14725
14726         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
14727                 rtnl_unlock();
14728
14729         /* If needed, clear the netlink message payload from the SKB
14730          * as it might contain key data that shouldn't stick around on
14731          * the heap after the SKB is freed. The netlink message header
14732          * is still needed for further processing, so leave it intact.
14733          */
14734         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
14735                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
14736
14737                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
14738         }
14739 }
14740
14741 static int nl80211_set_sar_sub_specs(struct cfg80211_registered_device *rdev,
14742                                      struct cfg80211_sar_specs *sar_specs,
14743                                      struct nlattr *spec[], int index)
14744 {
14745         u32 range_index, i;
14746
14747         if (!sar_specs || !spec)
14748                 return -EINVAL;
14749
14750         if (!spec[NL80211_SAR_ATTR_SPECS_POWER] ||
14751             !spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX])
14752                 return -EINVAL;
14753
14754         range_index = nla_get_u32(spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX]);
14755
14756         /* check if range_index exceeds num_freq_ranges */
14757         if (range_index >= rdev->wiphy.sar_capa->num_freq_ranges)
14758                 return -EINVAL;
14759
14760         /* check if range_index duplicates */
14761         for (i = 0; i < index; i++) {
14762                 if (sar_specs->sub_specs[i].freq_range_index == range_index)
14763                         return -EINVAL;
14764         }
14765
14766         sar_specs->sub_specs[index].power =
14767                 nla_get_s32(spec[NL80211_SAR_ATTR_SPECS_POWER]);
14768
14769         sar_specs->sub_specs[index].freq_range_index = range_index;
14770
14771         return 0;
14772 }
14773
14774 static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info)
14775 {
14776         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14777         struct nlattr *spec[NL80211_SAR_ATTR_SPECS_MAX + 1];
14778         struct nlattr *tb[NL80211_SAR_ATTR_MAX + 1];
14779         struct cfg80211_sar_specs *sar_spec;
14780         enum nl80211_sar_type type;
14781         struct nlattr *spec_list;
14782         u32 specs;
14783         int rem, err;
14784
14785         if (!rdev->wiphy.sar_capa || !rdev->ops->set_sar_specs)
14786                 return -EOPNOTSUPP;
14787
14788         if (!info->attrs[NL80211_ATTR_SAR_SPEC])
14789                 return -EINVAL;
14790
14791         nla_parse_nested(tb, NL80211_SAR_ATTR_MAX,
14792                          info->attrs[NL80211_ATTR_SAR_SPEC],
14793                          NULL, NULL);
14794
14795         if (!tb[NL80211_SAR_ATTR_TYPE] || !tb[NL80211_SAR_ATTR_SPECS])
14796                 return -EINVAL;
14797
14798         type = nla_get_u32(tb[NL80211_SAR_ATTR_TYPE]);
14799         if (type != rdev->wiphy.sar_capa->type)
14800                 return -EINVAL;
14801
14802         specs = 0;
14803         nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem)
14804                 specs++;
14805
14806         if (specs > rdev->wiphy.sar_capa->num_freq_ranges)
14807                 return -EINVAL;
14808
14809         sar_spec = kzalloc(sizeof(*sar_spec) +
14810                            specs * sizeof(struct cfg80211_sar_sub_specs),
14811                            GFP_KERNEL);
14812         if (!sar_spec)
14813                 return -ENOMEM;
14814
14815         sar_spec->type = type;
14816         specs = 0;
14817         nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) {
14818                 nla_parse_nested(spec, NL80211_SAR_ATTR_SPECS_MAX,
14819                                  spec_list, NULL, NULL);
14820
14821                 switch (type) {
14822                 case NL80211_SAR_TYPE_POWER:
14823                         if (nl80211_set_sar_sub_specs(rdev, sar_spec,
14824                                                       spec, specs)) {
14825                                 err = -EINVAL;
14826                                 goto error;
14827                         }
14828                         break;
14829                 default:
14830                         err = -EINVAL;
14831                         goto error;
14832                 }
14833                 specs++;
14834         }
14835
14836         sar_spec->num_sub_specs = specs;
14837
14838         rdev->cur_cmd_info = info;
14839         err = rdev_set_sar_specs(rdev, sar_spec);
14840         rdev->cur_cmd_info = NULL;
14841 error:
14842         kfree(sar_spec);
14843         return err;
14844 }
14845
14846 static const struct genl_ops nl80211_ops[] = {
14847         {
14848                 .cmd = NL80211_CMD_GET_WIPHY,
14849                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14850                 .doit = nl80211_get_wiphy,
14851                 .dumpit = nl80211_dump_wiphy,
14852                 .done = nl80211_dump_wiphy_done,
14853                 /* can be retrieved by unprivileged users */
14854                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14855                                   NL80211_FLAG_NEED_RTNL,
14856         },
14857 };
14858
14859 static const struct genl_small_ops nl80211_small_ops[] = {
14860         {
14861                 .cmd = NL80211_CMD_SET_WIPHY,
14862                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14863                 .doit = nl80211_set_wiphy,
14864                 .flags = GENL_UNS_ADMIN_PERM,
14865                 .internal_flags = NL80211_FLAG_NEED_RTNL,
14866         },
14867         {
14868                 .cmd = NL80211_CMD_GET_INTERFACE,
14869                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14870                 .doit = nl80211_get_interface,
14871                 .dumpit = nl80211_dump_interface,
14872                 /* can be retrieved by unprivileged users */
14873                 .internal_flags = NL80211_FLAG_NEED_WDEV |
14874                                   NL80211_FLAG_NEED_RTNL,
14875         },
14876         {
14877                 .cmd = NL80211_CMD_SET_INTERFACE,
14878                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14879                 .doit = nl80211_set_interface,
14880                 .flags = GENL_UNS_ADMIN_PERM,
14881                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14882                                   NL80211_FLAG_NEED_RTNL,
14883         },
14884         {
14885                 .cmd = NL80211_CMD_NEW_INTERFACE,
14886                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14887                 .doit = nl80211_new_interface,
14888                 .flags = GENL_UNS_ADMIN_PERM,
14889                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14890                                   NL80211_FLAG_NEED_RTNL,
14891         },
14892         {
14893                 .cmd = NL80211_CMD_DEL_INTERFACE,
14894                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14895                 .doit = nl80211_del_interface,
14896                 .flags = GENL_UNS_ADMIN_PERM,
14897                 .internal_flags = NL80211_FLAG_NEED_WDEV |
14898                                   NL80211_FLAG_NEED_RTNL,
14899         },
14900         {
14901                 .cmd = NL80211_CMD_GET_KEY,
14902                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14903                 .doit = nl80211_get_key,
14904                 .flags = GENL_UNS_ADMIN_PERM,
14905                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14906                                   NL80211_FLAG_NEED_RTNL,
14907         },
14908         {
14909                 .cmd = NL80211_CMD_SET_KEY,
14910                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14911                 .doit = nl80211_set_key,
14912                 .flags = GENL_UNS_ADMIN_PERM,
14913                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14914                                   NL80211_FLAG_NEED_RTNL |
14915                                   NL80211_FLAG_CLEAR_SKB,
14916         },
14917         {
14918                 .cmd = NL80211_CMD_NEW_KEY,
14919                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14920                 .doit = nl80211_new_key,
14921                 .flags = GENL_UNS_ADMIN_PERM,
14922                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14923                                   NL80211_FLAG_NEED_RTNL |
14924                                   NL80211_FLAG_CLEAR_SKB,
14925         },
14926         {
14927                 .cmd = NL80211_CMD_DEL_KEY,
14928                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14929                 .doit = nl80211_del_key,
14930                 .flags = GENL_UNS_ADMIN_PERM,
14931                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14932                                   NL80211_FLAG_NEED_RTNL,
14933         },
14934         {
14935                 .cmd = NL80211_CMD_SET_BEACON,
14936                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14937                 .flags = GENL_UNS_ADMIN_PERM,
14938                 .doit = nl80211_set_beacon,
14939                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14940                                   NL80211_FLAG_NEED_RTNL,
14941         },
14942         {
14943                 .cmd = NL80211_CMD_START_AP,
14944                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14945                 .flags = GENL_UNS_ADMIN_PERM,
14946                 .doit = nl80211_start_ap,
14947                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14948                                   NL80211_FLAG_NEED_RTNL,
14949         },
14950         {
14951                 .cmd = NL80211_CMD_STOP_AP,
14952                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14953                 .flags = GENL_UNS_ADMIN_PERM,
14954                 .doit = nl80211_stop_ap,
14955                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14956                                   NL80211_FLAG_NEED_RTNL,
14957         },
14958         {
14959                 .cmd = NL80211_CMD_GET_STATION,
14960                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14961                 .doit = nl80211_get_station,
14962                 .dumpit = nl80211_dump_station,
14963                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14964                                   NL80211_FLAG_NEED_RTNL,
14965         },
14966         {
14967                 .cmd = NL80211_CMD_SET_STATION,
14968                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14969                 .doit = nl80211_set_station,
14970                 .flags = GENL_UNS_ADMIN_PERM,
14971                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14972                                   NL80211_FLAG_NEED_RTNL,
14973         },
14974         {
14975                 .cmd = NL80211_CMD_NEW_STATION,
14976                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14977                 .doit = nl80211_new_station,
14978                 .flags = GENL_UNS_ADMIN_PERM,
14979                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14980                                   NL80211_FLAG_NEED_RTNL,
14981         },
14982         {
14983                 .cmd = NL80211_CMD_DEL_STATION,
14984                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14985                 .doit = nl80211_del_station,
14986                 .flags = GENL_UNS_ADMIN_PERM,
14987                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14988                                   NL80211_FLAG_NEED_RTNL,
14989         },
14990         {
14991                 .cmd = NL80211_CMD_GET_MPATH,
14992                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14993                 .doit = nl80211_get_mpath,
14994                 .dumpit = nl80211_dump_mpath,
14995                 .flags = GENL_UNS_ADMIN_PERM,
14996                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14997                                   NL80211_FLAG_NEED_RTNL,
14998         },
14999         {
15000                 .cmd = NL80211_CMD_GET_MPP,
15001                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15002                 .doit = nl80211_get_mpp,
15003                 .dumpit = nl80211_dump_mpp,
15004                 .flags = GENL_UNS_ADMIN_PERM,
15005                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15006                                   NL80211_FLAG_NEED_RTNL,
15007         },
15008         {
15009                 .cmd = NL80211_CMD_SET_MPATH,
15010                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15011                 .doit = nl80211_set_mpath,
15012                 .flags = GENL_UNS_ADMIN_PERM,
15013                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15014                                   NL80211_FLAG_NEED_RTNL,
15015         },
15016         {
15017                 .cmd = NL80211_CMD_NEW_MPATH,
15018                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15019                 .doit = nl80211_new_mpath,
15020                 .flags = GENL_UNS_ADMIN_PERM,
15021                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15022                                   NL80211_FLAG_NEED_RTNL,
15023         },
15024         {
15025                 .cmd = NL80211_CMD_DEL_MPATH,
15026                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15027                 .doit = nl80211_del_mpath,
15028                 .flags = GENL_UNS_ADMIN_PERM,
15029                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15030                                   NL80211_FLAG_NEED_RTNL,
15031         },
15032         {
15033                 .cmd = NL80211_CMD_SET_BSS,
15034                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15035                 .doit = nl80211_set_bss,
15036                 .flags = GENL_UNS_ADMIN_PERM,
15037                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15038                                   NL80211_FLAG_NEED_RTNL,
15039         },
15040         {
15041                 .cmd = NL80211_CMD_GET_REG,
15042                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15043                 .doit = nl80211_get_reg_do,
15044                 .dumpit = nl80211_get_reg_dump,
15045                 .internal_flags = NL80211_FLAG_NEED_RTNL,
15046                 /* can be retrieved by unprivileged users */
15047         },
15048 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
15049         {
15050                 .cmd = NL80211_CMD_SET_REG,
15051                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15052                 .doit = nl80211_set_reg,
15053                 .flags = GENL_ADMIN_PERM,
15054                 .internal_flags = NL80211_FLAG_NEED_RTNL,
15055         },
15056 #endif
15057         {
15058                 .cmd = NL80211_CMD_REQ_SET_REG,
15059                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15060                 .doit = nl80211_req_set_reg,
15061                 .flags = GENL_ADMIN_PERM,
15062         },
15063         {
15064                 .cmd = NL80211_CMD_RELOAD_REGDB,
15065                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15066                 .doit = nl80211_reload_regdb,
15067                 .flags = GENL_ADMIN_PERM,
15068         },
15069         {
15070                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
15071                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15072                 .doit = nl80211_get_mesh_config,
15073                 /* can be retrieved by unprivileged users */
15074                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15075                                   NL80211_FLAG_NEED_RTNL,
15076         },
15077         {
15078                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
15079                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15080                 .doit = nl80211_update_mesh_config,
15081                 .flags = GENL_UNS_ADMIN_PERM,
15082                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15083                                   NL80211_FLAG_NEED_RTNL,
15084         },
15085         {
15086                 .cmd = NL80211_CMD_TRIGGER_SCAN,
15087                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15088                 .doit = nl80211_trigger_scan,
15089                 .flags = GENL_UNS_ADMIN_PERM,
15090                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15091                                   NL80211_FLAG_NEED_RTNL,
15092         },
15093         {
15094                 .cmd = NL80211_CMD_ABORT_SCAN,
15095                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15096                 .doit = nl80211_abort_scan,
15097                 .flags = GENL_UNS_ADMIN_PERM,
15098                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15099                                   NL80211_FLAG_NEED_RTNL,
15100         },
15101         {
15102                 .cmd = NL80211_CMD_GET_SCAN,
15103                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15104                 .dumpit = nl80211_dump_scan,
15105         },
15106         {
15107                 .cmd = NL80211_CMD_START_SCHED_SCAN,
15108                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15109                 .doit = nl80211_start_sched_scan,
15110                 .flags = GENL_UNS_ADMIN_PERM,
15111                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15112                                   NL80211_FLAG_NEED_RTNL,
15113         },
15114         {
15115                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
15116                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15117                 .doit = nl80211_stop_sched_scan,
15118                 .flags = GENL_UNS_ADMIN_PERM,
15119                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15120                                   NL80211_FLAG_NEED_RTNL,
15121         },
15122         {
15123                 .cmd = NL80211_CMD_AUTHENTICATE,
15124                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15125                 .doit = nl80211_authenticate,
15126                 .flags = GENL_UNS_ADMIN_PERM,
15127                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15128                                   NL80211_FLAG_NEED_RTNL |
15129                                   NL80211_FLAG_CLEAR_SKB,
15130         },
15131         {
15132                 .cmd = NL80211_CMD_ASSOCIATE,
15133                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15134                 .doit = nl80211_associate,
15135                 .flags = GENL_UNS_ADMIN_PERM,
15136                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15137                                   NL80211_FLAG_NEED_RTNL |
15138                                   NL80211_FLAG_CLEAR_SKB,
15139         },
15140         {
15141                 .cmd = NL80211_CMD_DEAUTHENTICATE,
15142                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15143                 .doit = nl80211_deauthenticate,
15144                 .flags = GENL_UNS_ADMIN_PERM,
15145                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15146                                   NL80211_FLAG_NEED_RTNL,
15147         },
15148         {
15149                 .cmd = NL80211_CMD_DISASSOCIATE,
15150                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15151                 .doit = nl80211_disassociate,
15152                 .flags = GENL_UNS_ADMIN_PERM,
15153                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15154                                   NL80211_FLAG_NEED_RTNL,
15155         },
15156         {
15157                 .cmd = NL80211_CMD_JOIN_IBSS,
15158                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15159                 .doit = nl80211_join_ibss,
15160                 .flags = GENL_UNS_ADMIN_PERM,
15161                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15162                                   NL80211_FLAG_NEED_RTNL,
15163         },
15164         {
15165                 .cmd = NL80211_CMD_LEAVE_IBSS,
15166                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15167                 .doit = nl80211_leave_ibss,
15168                 .flags = GENL_UNS_ADMIN_PERM,
15169                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15170                                   NL80211_FLAG_NEED_RTNL,
15171         },
15172 #ifdef CONFIG_NL80211_TESTMODE
15173         {
15174                 .cmd = NL80211_CMD_TESTMODE,
15175                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15176                 .doit = nl80211_testmode_do,
15177                 .dumpit = nl80211_testmode_dump,
15178                 .flags = GENL_UNS_ADMIN_PERM,
15179                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
15180                                   NL80211_FLAG_NEED_RTNL,
15181         },
15182 #endif
15183         {
15184                 .cmd = NL80211_CMD_CONNECT,
15185                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15186                 .doit = nl80211_connect,
15187                 .flags = GENL_UNS_ADMIN_PERM,
15188                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15189                                   NL80211_FLAG_NEED_RTNL |
15190                                   NL80211_FLAG_CLEAR_SKB,
15191         },
15192         {
15193                 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
15194                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15195                 .doit = nl80211_update_connect_params,
15196                 .flags = GENL_ADMIN_PERM,
15197                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15198                                   NL80211_FLAG_NEED_RTNL |
15199                                   NL80211_FLAG_CLEAR_SKB,
15200         },
15201         {
15202                 .cmd = NL80211_CMD_DISCONNECT,
15203                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15204                 .doit = nl80211_disconnect,
15205                 .flags = GENL_UNS_ADMIN_PERM,
15206                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15207                                   NL80211_FLAG_NEED_RTNL,
15208         },
15209         {
15210                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
15211                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15212                 .doit = nl80211_wiphy_netns,
15213                 .flags = GENL_UNS_ADMIN_PERM,
15214                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
15215                                   NL80211_FLAG_NEED_RTNL,
15216         },
15217         {
15218                 .cmd = NL80211_CMD_GET_SURVEY,
15219                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15220                 .dumpit = nl80211_dump_survey,
15221         },
15222         {
15223                 .cmd = NL80211_CMD_SET_PMKSA,
15224                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15225                 .doit = nl80211_setdel_pmksa,
15226                 .flags = GENL_UNS_ADMIN_PERM,
15227                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15228                                   NL80211_FLAG_NEED_RTNL |
15229                                   NL80211_FLAG_CLEAR_SKB,
15230         },
15231         {
15232                 .cmd = NL80211_CMD_DEL_PMKSA,
15233                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15234                 .doit = nl80211_setdel_pmksa,
15235                 .flags = GENL_UNS_ADMIN_PERM,
15236                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15237                                   NL80211_FLAG_NEED_RTNL,
15238         },
15239         {
15240                 .cmd = NL80211_CMD_FLUSH_PMKSA,
15241                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15242                 .doit = nl80211_flush_pmksa,
15243                 .flags = GENL_UNS_ADMIN_PERM,
15244                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15245                                   NL80211_FLAG_NEED_RTNL,
15246         },
15247         {
15248                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
15249                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15250                 .doit = nl80211_remain_on_channel,
15251                 .flags = GENL_UNS_ADMIN_PERM,
15252                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15253                                   NL80211_FLAG_NEED_RTNL,
15254         },
15255         {
15256                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
15257                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15258                 .doit = nl80211_cancel_remain_on_channel,
15259                 .flags = GENL_UNS_ADMIN_PERM,
15260                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15261                                   NL80211_FLAG_NEED_RTNL,
15262         },
15263         {
15264                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
15265                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15266                 .doit = nl80211_set_tx_bitrate_mask,
15267                 .flags = GENL_UNS_ADMIN_PERM,
15268                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
15269                                   NL80211_FLAG_NEED_RTNL,
15270         },
15271         {
15272                 .cmd = NL80211_CMD_REGISTER_FRAME,
15273                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15274                 .doit = nl80211_register_mgmt,
15275                 .flags = GENL_UNS_ADMIN_PERM,
15276                 .internal_flags = NL80211_FLAG_NEED_WDEV |
15277                                   NL80211_FLAG_NEED_RTNL,
15278         },
15279         {
15280                 .cmd = NL80211_CMD_FRAME,
15281                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15282                 .doit = nl80211_tx_mgmt,
15283                 .flags = GENL_UNS_ADMIN_PERM,
15284                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15285                                   NL80211_FLAG_NEED_RTNL,
15286         },
15287         {
15288                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
15289                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15290                 .doit = nl80211_tx_mgmt_cancel_wait,
15291                 .flags = GENL_UNS_ADMIN_PERM,
15292                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15293                                   NL80211_FLAG_NEED_RTNL,
15294         },
15295         {
15296                 .cmd = NL80211_CMD_SET_POWER_SAVE,
15297                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15298                 .doit = nl80211_set_power_save,
15299                 .flags = GENL_UNS_ADMIN_PERM,
15300                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
15301                                   NL80211_FLAG_NEED_RTNL,
15302         },
15303         {
15304                 .cmd = NL80211_CMD_GET_POWER_SAVE,
15305                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15306                 .doit = nl80211_get_power_save,
15307                 /* can be retrieved by unprivileged users */
15308                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
15309                                   NL80211_FLAG_NEED_RTNL,
15310         },
15311         {
15312                 .cmd = NL80211_CMD_SET_CQM,
15313                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15314                 .doit = nl80211_set_cqm,
15315                 .flags = GENL_UNS_ADMIN_PERM,
15316                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
15317                                   NL80211_FLAG_NEED_RTNL,
15318         },
15319         {
15320                 .cmd = NL80211_CMD_SET_CHANNEL,
15321                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15322                 .doit = nl80211_set_channel,
15323                 .flags = GENL_UNS_ADMIN_PERM,
15324                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
15325                                   NL80211_FLAG_NEED_RTNL,
15326         },
15327         {
15328                 .cmd = NL80211_CMD_JOIN_MESH,
15329                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15330                 .doit = nl80211_join_mesh,
15331                 .flags = GENL_UNS_ADMIN_PERM,
15332                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15333                                   NL80211_FLAG_NEED_RTNL,
15334         },
15335         {
15336                 .cmd = NL80211_CMD_LEAVE_MESH,
15337                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15338                 .doit = nl80211_leave_mesh,
15339                 .flags = GENL_UNS_ADMIN_PERM,
15340                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15341                                   NL80211_FLAG_NEED_RTNL,
15342         },
15343         {
15344                 .cmd = NL80211_CMD_JOIN_OCB,
15345                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15346                 .doit = nl80211_join_ocb,
15347                 .flags = GENL_UNS_ADMIN_PERM,
15348                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15349                                   NL80211_FLAG_NEED_RTNL,
15350         },
15351         {
15352                 .cmd = NL80211_CMD_LEAVE_OCB,
15353                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15354                 .doit = nl80211_leave_ocb,
15355                 .flags = GENL_UNS_ADMIN_PERM,
15356                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15357                                   NL80211_FLAG_NEED_RTNL,
15358         },
15359 #ifdef CONFIG_PM
15360         {
15361                 .cmd = NL80211_CMD_GET_WOWLAN,
15362                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15363                 .doit = nl80211_get_wowlan,
15364                 /* can be retrieved by unprivileged users */
15365                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
15366                                   NL80211_FLAG_NEED_RTNL,
15367         },
15368         {
15369                 .cmd = NL80211_CMD_SET_WOWLAN,
15370                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15371                 .doit = nl80211_set_wowlan,
15372                 .flags = GENL_UNS_ADMIN_PERM,
15373                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
15374                                   NL80211_FLAG_NEED_RTNL,
15375         },
15376 #endif
15377         {
15378                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
15379                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15380                 .doit = nl80211_set_rekey_data,
15381                 .flags = GENL_UNS_ADMIN_PERM,
15382                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15383                                   NL80211_FLAG_NEED_RTNL |
15384                                   NL80211_FLAG_CLEAR_SKB,
15385         },
15386         {
15387                 .cmd = NL80211_CMD_TDLS_MGMT,
15388                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15389                 .doit = nl80211_tdls_mgmt,
15390                 .flags = GENL_UNS_ADMIN_PERM,
15391                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15392                                   NL80211_FLAG_NEED_RTNL,
15393         },
15394         {
15395                 .cmd = NL80211_CMD_TDLS_OPER,
15396                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15397                 .doit = nl80211_tdls_oper,
15398                 .flags = GENL_UNS_ADMIN_PERM,
15399                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15400                                   NL80211_FLAG_NEED_RTNL,
15401         },
15402         {
15403                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
15404                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15405                 .doit = nl80211_register_unexpected_frame,
15406                 .flags = GENL_UNS_ADMIN_PERM,
15407                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
15408                                   NL80211_FLAG_NEED_RTNL,
15409         },
15410         {
15411                 .cmd = NL80211_CMD_PROBE_CLIENT,
15412                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15413                 .doit = nl80211_probe_client,
15414                 .flags = GENL_UNS_ADMIN_PERM,
15415                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15416                                   NL80211_FLAG_NEED_RTNL,
15417         },
15418         {
15419                 .cmd = NL80211_CMD_REGISTER_BEACONS,
15420                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15421                 .doit = nl80211_register_beacons,
15422                 .flags = GENL_UNS_ADMIN_PERM,
15423                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
15424                                   NL80211_FLAG_NEED_RTNL,
15425         },
15426         {
15427                 .cmd = NL80211_CMD_SET_NOACK_MAP,
15428                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15429                 .doit = nl80211_set_noack_map,
15430                 .flags = GENL_UNS_ADMIN_PERM,
15431                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
15432                                   NL80211_FLAG_NEED_RTNL,
15433         },
15434         {
15435                 .cmd = NL80211_CMD_START_P2P_DEVICE,
15436                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15437                 .doit = nl80211_start_p2p_device,
15438                 .flags = GENL_UNS_ADMIN_PERM,
15439                 .internal_flags = NL80211_FLAG_NEED_WDEV |
15440                                   NL80211_FLAG_NEED_RTNL,
15441         },
15442         {
15443                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
15444                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15445                 .doit = nl80211_stop_p2p_device,
15446                 .flags = GENL_UNS_ADMIN_PERM,
15447                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15448                                   NL80211_FLAG_NEED_RTNL,
15449         },
15450         {
15451                 .cmd = NL80211_CMD_START_NAN,
15452                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15453                 .doit = nl80211_start_nan,
15454                 .flags = GENL_ADMIN_PERM,
15455                 .internal_flags = NL80211_FLAG_NEED_WDEV |
15456                                   NL80211_FLAG_NEED_RTNL,
15457         },
15458         {
15459                 .cmd = NL80211_CMD_STOP_NAN,
15460                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15461                 .doit = nl80211_stop_nan,
15462                 .flags = GENL_ADMIN_PERM,
15463                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15464                                   NL80211_FLAG_NEED_RTNL,
15465         },
15466         {
15467                 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
15468                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15469                 .doit = nl80211_nan_add_func,
15470                 .flags = GENL_ADMIN_PERM,
15471                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15472                                   NL80211_FLAG_NEED_RTNL,
15473         },
15474         {
15475                 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
15476                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15477                 .doit = nl80211_nan_del_func,
15478                 .flags = GENL_ADMIN_PERM,
15479                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15480                                   NL80211_FLAG_NEED_RTNL,
15481         },
15482         {
15483                 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
15484                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15485                 .doit = nl80211_nan_change_config,
15486                 .flags = GENL_ADMIN_PERM,
15487                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15488                                   NL80211_FLAG_NEED_RTNL,
15489         },
15490         {
15491                 .cmd = NL80211_CMD_SET_MCAST_RATE,
15492                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15493                 .doit = nl80211_set_mcast_rate,
15494                 .flags = GENL_UNS_ADMIN_PERM,
15495                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
15496                                   NL80211_FLAG_NEED_RTNL,
15497         },
15498         {
15499                 .cmd = NL80211_CMD_SET_MAC_ACL,
15500                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15501                 .doit = nl80211_set_mac_acl,
15502                 .flags = GENL_UNS_ADMIN_PERM,
15503                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
15504                                   NL80211_FLAG_NEED_RTNL,
15505         },
15506         {
15507                 .cmd = NL80211_CMD_RADAR_DETECT,
15508                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15509                 .doit = nl80211_start_radar_detection,
15510                 .flags = GENL_UNS_ADMIN_PERM,
15511                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15512                                   NL80211_FLAG_NEED_RTNL,
15513         },
15514         {
15515                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
15516                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15517                 .doit = nl80211_get_protocol_features,
15518         },
15519         {
15520                 .cmd = NL80211_CMD_UPDATE_FT_IES,
15521                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15522                 .doit = nl80211_update_ft_ies,
15523                 .flags = GENL_UNS_ADMIN_PERM,
15524                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15525                                   NL80211_FLAG_NEED_RTNL,
15526         },
15527         {
15528                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
15529                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15530                 .doit = nl80211_crit_protocol_start,
15531                 .flags = GENL_UNS_ADMIN_PERM,
15532                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15533                                   NL80211_FLAG_NEED_RTNL,
15534         },
15535         {
15536                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
15537                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15538                 .doit = nl80211_crit_protocol_stop,
15539                 .flags = GENL_UNS_ADMIN_PERM,
15540                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15541                                   NL80211_FLAG_NEED_RTNL,
15542         },
15543         {
15544                 .cmd = NL80211_CMD_GET_COALESCE,
15545                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15546                 .doit = nl80211_get_coalesce,
15547                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
15548                                   NL80211_FLAG_NEED_RTNL,
15549         },
15550         {
15551                 .cmd = NL80211_CMD_SET_COALESCE,
15552                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15553                 .doit = nl80211_set_coalesce,
15554                 .flags = GENL_UNS_ADMIN_PERM,
15555                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
15556                                   NL80211_FLAG_NEED_RTNL,
15557         },
15558         {
15559                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
15560                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15561                 .doit = nl80211_channel_switch,
15562                 .flags = GENL_UNS_ADMIN_PERM,
15563                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15564                                   NL80211_FLAG_NEED_RTNL,
15565         },
15566         {
15567                 .cmd = NL80211_CMD_VENDOR,
15568                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15569                 .doit = nl80211_vendor_cmd,
15570                 .dumpit = nl80211_vendor_cmd_dump,
15571                 .flags = GENL_UNS_ADMIN_PERM,
15572                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
15573                                   NL80211_FLAG_NEED_RTNL |
15574                                   NL80211_FLAG_CLEAR_SKB,
15575         },
15576         {
15577                 .cmd = NL80211_CMD_SET_QOS_MAP,
15578                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15579                 .doit = nl80211_set_qos_map,
15580                 .flags = GENL_UNS_ADMIN_PERM,
15581                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15582                                   NL80211_FLAG_NEED_RTNL,
15583         },
15584         {
15585                 .cmd = NL80211_CMD_ADD_TX_TS,
15586                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15587                 .doit = nl80211_add_tx_ts,
15588                 .flags = GENL_UNS_ADMIN_PERM,
15589                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15590                                   NL80211_FLAG_NEED_RTNL,
15591         },
15592         {
15593                 .cmd = NL80211_CMD_DEL_TX_TS,
15594                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15595                 .doit = nl80211_del_tx_ts,
15596                 .flags = GENL_UNS_ADMIN_PERM,
15597                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15598                                   NL80211_FLAG_NEED_RTNL,
15599         },
15600         {
15601                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
15602                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15603                 .doit = nl80211_tdls_channel_switch,
15604                 .flags = GENL_UNS_ADMIN_PERM,
15605                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15606                                   NL80211_FLAG_NEED_RTNL,
15607         },
15608         {
15609                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
15610                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15611                 .doit = nl80211_tdls_cancel_channel_switch,
15612                 .flags = GENL_UNS_ADMIN_PERM,
15613                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15614                                   NL80211_FLAG_NEED_RTNL,
15615         },
15616         {
15617                 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
15618                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15619                 .doit = nl80211_set_multicast_to_unicast,
15620                 .flags = GENL_UNS_ADMIN_PERM,
15621                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
15622                                   NL80211_FLAG_NEED_RTNL,
15623         },
15624         {
15625                 .cmd = NL80211_CMD_SET_PMK,
15626                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15627                 .doit = nl80211_set_pmk,
15628                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15629                                   NL80211_FLAG_NEED_RTNL |
15630                                   NL80211_FLAG_CLEAR_SKB,
15631         },
15632         {
15633                 .cmd = NL80211_CMD_DEL_PMK,
15634                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15635                 .doit = nl80211_del_pmk,
15636                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15637                                   NL80211_FLAG_NEED_RTNL,
15638         },
15639         {
15640                 .cmd = NL80211_CMD_EXTERNAL_AUTH,
15641                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15642                 .doit = nl80211_external_auth,
15643                 .flags = GENL_ADMIN_PERM,
15644                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15645                                   NL80211_FLAG_NEED_RTNL,
15646         },
15647         {
15648                 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
15649                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15650                 .doit = nl80211_tx_control_port,
15651                 .flags = GENL_UNS_ADMIN_PERM,
15652                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15653                                   NL80211_FLAG_NEED_RTNL,
15654         },
15655         {
15656                 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
15657                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15658                 .doit = nl80211_get_ftm_responder_stats,
15659                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
15660                                   NL80211_FLAG_NEED_RTNL,
15661         },
15662         {
15663                 .cmd = NL80211_CMD_PEER_MEASUREMENT_START,
15664                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15665                 .doit = nl80211_pmsr_start,
15666                 .flags = GENL_UNS_ADMIN_PERM,
15667                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15668                                   NL80211_FLAG_NEED_RTNL,
15669         },
15670         {
15671                 .cmd = NL80211_CMD_NOTIFY_RADAR,
15672                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15673                 .doit = nl80211_notify_radar_detection,
15674                 .flags = GENL_UNS_ADMIN_PERM,
15675                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15676                                   NL80211_FLAG_NEED_RTNL,
15677         },
15678         {
15679                 .cmd = NL80211_CMD_UPDATE_OWE_INFO,
15680                 .doit = nl80211_update_owe_info,
15681                 .flags = GENL_ADMIN_PERM,
15682                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15683                                   NL80211_FLAG_NEED_RTNL,
15684         },
15685         {
15686                 .cmd = NL80211_CMD_PROBE_MESH_LINK,
15687                 .doit = nl80211_probe_mesh_link,
15688                 .flags = GENL_UNS_ADMIN_PERM,
15689                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15690                                   NL80211_FLAG_NEED_RTNL,
15691         },
15692         {
15693                 .cmd = NL80211_CMD_SET_TID_CONFIG,
15694                 .doit = nl80211_set_tid_config,
15695                 .flags = GENL_UNS_ADMIN_PERM,
15696                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
15697                                   NL80211_FLAG_NEED_RTNL,
15698         },
15699         {
15700                 .cmd = NL80211_CMD_SET_SAR_SPECS,
15701                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15702                 .doit = nl80211_set_sar_specs,
15703                 .flags = GENL_UNS_ADMIN_PERM,
15704                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
15705                                   NL80211_FLAG_NEED_RTNL,
15706         },
15707 };
15708
15709 static struct genl_family nl80211_fam __ro_after_init = {
15710         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
15711         .hdrsize = 0,                   /* no private header */
15712         .version = 1,                   /* no particular meaning now */
15713         .maxattr = NL80211_ATTR_MAX,
15714         .policy = nl80211_policy,
15715         .netnsok = true,
15716         .pre_doit = nl80211_pre_doit,
15717         .post_doit = nl80211_post_doit,
15718         .module = THIS_MODULE,
15719         .ops = nl80211_ops,
15720         .n_ops = ARRAY_SIZE(nl80211_ops),
15721         .small_ops = nl80211_small_ops,
15722         .n_small_ops = ARRAY_SIZE(nl80211_small_ops),
15723         .mcgrps = nl80211_mcgrps,
15724         .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
15725         .parallel_ops = true,
15726 };
15727
15728 /* notification functions */
15729
15730 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
15731                           enum nl80211_commands cmd)
15732 {
15733         struct sk_buff *msg;
15734         struct nl80211_dump_wiphy_state state = {};
15735
15736         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
15737                 cmd != NL80211_CMD_DEL_WIPHY);
15738
15739         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15740         if (!msg)
15741                 return;
15742
15743         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
15744                 nlmsg_free(msg);
15745                 return;
15746         }
15747
15748         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15749                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
15750 }
15751
15752 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
15753                                 struct wireless_dev *wdev,
15754                                 enum nl80211_commands cmd)
15755 {
15756         struct sk_buff *msg;
15757
15758         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15759         if (!msg)
15760                 return;
15761
15762         if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) {
15763                 nlmsg_free(msg);
15764                 return;
15765         }
15766
15767         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15768                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
15769 }
15770
15771 static int nl80211_add_scan_req(struct sk_buff *msg,
15772                                 struct cfg80211_registered_device *rdev)
15773 {
15774         struct cfg80211_scan_request *req = rdev->scan_req;
15775         struct nlattr *nest;
15776         int i;
15777         struct cfg80211_scan_info *info;
15778
15779         if (WARN_ON(!req))
15780                 return 0;
15781
15782         nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS);
15783         if (!nest)
15784                 goto nla_put_failure;
15785         for (i = 0; i < req->n_ssids; i++) {
15786                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
15787                         goto nla_put_failure;
15788         }
15789         nla_nest_end(msg, nest);
15790
15791         if (req->flags & NL80211_SCAN_FLAG_FREQ_KHZ) {
15792                 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQ_KHZ);
15793                 if (!nest)
15794                         goto nla_put_failure;
15795                 for (i = 0; i < req->n_channels; i++) {
15796                         if (nla_put_u32(msg, i,
15797                                    ieee80211_channel_to_khz(req->channels[i])))
15798                                 goto nla_put_failure;
15799                 }
15800                 nla_nest_end(msg, nest);
15801         } else {
15802                 nest = nla_nest_start_noflag(msg,
15803                                              NL80211_ATTR_SCAN_FREQUENCIES);
15804                 if (!nest)
15805                         goto nla_put_failure;
15806                 for (i = 0; i < req->n_channels; i++) {
15807                         if (nla_put_u32(msg, i, req->channels[i]->center_freq))
15808                                 goto nla_put_failure;
15809                 }
15810                 nla_nest_end(msg, nest);
15811         }
15812
15813         if (req->ie &&
15814             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
15815                 goto nla_put_failure;
15816
15817         if (req->flags &&
15818             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
15819                 goto nla_put_failure;
15820
15821         info = rdev->int_scan_req ? &rdev->int_scan_req->info :
15822                 &rdev->scan_req->info;
15823         if (info->scan_start_tsf &&
15824             (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
15825                                info->scan_start_tsf, NL80211_BSS_PAD) ||
15826              nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
15827                      info->tsf_bssid)))
15828                 goto nla_put_failure;
15829
15830         return 0;
15831  nla_put_failure:
15832         return -ENOBUFS;
15833 }
15834
15835 static int nl80211_prep_scan_msg(struct sk_buff *msg,
15836                                  struct cfg80211_registered_device *rdev,
15837                                  struct wireless_dev *wdev,
15838                                  u32 portid, u32 seq, int flags,
15839                                  u32 cmd)
15840 {
15841         void *hdr;
15842
15843         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
15844         if (!hdr)
15845                 return -1;
15846
15847         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15848             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15849                                          wdev->netdev->ifindex)) ||
15850             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15851                               NL80211_ATTR_PAD))
15852                 goto nla_put_failure;
15853
15854         /* ignore errors and send incomplete event anyway */
15855         nl80211_add_scan_req(msg, rdev);
15856
15857         genlmsg_end(msg, hdr);
15858         return 0;
15859
15860  nla_put_failure:
15861         genlmsg_cancel(msg, hdr);
15862         return -EMSGSIZE;
15863 }
15864
15865 static int
15866 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
15867                             struct cfg80211_sched_scan_request *req, u32 cmd)
15868 {
15869         void *hdr;
15870
15871         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
15872         if (!hdr)
15873                 return -1;
15874
15875         if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
15876                         wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
15877             nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
15878             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
15879                               NL80211_ATTR_PAD))
15880                 goto nla_put_failure;
15881
15882         genlmsg_end(msg, hdr);
15883         return 0;
15884
15885  nla_put_failure:
15886         genlmsg_cancel(msg, hdr);
15887         return -EMSGSIZE;
15888 }
15889
15890 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
15891                              struct wireless_dev *wdev)
15892 {
15893         struct sk_buff *msg;
15894
15895         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15896         if (!msg)
15897                 return;
15898
15899         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
15900                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
15901                 nlmsg_free(msg);
15902                 return;
15903         }
15904
15905         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15906                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
15907 }
15908
15909 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
15910                                        struct wireless_dev *wdev, bool aborted)
15911 {
15912         struct sk_buff *msg;
15913
15914         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15915         if (!msg)
15916                 return NULL;
15917
15918         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
15919                                   aborted ? NL80211_CMD_SCAN_ABORTED :
15920                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
15921                 nlmsg_free(msg);
15922                 return NULL;
15923         }
15924
15925         return msg;
15926 }
15927
15928 /* send message created by nl80211_build_scan_msg() */
15929 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
15930                            struct sk_buff *msg)
15931 {
15932         if (!msg)
15933                 return;
15934
15935         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15936                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
15937 }
15938
15939 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
15940 {
15941         struct sk_buff *msg;
15942
15943         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15944         if (!msg)
15945                 return;
15946
15947         if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
15948                 nlmsg_free(msg);
15949                 return;
15950         }
15951
15952         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
15953                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
15954 }
15955
15956 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
15957                                           struct regulatory_request *request)
15958 {
15959         /* Userspace can always count this one always being set */
15960         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
15961                 goto nla_put_failure;
15962
15963         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
15964                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
15965                                NL80211_REGDOM_TYPE_WORLD))
15966                         goto nla_put_failure;
15967         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
15968                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
15969                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
15970                         goto nla_put_failure;
15971         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
15972                    request->intersect) {
15973                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
15974                                NL80211_REGDOM_TYPE_INTERSECTION))
15975                         goto nla_put_failure;
15976         } else {
15977                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
15978                                NL80211_REGDOM_TYPE_COUNTRY) ||
15979                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
15980                                    request->alpha2))
15981                         goto nla_put_failure;
15982         }
15983
15984         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
15985                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
15986
15987                 if (wiphy &&
15988                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
15989                         goto nla_put_failure;
15990
15991                 if (wiphy &&
15992                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
15993                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
15994                         goto nla_put_failure;
15995         }
15996
15997         return true;
15998
15999 nla_put_failure:
16000         return false;
16001 }
16002
16003 /*
16004  * This can happen on global regulatory changes or device specific settings
16005  * based on custom regulatory domains.
16006  */
16007 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
16008                                      struct regulatory_request *request)
16009 {
16010         struct sk_buff *msg;
16011         void *hdr;
16012
16013         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16014         if (!msg)
16015                 return;
16016
16017         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
16018         if (!hdr)
16019                 goto nla_put_failure;
16020
16021         if (!nl80211_reg_change_event_fill(msg, request))
16022                 goto nla_put_failure;
16023
16024         genlmsg_end(msg, hdr);
16025
16026         rcu_read_lock();
16027         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
16028                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
16029         rcu_read_unlock();
16030
16031         return;
16032
16033 nla_put_failure:
16034         nlmsg_free(msg);
16035 }
16036
16037 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
16038                                     struct net_device *netdev,
16039                                     const u8 *buf, size_t len,
16040                                     enum nl80211_commands cmd, gfp_t gfp,
16041                                     int uapsd_queues, const u8 *req_ies,
16042                                     size_t req_ies_len, bool reconnect)
16043 {
16044         struct sk_buff *msg;
16045         void *hdr;
16046
16047         msg = nlmsg_new(100 + len + req_ies_len, gfp);
16048         if (!msg)
16049                 return;
16050
16051         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
16052         if (!hdr) {
16053                 nlmsg_free(msg);
16054                 return;
16055         }
16056
16057         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16058             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16059             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
16060             (req_ies &&
16061              nla_put(msg, NL80211_ATTR_REQ_IE, req_ies_len, req_ies)))
16062                 goto nla_put_failure;
16063
16064         if (reconnect && nla_put_flag(msg, NL80211_ATTR_RECONNECT_REQUESTED))
16065                 goto nla_put_failure;
16066
16067         if (uapsd_queues >= 0) {
16068                 struct nlattr *nla_wmm =
16069                         nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME);
16070                 if (!nla_wmm)
16071                         goto nla_put_failure;
16072
16073                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
16074                                uapsd_queues))
16075                         goto nla_put_failure;
16076
16077                 nla_nest_end(msg, nla_wmm);
16078         }
16079
16080         genlmsg_end(msg, hdr);
16081
16082         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16083                                 NL80211_MCGRP_MLME, gfp);
16084         return;
16085
16086  nla_put_failure:
16087         nlmsg_free(msg);
16088 }
16089
16090 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
16091                           struct net_device *netdev, const u8 *buf,
16092                           size_t len, gfp_t gfp)
16093 {
16094         nl80211_send_mlme_event(rdev, netdev, buf, len,
16095                                 NL80211_CMD_AUTHENTICATE, gfp, -1, NULL, 0,
16096                                 false);
16097 }
16098
16099 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
16100                            struct net_device *netdev, const u8 *buf,
16101                            size_t len, gfp_t gfp, int uapsd_queues,
16102                            const u8 *req_ies, size_t req_ies_len)
16103 {
16104         nl80211_send_mlme_event(rdev, netdev, buf, len,
16105                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues,
16106                                 req_ies, req_ies_len, false);
16107 }
16108
16109 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
16110                          struct net_device *netdev, const u8 *buf,
16111                          size_t len, bool reconnect, gfp_t gfp)
16112 {
16113         nl80211_send_mlme_event(rdev, netdev, buf, len,
16114                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1, NULL, 0,
16115                                 reconnect);
16116 }
16117
16118 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
16119                            struct net_device *netdev, const u8 *buf,
16120                            size_t len, bool reconnect, gfp_t gfp)
16121 {
16122         nl80211_send_mlme_event(rdev, netdev, buf, len,
16123                                 NL80211_CMD_DISASSOCIATE, gfp, -1, NULL, 0,
16124                                 reconnect);
16125 }
16126
16127 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
16128                                   size_t len)
16129 {
16130         struct wireless_dev *wdev = dev->ieee80211_ptr;
16131         struct wiphy *wiphy = wdev->wiphy;
16132         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16133         const struct ieee80211_mgmt *mgmt = (void *)buf;
16134         u32 cmd;
16135
16136         if (WARN_ON(len < 2))
16137                 return;
16138
16139         if (ieee80211_is_deauth(mgmt->frame_control)) {
16140                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
16141         } else if (ieee80211_is_disassoc(mgmt->frame_control)) {
16142                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
16143         } else if (ieee80211_is_beacon(mgmt->frame_control)) {
16144                 if (wdev->unprot_beacon_reported &&
16145                     elapsed_jiffies_msecs(wdev->unprot_beacon_reported) < 10000)
16146                         return;
16147                 cmd = NL80211_CMD_UNPROT_BEACON;
16148                 wdev->unprot_beacon_reported = jiffies;
16149         } else {
16150                 return;
16151         }
16152
16153         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
16154         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1,
16155                                 NULL, 0, false);
16156 }
16157 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
16158
16159 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
16160                                       struct net_device *netdev, int cmd,
16161                                       const u8 *addr, gfp_t gfp)
16162 {
16163         struct sk_buff *msg;
16164         void *hdr;
16165
16166         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16167         if (!msg)
16168                 return;
16169
16170         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
16171         if (!hdr) {
16172                 nlmsg_free(msg);
16173                 return;
16174         }
16175
16176         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16177             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16178             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
16179             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
16180                 goto nla_put_failure;
16181
16182         genlmsg_end(msg, hdr);
16183
16184         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16185                                 NL80211_MCGRP_MLME, gfp);
16186         return;
16187
16188  nla_put_failure:
16189         nlmsg_free(msg);
16190 }
16191
16192 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
16193                                struct net_device *netdev, const u8 *addr,
16194                                gfp_t gfp)
16195 {
16196         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
16197                                   addr, gfp);
16198 }
16199
16200 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
16201                                 struct net_device *netdev, const u8 *addr,
16202                                 gfp_t gfp)
16203 {
16204         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
16205                                   addr, gfp);
16206 }
16207
16208 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
16209                                  struct net_device *netdev,
16210                                  struct cfg80211_connect_resp_params *cr,
16211                                  gfp_t gfp)
16212 {
16213         struct sk_buff *msg;
16214         void *hdr;
16215
16216         msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
16217                         cr->fils.kek_len + cr->fils.pmk_len +
16218                         (cr->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
16219         if (!msg)
16220                 return;
16221
16222         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
16223         if (!hdr) {
16224                 nlmsg_free(msg);
16225                 return;
16226         }
16227
16228         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16229             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16230             (cr->bssid &&
16231              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) ||
16232             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
16233                         cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
16234                         cr->status) ||
16235             (cr->status < 0 &&
16236              (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
16237               nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
16238                           cr->timeout_reason))) ||
16239             (cr->req_ie &&
16240              nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
16241             (cr->resp_ie &&
16242              nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
16243                      cr->resp_ie)) ||
16244             (cr->fils.update_erp_next_seq_num &&
16245              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
16246                          cr->fils.erp_next_seq_num)) ||
16247             (cr->status == WLAN_STATUS_SUCCESS &&
16248              ((cr->fils.kek &&
16249                nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
16250                        cr->fils.kek)) ||
16251               (cr->fils.pmk &&
16252                nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
16253               (cr->fils.pmkid &&
16254                nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
16255                 goto nla_put_failure;
16256
16257         genlmsg_end(msg, hdr);
16258
16259         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16260                                 NL80211_MCGRP_MLME, gfp);
16261         return;
16262
16263  nla_put_failure:
16264         nlmsg_free(msg);
16265 }
16266
16267 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
16268                          struct net_device *netdev,
16269                          struct cfg80211_roam_info *info, gfp_t gfp)
16270 {
16271         struct sk_buff *msg;
16272         void *hdr;
16273         const u8 *bssid = info->bss ? info->bss->bssid : info->bssid;
16274
16275         msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
16276                         info->fils.kek_len + info->fils.pmk_len +
16277                         (info->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
16278         if (!msg)
16279                 return;
16280
16281         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
16282         if (!hdr) {
16283                 nlmsg_free(msg);
16284                 return;
16285         }
16286
16287         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16288             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16289             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
16290             (info->req_ie &&
16291              nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
16292                      info->req_ie)) ||
16293             (info->resp_ie &&
16294              nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
16295                      info->resp_ie)) ||
16296             (info->fils.update_erp_next_seq_num &&
16297              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
16298                          info->fils.erp_next_seq_num)) ||
16299             (info->fils.kek &&
16300              nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
16301                      info->fils.kek)) ||
16302             (info->fils.pmk &&
16303              nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
16304             (info->fils.pmkid &&
16305              nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
16306                 goto nla_put_failure;
16307
16308         genlmsg_end(msg, hdr);
16309
16310         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16311                                 NL80211_MCGRP_MLME, gfp);
16312         return;
16313
16314  nla_put_failure:
16315         nlmsg_free(msg);
16316 }
16317
16318 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
16319                                   struct net_device *netdev, const u8 *bssid)
16320 {
16321         struct sk_buff *msg;
16322         void *hdr;
16323
16324         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16325         if (!msg)
16326                 return;
16327
16328         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
16329         if (!hdr) {
16330                 nlmsg_free(msg);
16331                 return;
16332         }
16333
16334         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16335             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16336             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
16337                 goto nla_put_failure;
16338
16339         genlmsg_end(msg, hdr);
16340
16341         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16342                                 NL80211_MCGRP_MLME, GFP_KERNEL);
16343         return;
16344
16345  nla_put_failure:
16346         nlmsg_free(msg);
16347 }
16348
16349 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
16350                                struct net_device *netdev, u16 reason,
16351                                const u8 *ie, size_t ie_len, bool from_ap)
16352 {
16353         struct sk_buff *msg;
16354         void *hdr;
16355
16356         msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
16357         if (!msg)
16358                 return;
16359
16360         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
16361         if (!hdr) {
16362                 nlmsg_free(msg);
16363                 return;
16364         }
16365
16366         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16367             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16368             (reason &&
16369              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
16370             (from_ap &&
16371              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
16372             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
16373                 goto nla_put_failure;
16374
16375         genlmsg_end(msg, hdr);
16376
16377         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16378                                 NL80211_MCGRP_MLME, GFP_KERNEL);
16379         return;
16380
16381  nla_put_failure:
16382         nlmsg_free(msg);
16383 }
16384
16385 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
16386                              struct net_device *netdev, const u8 *bssid,
16387                              gfp_t gfp)
16388 {
16389         struct sk_buff *msg;
16390         void *hdr;
16391
16392         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16393         if (!msg)
16394                 return;
16395
16396         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
16397         if (!hdr) {
16398                 nlmsg_free(msg);
16399                 return;
16400         }
16401
16402         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16403             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16404             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
16405                 goto nla_put_failure;
16406
16407         genlmsg_end(msg, hdr);
16408
16409         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16410                                 NL80211_MCGRP_MLME, gfp);
16411         return;
16412
16413  nla_put_failure:
16414         nlmsg_free(msg);
16415 }
16416
16417 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
16418                                         const u8 *ie, u8 ie_len,
16419                                         int sig_dbm, gfp_t gfp)
16420 {
16421         struct wireless_dev *wdev = dev->ieee80211_ptr;
16422         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16423         struct sk_buff *msg;
16424         void *hdr;
16425
16426         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
16427                 return;
16428
16429         trace_cfg80211_notify_new_peer_candidate(dev, addr);
16430
16431         msg = nlmsg_new(100 + ie_len, gfp);
16432         if (!msg)
16433                 return;
16434
16435         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
16436         if (!hdr) {
16437                 nlmsg_free(msg);
16438                 return;
16439         }
16440
16441         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16442             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16443             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
16444             (ie_len && ie &&
16445              nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
16446             (sig_dbm &&
16447              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
16448                 goto nla_put_failure;
16449
16450         genlmsg_end(msg, hdr);
16451
16452         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16453                                 NL80211_MCGRP_MLME, gfp);
16454         return;
16455
16456  nla_put_failure:
16457         nlmsg_free(msg);
16458 }
16459 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
16460
16461 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
16462                                  struct net_device *netdev, const u8 *addr,
16463                                  enum nl80211_key_type key_type, int key_id,
16464                                  const u8 *tsc, gfp_t gfp)
16465 {
16466         struct sk_buff *msg;
16467         void *hdr;
16468
16469         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16470         if (!msg)
16471                 return;
16472
16473         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
16474         if (!hdr) {
16475                 nlmsg_free(msg);
16476                 return;
16477         }
16478
16479         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16480             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16481             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
16482             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
16483             (key_id != -1 &&
16484              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
16485             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
16486                 goto nla_put_failure;
16487
16488         genlmsg_end(msg, hdr);
16489
16490         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16491                                 NL80211_MCGRP_MLME, gfp);
16492         return;
16493
16494  nla_put_failure:
16495         nlmsg_free(msg);
16496 }
16497
16498 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
16499                                     struct ieee80211_channel *channel_before,
16500                                     struct ieee80211_channel *channel_after)
16501 {
16502         struct sk_buff *msg;
16503         void *hdr;
16504         struct nlattr *nl_freq;
16505
16506         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
16507         if (!msg)
16508                 return;
16509
16510         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
16511         if (!hdr) {
16512                 nlmsg_free(msg);
16513                 return;
16514         }
16515
16516         /*
16517          * Since we are applying the beacon hint to a wiphy we know its
16518          * wiphy_idx is valid
16519          */
16520         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
16521                 goto nla_put_failure;
16522
16523         /* Before */
16524         nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE);
16525         if (!nl_freq)
16526                 goto nla_put_failure;
16527
16528         if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
16529                 goto nla_put_failure;
16530         nla_nest_end(msg, nl_freq);
16531
16532         /* After */
16533         nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER);
16534         if (!nl_freq)
16535                 goto nla_put_failure;
16536
16537         if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
16538                 goto nla_put_failure;
16539         nla_nest_end(msg, nl_freq);
16540
16541         genlmsg_end(msg, hdr);
16542
16543         rcu_read_lock();
16544         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
16545                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
16546         rcu_read_unlock();
16547
16548         return;
16549
16550 nla_put_failure:
16551         nlmsg_free(msg);
16552 }
16553
16554 static void nl80211_send_remain_on_chan_event(
16555         int cmd, struct cfg80211_registered_device *rdev,
16556         struct wireless_dev *wdev, u64 cookie,
16557         struct ieee80211_channel *chan,
16558         unsigned int duration, gfp_t gfp)
16559 {
16560         struct sk_buff *msg;
16561         void *hdr;
16562
16563         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16564         if (!msg)
16565                 return;
16566
16567         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
16568         if (!hdr) {
16569                 nlmsg_free(msg);
16570                 return;
16571         }
16572
16573         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16574             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16575                                          wdev->netdev->ifindex)) ||
16576             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16577                               NL80211_ATTR_PAD) ||
16578             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
16579             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
16580                         NL80211_CHAN_NO_HT) ||
16581             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
16582                               NL80211_ATTR_PAD))
16583                 goto nla_put_failure;
16584
16585         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
16586             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
16587                 goto nla_put_failure;
16588
16589         genlmsg_end(msg, hdr);
16590
16591         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16592                                 NL80211_MCGRP_MLME, gfp);
16593         return;
16594
16595  nla_put_failure:
16596         nlmsg_free(msg);
16597 }
16598
16599 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
16600                                struct ieee80211_channel *chan,
16601                                unsigned int duration, gfp_t gfp)
16602 {
16603         struct wiphy *wiphy = wdev->wiphy;
16604         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16605
16606         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
16607         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
16608                                           rdev, wdev, cookie, chan,
16609                                           duration, gfp);
16610 }
16611 EXPORT_SYMBOL(cfg80211_ready_on_channel);
16612
16613 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
16614                                         struct ieee80211_channel *chan,
16615                                         gfp_t gfp)
16616 {
16617         struct wiphy *wiphy = wdev->wiphy;
16618         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16619
16620         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
16621         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
16622                                           rdev, wdev, cookie, chan, 0, gfp);
16623 }
16624 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
16625
16626 void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie,
16627                                         struct ieee80211_channel *chan,
16628                                         gfp_t gfp)
16629 {
16630         struct wiphy *wiphy = wdev->wiphy;
16631         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16632
16633         trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan);
16634         nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL,
16635                                           rdev, wdev, cookie, chan, 0, gfp);
16636 }
16637 EXPORT_SYMBOL(cfg80211_tx_mgmt_expired);
16638
16639 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
16640                       struct station_info *sinfo, gfp_t gfp)
16641 {
16642         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
16643         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16644         struct sk_buff *msg;
16645
16646         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
16647
16648         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16649         if (!msg)
16650                 return;
16651
16652         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
16653                                  rdev, dev, mac_addr, sinfo) < 0) {
16654                 nlmsg_free(msg);
16655                 return;
16656         }
16657
16658         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16659                                 NL80211_MCGRP_MLME, gfp);
16660 }
16661 EXPORT_SYMBOL(cfg80211_new_sta);
16662
16663 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
16664                             struct station_info *sinfo, gfp_t gfp)
16665 {
16666         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
16667         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16668         struct sk_buff *msg;
16669         struct station_info empty_sinfo = {};
16670
16671         if (!sinfo)
16672                 sinfo = &empty_sinfo;
16673
16674         trace_cfg80211_del_sta(dev, mac_addr);
16675
16676         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16677         if (!msg) {
16678                 cfg80211_sinfo_release_content(sinfo);
16679                 return;
16680         }
16681
16682         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
16683                                  rdev, dev, mac_addr, sinfo) < 0) {
16684                 nlmsg_free(msg);
16685                 return;
16686         }
16687
16688         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16689                                 NL80211_MCGRP_MLME, gfp);
16690 }
16691 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
16692
16693 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
16694                           enum nl80211_connect_failed_reason reason,
16695                           gfp_t gfp)
16696 {
16697         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
16698         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16699         struct sk_buff *msg;
16700         void *hdr;
16701
16702         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
16703         if (!msg)
16704                 return;
16705
16706         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
16707         if (!hdr) {
16708                 nlmsg_free(msg);
16709                 return;
16710         }
16711
16712         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16713             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
16714             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
16715                 goto nla_put_failure;
16716
16717         genlmsg_end(msg, hdr);
16718
16719         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16720                                 NL80211_MCGRP_MLME, gfp);
16721         return;
16722
16723  nla_put_failure:
16724         nlmsg_free(msg);
16725 }
16726 EXPORT_SYMBOL(cfg80211_conn_failed);
16727
16728 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
16729                                        const u8 *addr, gfp_t gfp)
16730 {
16731         struct wireless_dev *wdev = dev->ieee80211_ptr;
16732         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16733         struct sk_buff *msg;
16734         void *hdr;
16735         u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
16736
16737         if (!nlportid)
16738                 return false;
16739
16740         msg = nlmsg_new(100, gfp);
16741         if (!msg)
16742                 return true;
16743
16744         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
16745         if (!hdr) {
16746                 nlmsg_free(msg);
16747                 return true;
16748         }
16749
16750         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16751             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16752             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
16753                 goto nla_put_failure;
16754
16755         genlmsg_end(msg, hdr);
16756         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
16757         return true;
16758
16759  nla_put_failure:
16760         nlmsg_free(msg);
16761         return true;
16762 }
16763
16764 bool cfg80211_rx_spurious_frame(struct net_device *dev,
16765                                 const u8 *addr, gfp_t gfp)
16766 {
16767         struct wireless_dev *wdev = dev->ieee80211_ptr;
16768         bool ret;
16769
16770         trace_cfg80211_rx_spurious_frame(dev, addr);
16771
16772         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
16773                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
16774                 trace_cfg80211_return_bool(false);
16775                 return false;
16776         }
16777         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
16778                                          addr, gfp);
16779         trace_cfg80211_return_bool(ret);
16780         return ret;
16781 }
16782 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
16783
16784 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
16785                                         const u8 *addr, gfp_t gfp)
16786 {
16787         struct wireless_dev *wdev = dev->ieee80211_ptr;
16788         bool ret;
16789
16790         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
16791
16792         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
16793                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
16794                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
16795                 trace_cfg80211_return_bool(false);
16796                 return false;
16797         }
16798         ret = __nl80211_unexpected_frame(dev,
16799                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
16800                                          addr, gfp);
16801         trace_cfg80211_return_bool(ret);
16802         return ret;
16803 }
16804 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
16805
16806 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
16807                       struct wireless_dev *wdev, u32 nlportid,
16808                       int freq, int sig_dbm,
16809                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
16810 {
16811         struct net_device *netdev = wdev->netdev;
16812         struct sk_buff *msg;
16813         void *hdr;
16814
16815         msg = nlmsg_new(100 + len, gfp);
16816         if (!msg)
16817                 return -ENOMEM;
16818
16819         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
16820         if (!hdr) {
16821                 nlmsg_free(msg);
16822                 return -ENOMEM;
16823         }
16824
16825         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16826             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16827                                         netdev->ifindex)) ||
16828             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16829                               NL80211_ATTR_PAD) ||
16830             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, KHZ_TO_MHZ(freq)) ||
16831             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, freq % 1000) ||
16832             (sig_dbm &&
16833              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
16834             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
16835             (flags &&
16836              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
16837                 goto nla_put_failure;
16838
16839         genlmsg_end(msg, hdr);
16840
16841         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
16842
16843  nla_put_failure:
16844         nlmsg_free(msg);
16845         return -ENOBUFS;
16846 }
16847
16848 static void nl80211_frame_tx_status(struct wireless_dev *wdev, u64 cookie,
16849                                     const u8 *buf, size_t len, bool ack,
16850                                     gfp_t gfp, enum nl80211_commands command)
16851 {
16852         struct wiphy *wiphy = wdev->wiphy;
16853         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16854         struct net_device *netdev = wdev->netdev;
16855         struct sk_buff *msg;
16856         void *hdr;
16857
16858         if (command == NL80211_CMD_FRAME_TX_STATUS)
16859                 trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
16860         else
16861                 trace_cfg80211_control_port_tx_status(wdev, cookie, ack);
16862
16863         msg = nlmsg_new(100 + len, gfp);
16864         if (!msg)
16865                 return;
16866
16867         hdr = nl80211hdr_put(msg, 0, 0, 0, command);
16868         if (!hdr) {
16869                 nlmsg_free(msg);
16870                 return;
16871         }
16872
16873         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16874             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16875                                    netdev->ifindex)) ||
16876             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16877                               NL80211_ATTR_PAD) ||
16878             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
16879             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
16880                               NL80211_ATTR_PAD) ||
16881             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
16882                 goto nla_put_failure;
16883
16884         genlmsg_end(msg, hdr);
16885
16886         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16887                                 NL80211_MCGRP_MLME, gfp);
16888         return;
16889
16890 nla_put_failure:
16891         nlmsg_free(msg);
16892 }
16893
16894 void cfg80211_control_port_tx_status(struct wireless_dev *wdev, u64 cookie,
16895                                      const u8 *buf, size_t len, bool ack,
16896                                      gfp_t gfp)
16897 {
16898         nl80211_frame_tx_status(wdev, cookie, buf, len, ack, gfp,
16899                                 NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS);
16900 }
16901 EXPORT_SYMBOL(cfg80211_control_port_tx_status);
16902
16903 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
16904                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
16905 {
16906         nl80211_frame_tx_status(wdev, cookie, buf, len, ack, gfp,
16907                                 NL80211_CMD_FRAME_TX_STATUS);
16908 }
16909 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
16910
16911 static int __nl80211_rx_control_port(struct net_device *dev,
16912                                      struct sk_buff *skb,
16913                                      bool unencrypted, gfp_t gfp)
16914 {
16915         struct wireless_dev *wdev = dev->ieee80211_ptr;
16916         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16917         struct ethhdr *ehdr = eth_hdr(skb);
16918         const u8 *addr = ehdr->h_source;
16919         u16 proto = be16_to_cpu(skb->protocol);
16920         struct sk_buff *msg;
16921         void *hdr;
16922         struct nlattr *frame;
16923
16924         u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
16925
16926         if (!nlportid)
16927                 return -ENOENT;
16928
16929         msg = nlmsg_new(100 + skb->len, gfp);
16930         if (!msg)
16931                 return -ENOMEM;
16932
16933         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
16934         if (!hdr) {
16935                 nlmsg_free(msg);
16936                 return -ENOBUFS;
16937         }
16938
16939         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16940             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16941             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16942                               NL80211_ATTR_PAD) ||
16943             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
16944             nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
16945             (unencrypted && nla_put_flag(msg,
16946                                          NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
16947                 goto nla_put_failure;
16948
16949         frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
16950         if (!frame)
16951                 goto nla_put_failure;
16952
16953         skb_copy_bits(skb, 0, nla_data(frame), skb->len);
16954         genlmsg_end(msg, hdr);
16955
16956         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
16957
16958  nla_put_failure:
16959         nlmsg_free(msg);
16960         return -ENOBUFS;
16961 }
16962
16963 bool cfg80211_rx_control_port(struct net_device *dev,
16964                               struct sk_buff *skb, bool unencrypted)
16965 {
16966         int ret;
16967
16968         trace_cfg80211_rx_control_port(dev, skb, unencrypted);
16969         ret = __nl80211_rx_control_port(dev, skb, unencrypted, GFP_ATOMIC);
16970         trace_cfg80211_return_bool(ret == 0);
16971         return ret == 0;
16972 }
16973 EXPORT_SYMBOL(cfg80211_rx_control_port);
16974
16975 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
16976                                             const char *mac, gfp_t gfp)
16977 {
16978         struct wireless_dev *wdev = dev->ieee80211_ptr;
16979         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16980         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16981         void **cb;
16982
16983         if (!msg)
16984                 return NULL;
16985
16986         cb = (void **)msg->cb;
16987
16988         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
16989         if (!cb[0]) {
16990                 nlmsg_free(msg);
16991                 return NULL;
16992         }
16993
16994         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16995             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
16996                 goto nla_put_failure;
16997
16998         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
16999                 goto nla_put_failure;
17000
17001         cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM);
17002         if (!cb[1])
17003                 goto nla_put_failure;
17004
17005         cb[2] = rdev;
17006
17007         return msg;
17008  nla_put_failure:
17009         nlmsg_free(msg);
17010         return NULL;
17011 }
17012
17013 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
17014 {
17015         void **cb = (void **)msg->cb;
17016         struct cfg80211_registered_device *rdev = cb[2];
17017
17018         nla_nest_end(msg, cb[1]);
17019         genlmsg_end(msg, cb[0]);
17020
17021         memset(msg->cb, 0, sizeof(msg->cb));
17022
17023         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17024                                 NL80211_MCGRP_MLME, gfp);
17025 }
17026
17027 void cfg80211_cqm_rssi_notify(struct net_device *dev,
17028                               enum nl80211_cqm_rssi_threshold_event rssi_event,
17029                               s32 rssi_level, gfp_t gfp)
17030 {
17031         struct sk_buff *msg;
17032         struct wireless_dev *wdev = dev->ieee80211_ptr;
17033         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17034
17035         trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
17036
17037         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
17038                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
17039                 return;
17040
17041         if (wdev->cqm_config) {
17042                 wdev->cqm_config->last_rssi_event_value = rssi_level;
17043
17044                 cfg80211_cqm_rssi_update(rdev, dev);
17045
17046                 if (rssi_level == 0)
17047                         rssi_level = wdev->cqm_config->last_rssi_event_value;
17048         }
17049
17050         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
17051         if (!msg)
17052                 return;
17053
17054         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
17055                         rssi_event))
17056                 goto nla_put_failure;
17057
17058         if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
17059                                       rssi_level))
17060                 goto nla_put_failure;
17061
17062         cfg80211_send_cqm(msg, gfp);
17063
17064         return;
17065
17066  nla_put_failure:
17067         nlmsg_free(msg);
17068 }
17069 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
17070
17071 void cfg80211_cqm_txe_notify(struct net_device *dev,
17072                              const u8 *peer, u32 num_packets,
17073                              u32 rate, u32 intvl, gfp_t gfp)
17074 {
17075         struct sk_buff *msg;
17076
17077         msg = cfg80211_prepare_cqm(dev, peer, gfp);
17078         if (!msg)
17079                 return;
17080
17081         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
17082                 goto nla_put_failure;
17083
17084         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
17085                 goto nla_put_failure;
17086
17087         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
17088                 goto nla_put_failure;
17089
17090         cfg80211_send_cqm(msg, gfp);
17091         return;
17092
17093  nla_put_failure:
17094         nlmsg_free(msg);
17095 }
17096 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
17097
17098 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
17099                                  const u8 *peer, u32 num_packets, gfp_t gfp)
17100 {
17101         struct sk_buff *msg;
17102
17103         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
17104
17105         msg = cfg80211_prepare_cqm(dev, peer, gfp);
17106         if (!msg)
17107                 return;
17108
17109         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
17110                 goto nla_put_failure;
17111
17112         cfg80211_send_cqm(msg, gfp);
17113         return;
17114
17115  nla_put_failure:
17116         nlmsg_free(msg);
17117 }
17118 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
17119
17120 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
17121 {
17122         struct sk_buff *msg;
17123
17124         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
17125         if (!msg)
17126                 return;
17127
17128         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
17129                 goto nla_put_failure;
17130
17131         cfg80211_send_cqm(msg, gfp);
17132         return;
17133
17134  nla_put_failure:
17135         nlmsg_free(msg);
17136 }
17137 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
17138
17139 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
17140                                      struct net_device *netdev, const u8 *bssid,
17141                                      const u8 *replay_ctr, gfp_t gfp)
17142 {
17143         struct sk_buff *msg;
17144         struct nlattr *rekey_attr;
17145         void *hdr;
17146
17147         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17148         if (!msg)
17149                 return;
17150
17151         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
17152         if (!hdr) {
17153                 nlmsg_free(msg);
17154                 return;
17155         }
17156
17157         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17158             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17159             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
17160                 goto nla_put_failure;
17161
17162         rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA);
17163         if (!rekey_attr)
17164                 goto nla_put_failure;
17165
17166         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
17167                     NL80211_REPLAY_CTR_LEN, replay_ctr))
17168                 goto nla_put_failure;
17169
17170         nla_nest_end(msg, rekey_attr);
17171
17172         genlmsg_end(msg, hdr);
17173
17174         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17175                                 NL80211_MCGRP_MLME, gfp);
17176         return;
17177
17178  nla_put_failure:
17179         nlmsg_free(msg);
17180 }
17181
17182 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
17183                                const u8 *replay_ctr, gfp_t gfp)
17184 {
17185         struct wireless_dev *wdev = dev->ieee80211_ptr;
17186         struct wiphy *wiphy = wdev->wiphy;
17187         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17188
17189         trace_cfg80211_gtk_rekey_notify(dev, bssid);
17190         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
17191 }
17192 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
17193
17194 static void
17195 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
17196                                struct net_device *netdev, int index,
17197                                const u8 *bssid, bool preauth, gfp_t gfp)
17198 {
17199         struct sk_buff *msg;
17200         struct nlattr *attr;
17201         void *hdr;
17202
17203         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17204         if (!msg)
17205                 return;
17206
17207         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
17208         if (!hdr) {
17209                 nlmsg_free(msg);
17210                 return;
17211         }
17212
17213         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17214             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
17215                 goto nla_put_failure;
17216
17217         attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE);
17218         if (!attr)
17219                 goto nla_put_failure;
17220
17221         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
17222             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
17223             (preauth &&
17224              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
17225                 goto nla_put_failure;
17226
17227         nla_nest_end(msg, attr);
17228
17229         genlmsg_end(msg, hdr);
17230
17231         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17232                                 NL80211_MCGRP_MLME, gfp);
17233         return;
17234
17235  nla_put_failure:
17236         nlmsg_free(msg);
17237 }
17238
17239 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
17240                                      const u8 *bssid, bool preauth, gfp_t gfp)
17241 {
17242         struct wireless_dev *wdev = dev->ieee80211_ptr;
17243         struct wiphy *wiphy = wdev->wiphy;
17244         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17245
17246         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
17247         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
17248 }
17249 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
17250
17251 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
17252                                      struct net_device *netdev,
17253                                      struct cfg80211_chan_def *chandef,
17254                                      gfp_t gfp,
17255                                      enum nl80211_commands notif,
17256                                      u8 count, bool quiet)
17257 {
17258         struct sk_buff *msg;
17259         void *hdr;
17260
17261         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17262         if (!msg)
17263                 return;
17264
17265         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
17266         if (!hdr) {
17267                 nlmsg_free(msg);
17268                 return;
17269         }
17270
17271         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
17272                 goto nla_put_failure;
17273
17274         if (nl80211_send_chandef(msg, chandef))
17275                 goto nla_put_failure;
17276
17277         if (notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) {
17278                 if (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count))
17279                         goto nla_put_failure;
17280                 if (quiet &&
17281                     nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX))
17282                         goto nla_put_failure;
17283         }
17284
17285         genlmsg_end(msg, hdr);
17286
17287         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17288                                 NL80211_MCGRP_MLME, gfp);
17289         return;
17290
17291  nla_put_failure:
17292         nlmsg_free(msg);
17293 }
17294
17295 void cfg80211_ch_switch_notify(struct net_device *dev,
17296                                struct cfg80211_chan_def *chandef)
17297 {
17298         struct wireless_dev *wdev = dev->ieee80211_ptr;
17299         struct wiphy *wiphy = wdev->wiphy;
17300         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17301
17302         ASSERT_WDEV_LOCK(wdev);
17303
17304         trace_cfg80211_ch_switch_notify(dev, chandef);
17305
17306         wdev->chandef = *chandef;
17307         wdev->preset_chandef = *chandef;
17308
17309         if (wdev->iftype == NL80211_IFTYPE_STATION &&
17310             !WARN_ON(!wdev->current_bss))
17311                 cfg80211_update_assoc_bss_entry(wdev, chandef->chan);
17312
17313         cfg80211_sched_dfs_chan_update(rdev);
17314
17315         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
17316                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0, false);
17317 }
17318 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
17319
17320 void cfg80211_ch_switch_started_notify(struct net_device *dev,
17321                                        struct cfg80211_chan_def *chandef,
17322                                        u8 count, bool quiet)
17323 {
17324         struct wireless_dev *wdev = dev->ieee80211_ptr;
17325         struct wiphy *wiphy = wdev->wiphy;
17326         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17327
17328         trace_cfg80211_ch_switch_started_notify(dev, chandef);
17329
17330         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
17331                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY,
17332                                  count, quiet);
17333 }
17334 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
17335
17336 void
17337 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
17338                      const struct cfg80211_chan_def *chandef,
17339                      enum nl80211_radar_event event,
17340                      struct net_device *netdev, gfp_t gfp)
17341 {
17342         struct sk_buff *msg;
17343         void *hdr;
17344
17345         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17346         if (!msg)
17347                 return;
17348
17349         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
17350         if (!hdr) {
17351                 nlmsg_free(msg);
17352                 return;
17353         }
17354
17355         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
17356                 goto nla_put_failure;
17357
17358         /* NOP and radar events don't need a netdev parameter */
17359         if (netdev) {
17360                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
17361
17362                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17363                     nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17364                                       NL80211_ATTR_PAD))
17365                         goto nla_put_failure;
17366         }
17367
17368         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
17369                 goto nla_put_failure;
17370
17371         if (nl80211_send_chandef(msg, chandef))
17372                 goto nla_put_failure;
17373
17374         genlmsg_end(msg, hdr);
17375
17376         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17377                                 NL80211_MCGRP_MLME, gfp);
17378         return;
17379
17380  nla_put_failure:
17381         nlmsg_free(msg);
17382 }
17383
17384 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
17385                                        struct sta_opmode_info *sta_opmode,
17386                                        gfp_t gfp)
17387 {
17388         struct sk_buff *msg;
17389         struct wireless_dev *wdev = dev->ieee80211_ptr;
17390         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17391         void *hdr;
17392
17393         if (WARN_ON(!mac))
17394                 return;
17395
17396         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17397         if (!msg)
17398                 return;
17399
17400         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
17401         if (!hdr) {
17402                 nlmsg_free(msg);
17403                 return;
17404         }
17405
17406         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
17407                 goto nla_put_failure;
17408
17409         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
17410                 goto nla_put_failure;
17411
17412         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
17413                 goto nla_put_failure;
17414
17415         if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
17416             nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
17417                 goto nla_put_failure;
17418
17419         if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
17420             nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
17421                 goto nla_put_failure;
17422
17423         if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
17424             nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
17425                 goto nla_put_failure;
17426
17427         genlmsg_end(msg, hdr);
17428
17429         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17430                                 NL80211_MCGRP_MLME, gfp);
17431
17432         return;
17433
17434 nla_put_failure:
17435         nlmsg_free(msg);
17436 }
17437 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
17438
17439 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
17440                            u64 cookie, bool acked, s32 ack_signal,
17441                            bool is_valid_ack_signal, gfp_t gfp)
17442 {
17443         struct wireless_dev *wdev = dev->ieee80211_ptr;
17444         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17445         struct sk_buff *msg;
17446         void *hdr;
17447
17448         trace_cfg80211_probe_status(dev, addr, cookie, acked);
17449
17450         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17451
17452         if (!msg)
17453                 return;
17454
17455         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
17456         if (!hdr) {
17457                 nlmsg_free(msg);
17458                 return;
17459         }
17460
17461         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17462             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
17463             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
17464             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
17465                               NL80211_ATTR_PAD) ||
17466             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
17467             (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
17468                                                 ack_signal)))
17469                 goto nla_put_failure;
17470
17471         genlmsg_end(msg, hdr);
17472
17473         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17474                                 NL80211_MCGRP_MLME, gfp);
17475         return;
17476
17477  nla_put_failure:
17478         nlmsg_free(msg);
17479 }
17480 EXPORT_SYMBOL(cfg80211_probe_status);
17481
17482 void cfg80211_report_obss_beacon_khz(struct wiphy *wiphy, const u8 *frame,
17483                                      size_t len, int freq, int sig_dbm)
17484 {
17485         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17486         struct sk_buff *msg;
17487         void *hdr;
17488         struct cfg80211_beacon_registration *reg;
17489
17490         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
17491
17492         spin_lock_bh(&rdev->beacon_registrations_lock);
17493         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
17494                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
17495                 if (!msg) {
17496                         spin_unlock_bh(&rdev->beacon_registrations_lock);
17497                         return;
17498                 }
17499
17500                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
17501                 if (!hdr)
17502                         goto nla_put_failure;
17503
17504                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17505                     (freq &&
17506                      (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
17507                                   KHZ_TO_MHZ(freq)) ||
17508                       nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
17509                                   freq % 1000))) ||
17510                     (sig_dbm &&
17511                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
17512                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
17513                         goto nla_put_failure;
17514
17515                 genlmsg_end(msg, hdr);
17516
17517                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
17518         }
17519         spin_unlock_bh(&rdev->beacon_registrations_lock);
17520         return;
17521
17522  nla_put_failure:
17523         spin_unlock_bh(&rdev->beacon_registrations_lock);
17524         nlmsg_free(msg);
17525 }
17526 EXPORT_SYMBOL(cfg80211_report_obss_beacon_khz);
17527
17528 #ifdef CONFIG_PM
17529 static int cfg80211_net_detect_results(struct sk_buff *msg,
17530                                        struct cfg80211_wowlan_wakeup *wakeup)
17531 {
17532         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
17533         struct nlattr *nl_results, *nl_match, *nl_freqs;
17534         int i, j;
17535
17536         nl_results = nla_nest_start_noflag(msg,
17537                                            NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
17538         if (!nl_results)
17539                 return -EMSGSIZE;
17540
17541         for (i = 0; i < nd->n_matches; i++) {
17542                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
17543
17544                 nl_match = nla_nest_start_noflag(msg, i);
17545                 if (!nl_match)
17546                         break;
17547
17548                 /* The SSID attribute is optional in nl80211, but for
17549                  * simplicity reasons it's always present in the
17550                  * cfg80211 structure.  If a driver can't pass the
17551                  * SSID, that needs to be changed.  A zero length SSID
17552                  * is still a valid SSID (wildcard), so it cannot be
17553                  * used for this purpose.
17554                  */
17555                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
17556                             match->ssid.ssid)) {
17557                         nla_nest_cancel(msg, nl_match);
17558                         goto out;
17559                 }
17560
17561                 if (match->n_channels) {
17562                         nl_freqs = nla_nest_start_noflag(msg,
17563                                                          NL80211_ATTR_SCAN_FREQUENCIES);
17564                         if (!nl_freqs) {
17565                                 nla_nest_cancel(msg, nl_match);
17566                                 goto out;
17567                         }
17568
17569                         for (j = 0; j < match->n_channels; j++) {
17570                                 if (nla_put_u32(msg, j, match->channels[j])) {
17571                                         nla_nest_cancel(msg, nl_freqs);
17572                                         nla_nest_cancel(msg, nl_match);
17573                                         goto out;
17574                                 }
17575                         }
17576
17577                         nla_nest_end(msg, nl_freqs);
17578                 }
17579
17580                 nla_nest_end(msg, nl_match);
17581         }
17582
17583 out:
17584         nla_nest_end(msg, nl_results);
17585         return 0;
17586 }
17587
17588 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
17589                                    struct cfg80211_wowlan_wakeup *wakeup,
17590                                    gfp_t gfp)
17591 {
17592         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17593         struct sk_buff *msg;
17594         void *hdr;
17595         int size = 200;
17596
17597         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
17598
17599         if (wakeup)
17600                 size += wakeup->packet_present_len;
17601
17602         msg = nlmsg_new(size, gfp);
17603         if (!msg)
17604                 return;
17605
17606         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
17607         if (!hdr)
17608                 goto free_msg;
17609
17610         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17611             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17612                               NL80211_ATTR_PAD))
17613                 goto free_msg;
17614
17615         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
17616                                         wdev->netdev->ifindex))
17617                 goto free_msg;
17618
17619         if (wakeup) {
17620                 struct nlattr *reasons;
17621
17622                 reasons = nla_nest_start_noflag(msg,
17623                                                 NL80211_ATTR_WOWLAN_TRIGGERS);
17624                 if (!reasons)
17625                         goto free_msg;
17626
17627                 if (wakeup->disconnect &&
17628                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
17629                         goto free_msg;
17630                 if (wakeup->magic_pkt &&
17631                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
17632                         goto free_msg;
17633                 if (wakeup->gtk_rekey_failure &&
17634                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
17635                         goto free_msg;
17636                 if (wakeup->eap_identity_req &&
17637                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
17638                         goto free_msg;
17639                 if (wakeup->four_way_handshake &&
17640                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
17641                         goto free_msg;
17642                 if (wakeup->rfkill_release &&
17643                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
17644                         goto free_msg;
17645
17646                 if (wakeup->pattern_idx >= 0 &&
17647                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
17648                                 wakeup->pattern_idx))
17649                         goto free_msg;
17650
17651                 if (wakeup->tcp_match &&
17652                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
17653                         goto free_msg;
17654
17655                 if (wakeup->tcp_connlost &&
17656                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
17657                         goto free_msg;
17658
17659                 if (wakeup->tcp_nomoretokens &&
17660                     nla_put_flag(msg,
17661                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
17662                         goto free_msg;
17663
17664                 if (wakeup->packet) {
17665                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
17666                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
17667
17668                         if (!wakeup->packet_80211) {
17669                                 pkt_attr =
17670                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
17671                                 len_attr =
17672                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
17673                         }
17674
17675                         if (wakeup->packet_len &&
17676                             nla_put_u32(msg, len_attr, wakeup->packet_len))
17677                                 goto free_msg;
17678
17679                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
17680                                     wakeup->packet))
17681                                 goto free_msg;
17682                 }
17683
17684                 if (wakeup->net_detect &&
17685                     cfg80211_net_detect_results(msg, wakeup))
17686                                 goto free_msg;
17687
17688                 nla_nest_end(msg, reasons);
17689         }
17690
17691         genlmsg_end(msg, hdr);
17692
17693         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17694                                 NL80211_MCGRP_MLME, gfp);
17695         return;
17696
17697  free_msg:
17698         nlmsg_free(msg);
17699 }
17700 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
17701 #endif
17702
17703 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
17704                                 enum nl80211_tdls_operation oper,
17705                                 u16 reason_code, gfp_t gfp)
17706 {
17707         struct wireless_dev *wdev = dev->ieee80211_ptr;
17708         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17709         struct sk_buff *msg;
17710         void *hdr;
17711
17712         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
17713                                          reason_code);
17714
17715         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17716         if (!msg)
17717                 return;
17718
17719         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
17720         if (!hdr) {
17721                 nlmsg_free(msg);
17722                 return;
17723         }
17724
17725         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17726             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
17727             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
17728             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
17729             (reason_code > 0 &&
17730              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
17731                 goto nla_put_failure;
17732
17733         genlmsg_end(msg, hdr);
17734
17735         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17736                                 NL80211_MCGRP_MLME, gfp);
17737         return;
17738
17739  nla_put_failure:
17740         nlmsg_free(msg);
17741 }
17742 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
17743
17744 static int nl80211_netlink_notify(struct notifier_block * nb,
17745                                   unsigned long state,
17746                                   void *_notify)
17747 {
17748         struct netlink_notify *notify = _notify;
17749         struct cfg80211_registered_device *rdev;
17750         struct wireless_dev *wdev;
17751         struct cfg80211_beacon_registration *reg, *tmp;
17752
17753         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
17754                 return NOTIFY_DONE;
17755
17756         rcu_read_lock();
17757
17758         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
17759                 struct cfg80211_sched_scan_request *sched_scan_req;
17760
17761                 list_for_each_entry_rcu(sched_scan_req,
17762                                         &rdev->sched_scan_req_list,
17763                                         list) {
17764                         if (sched_scan_req->owner_nlportid == notify->portid) {
17765                                 sched_scan_req->nl_owner_dead = true;
17766                                 schedule_work(&rdev->sched_scan_stop_wk);
17767                         }
17768                 }
17769
17770                 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
17771                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
17772
17773                         if (wdev->owner_nlportid == notify->portid) {
17774                                 wdev->nl_owner_dead = true;
17775                                 schedule_work(&rdev->destroy_work);
17776                         } else if (wdev->conn_owner_nlportid == notify->portid) {
17777                                 schedule_work(&wdev->disconnect_wk);
17778                         }
17779
17780                         cfg80211_release_pmsr(wdev, notify->portid);
17781                 }
17782
17783                 spin_lock_bh(&rdev->beacon_registrations_lock);
17784                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
17785                                          list) {
17786                         if (reg->nlportid == notify->portid) {
17787                                 list_del(&reg->list);
17788                                 kfree(reg);
17789                                 break;
17790                         }
17791                 }
17792                 spin_unlock_bh(&rdev->beacon_registrations_lock);
17793         }
17794
17795         rcu_read_unlock();
17796
17797         /*
17798          * It is possible that the user space process that is controlling the
17799          * indoor setting disappeared, so notify the regulatory core.
17800          */
17801         regulatory_netlink_notify(notify->portid);
17802         return NOTIFY_OK;
17803 }
17804
17805 static struct notifier_block nl80211_netlink_notifier = {
17806         .notifier_call = nl80211_netlink_notify,
17807 };
17808
17809 void cfg80211_ft_event(struct net_device *netdev,
17810                        struct cfg80211_ft_event_params *ft_event)
17811 {
17812         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
17813         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17814         struct sk_buff *msg;
17815         void *hdr;
17816
17817         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
17818
17819         if (!ft_event->target_ap)
17820                 return;
17821
17822         msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
17823                         GFP_KERNEL);
17824         if (!msg)
17825                 return;
17826
17827         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
17828         if (!hdr)
17829                 goto out;
17830
17831         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17832             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17833             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
17834                 goto out;
17835
17836         if (ft_event->ies &&
17837             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
17838                 goto out;
17839         if (ft_event->ric_ies &&
17840             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
17841                     ft_event->ric_ies))
17842                 goto out;
17843
17844         genlmsg_end(msg, hdr);
17845
17846         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17847                                 NL80211_MCGRP_MLME, GFP_KERNEL);
17848         return;
17849  out:
17850         nlmsg_free(msg);
17851 }
17852 EXPORT_SYMBOL(cfg80211_ft_event);
17853
17854 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
17855 {
17856         struct cfg80211_registered_device *rdev;
17857         struct sk_buff *msg;
17858         void *hdr;
17859         u32 nlportid;
17860
17861         rdev = wiphy_to_rdev(wdev->wiphy);
17862         if (!rdev->crit_proto_nlportid)
17863                 return;
17864
17865         nlportid = rdev->crit_proto_nlportid;
17866         rdev->crit_proto_nlportid = 0;
17867
17868         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17869         if (!msg)
17870                 return;
17871
17872         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
17873         if (!hdr)
17874                 goto nla_put_failure;
17875
17876         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17877             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17878                               NL80211_ATTR_PAD))
17879                 goto nla_put_failure;
17880
17881         genlmsg_end(msg, hdr);
17882
17883         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
17884         return;
17885
17886  nla_put_failure:
17887         nlmsg_free(msg);
17888 }
17889 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
17890
17891 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
17892 {
17893         struct wiphy *wiphy = wdev->wiphy;
17894         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17895         struct sk_buff *msg;
17896         void *hdr;
17897
17898         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17899         if (!msg)
17900                 return;
17901
17902         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
17903         if (!hdr)
17904                 goto out;
17905
17906         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17907             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
17908             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17909                               NL80211_ATTR_PAD))
17910                 goto out;
17911
17912         genlmsg_end(msg, hdr);
17913
17914         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
17915                                 NL80211_MCGRP_MLME, GFP_KERNEL);
17916         return;
17917  out:
17918         nlmsg_free(msg);
17919 }
17920
17921 int cfg80211_external_auth_request(struct net_device *dev,
17922                                    struct cfg80211_external_auth_params *params,
17923                                    gfp_t gfp)
17924 {
17925         struct wireless_dev *wdev = dev->ieee80211_ptr;
17926         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17927         struct sk_buff *msg;
17928         void *hdr;
17929
17930         if (!wdev->conn_owner_nlportid)
17931                 return -EINVAL;
17932
17933         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17934         if (!msg)
17935                 return -ENOMEM;
17936
17937         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
17938         if (!hdr)
17939                 goto nla_put_failure;
17940
17941         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17942             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
17943             nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) ||
17944             nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
17945                         params->action) ||
17946             nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
17947             nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
17948                     params->ssid.ssid))
17949                 goto nla_put_failure;
17950
17951         genlmsg_end(msg, hdr);
17952         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
17953                         wdev->conn_owner_nlportid);
17954         return 0;
17955
17956  nla_put_failure:
17957         nlmsg_free(msg);
17958         return -ENOBUFS;
17959 }
17960 EXPORT_SYMBOL(cfg80211_external_auth_request);
17961
17962 void cfg80211_update_owe_info_event(struct net_device *netdev,
17963                                     struct cfg80211_update_owe_info *owe_info,
17964                                     gfp_t gfp)
17965 {
17966         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
17967         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17968         struct sk_buff *msg;
17969         void *hdr;
17970
17971         trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info);
17972
17973         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17974         if (!msg)
17975                 return;
17976
17977         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO);
17978         if (!hdr)
17979                 goto nla_put_failure;
17980
17981         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17982             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17983             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer))
17984                 goto nla_put_failure;
17985
17986         if (!owe_info->ie_len ||
17987             nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie))
17988                 goto nla_put_failure;
17989
17990         genlmsg_end(msg, hdr);
17991
17992         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17993                                 NL80211_MCGRP_MLME, gfp);
17994         return;
17995
17996 nla_put_failure:
17997         genlmsg_cancel(msg, hdr);
17998         nlmsg_free(msg);
17999 }
18000 EXPORT_SYMBOL(cfg80211_update_owe_info_event);
18001
18002 /* initialisation/exit functions */
18003
18004 int __init nl80211_init(void)
18005 {
18006         int err;
18007
18008         err = genl_register_family(&nl80211_fam);
18009         if (err)
18010                 return err;
18011
18012         err = netlink_register_notifier(&nl80211_netlink_notifier);
18013         if (err)
18014                 goto err_out;
18015
18016         return 0;
18017  err_out:
18018         genl_unregister_family(&nl80211_fam);
18019         return err;
18020 }
18021
18022 void nl80211_exit(void)
18023 {
18024         netlink_unregister_notifier(&nl80211_netlink_notifier);
18025         genl_unregister_family(&nl80211_fam);
18026 }