net/wireless/nl80211.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * This is the new netlink-based wireless configuration interface.
   4  *
   5  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   6  * Copyright 2013-2014  Intel Mobile Communications GmbH
   7  * Copyright 2015-2017  Intel Deutschland GmbH
   8  * Copyright (C) 2018-2019 Intel Corporation
   9  */
  10
  11 #include <linux/if.h>
  12 #include <linux/module.h>
  13 #include <linux/err.h>
  14 #include <linux/slab.h>
  15 #include <linux/list.h>
  16 #include <linux/if_ether.h>
  17 #include <linux/ieee80211.h>
  18 #include <linux/nl80211.h>
  19 #include <linux/rtnetlink.h>
  20 #include <linux/netlink.h>
  21 #include <linux/nospec.h>
  22 #include <linux/etherdevice.h>
  23 #include <net/net_namespace.h>
  24 #include <net/genetlink.h>
  25 #include <net/cfg80211.h>
  26 #include <net/sock.h>
  27 #include <net/inet_connection_sock.h>
  28 #include "core.h"
  29 #include "nl80211.h"
  30 #include "reg.h"
  31 #include "rdev-ops.h"
  32
  33 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  34                                    struct genl_info *info,
  35                                    struct cfg80211_crypto_settings *settings,
  36                                    int cipher_limit);
  37
  38 /* the netlink family */
  39 static struct genl_family nl80211_fam;
  40
  41 /* multicast groups */
  42 enum nl80211_multicast_groups {
  43         NL80211_MCGRP_CONFIG,
  44         NL80211_MCGRP_SCAN,
  45         NL80211_MCGRP_REGULATORY,
  46         NL80211_MCGRP_MLME,
  47         NL80211_MCGRP_VENDOR,
  48         NL80211_MCGRP_NAN,
  49         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  50 };
  51
  52 static const struct genl_multicast_group nl80211_mcgrps[] = {
  53         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  54         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  55         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  56         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  57         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  58         [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
  59 #ifdef CONFIG_NL80211_TESTMODE
  60         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  61 #endif
  62 };
  63
  64 /* returns ERR_PTR values */
  65 static struct wireless_dev *
  66 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  67 {
  68         struct cfg80211_registered_device *rdev;
  69         struct wireless_dev *result = NULL;
  70         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  71         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  72         u64 wdev_id;
  73         int wiphy_idx = -1;
  74         int ifidx = -1;
  75
  76         ASSERT_RTNL();
  77
  78         if (!have_ifidx && !have_wdev_id)
  79                 return ERR_PTR(-EINVAL);
  80
  81         if (have_ifidx)
  82                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  83         if (have_wdev_id) {
  84                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  85                 wiphy_idx = wdev_id >> 32;
  86         }
  87
  88         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  89                 struct wireless_dev *wdev;
  90
  91                 if (wiphy_net(&rdev->wiphy) != netns)
  92                         continue;
  93
  94                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  95                         continue;
  96
  97                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
  98                         if (have_ifidx && wdev->netdev &&
  99                             wdev->netdev->ifindex == ifidx) {
 100                                 result = wdev;
 101                                 break;
 102                         }
 103                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 104                                 result = wdev;
 105                                 break;
 106                         }
 107                 }
 108
 109                 if (result)
 110                         break;
 111         }
 112
 113         if (result)
 114                 return result;
 115         return ERR_PTR(-ENODEV);
 116 }
 117
 118 static struct cfg80211_registered_device *
 119 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 120 {
 121         struct cfg80211_registered_device *rdev = NULL, *tmp;
 122         struct net_device *netdev;
 123
 124         ASSERT_RTNL();
 125
 126         if (!attrs[NL80211_ATTR_WIPHY] &&
 127             !attrs[NL80211_ATTR_IFINDEX] &&
 128             !attrs[NL80211_ATTR_WDEV])
 129                 return ERR_PTR(-EINVAL);
 130
 131         if (attrs[NL80211_ATTR_WIPHY])
 132                 rdev = cfg80211_rdev_by_wiphy_idx(
 133                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 134
 135         if (attrs[NL80211_ATTR_WDEV]) {
 136                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 137                 struct wireless_dev *wdev;
 138                 bool found = false;
 139
 140                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 141                 if (tmp) {
 142                         /* make sure wdev exists */
 143                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 144                                 if (wdev->identifier != (u32)wdev_id)
 145                                         continue;
 146                                 found = true;
 147                                 break;
 148                         }
 149
 150                         if (!found)
 151                                 tmp = NULL;
 152
 153                         if (rdev && tmp != rdev)
 154                                 return ERR_PTR(-EINVAL);
 155                         rdev = tmp;
 156                 }
 157         }
 158
 159         if (attrs[NL80211_ATTR_IFINDEX]) {
 160                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 161
 162                 netdev = __dev_get_by_index(netns, ifindex);
 163                 if (netdev) {
 164                         if (netdev->ieee80211_ptr)
 165                                 tmp = wiphy_to_rdev(
 166                                         netdev->ieee80211_ptr->wiphy);
 167                         else
 168                                 tmp = NULL;
 169
 170                         /* not wireless device -- return error */
 171                         if (!tmp)
 172                                 return ERR_PTR(-EINVAL);
 173
 174                         /* mismatch -- return error */
 175                         if (rdev && tmp != rdev)
 176                                 return ERR_PTR(-EINVAL);
 177
 178                         rdev = tmp;
 179                 }
 180         }
 181
 182         if (!rdev)
 183                 return ERR_PTR(-ENODEV);
 184
 185         if (netns != wiphy_net(&rdev->wiphy))
 186                 return ERR_PTR(-ENODEV);
 187
 188         return rdev;
 189 }
 190
 191 /*
 192  * This function returns a pointer to the driver
 193  * that the genl_info item that is passed refers to.
 194  *
 195  * The result of this can be a PTR_ERR and hence must
 196  * be checked with IS_ERR() for errors.
 197  */
 198 static struct cfg80211_registered_device *
 199 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 200 {
 201         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 202 }
 203
 204 static int validate_ie_attr(const struct nlattr *attr,
 205                             struct netlink_ext_ack *extack)
 206 {
 207         const u8 *data = nla_data(attr);
 208         unsigned int len = nla_len(attr);
 209         const struct element *elem;
 210
 211         for_each_element(elem, data, len) {
 212                 /* nothing */
 213         }
 214
 215         if (for_each_element_completed(elem, data, len))
 216                 return 0;
 217
 218         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
 219         return -EINVAL;
 220 }
 221
 222 /* policy for the attributes */
 223 static const struct nla_policy
 224 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
 225         [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
 226         [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
 227                                         .len = U8_MAX },
 228         [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
 229                                              .len = U8_MAX },
 230 };
 231
 232 static const struct nla_policy
 233 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
 234         [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
 235         [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
 236         [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
 237                 NLA_POLICY_MAX(NLA_U8, 15),
 238         [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
 239         [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
 240                 NLA_POLICY_MAX(NLA_U8, 15),
 241         [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] =
 242                 NLA_POLICY_MAX(NLA_U8, 31),
 243         [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
 244         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
 245         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
 246 };
 247
 248 static const struct nla_policy
 249 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
 250         [NL80211_PMSR_TYPE_FTM] =
 251                 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
 252 };
 253
 254 static const struct nla_policy
 255 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
 256         [NL80211_PMSR_REQ_ATTR_DATA] =
 257                 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
 258         [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
 259 };
 260
 261 static const struct nla_policy
 262 nl80211_psmr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
 263         [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
 264         /*
 265          * we could specify this again to be the top-level policy,
 266          * but that would open us up to recursion problems ...
 267          */
 268         [NL80211_PMSR_PEER_ATTR_CHAN] = { .type = NLA_NESTED },
 269         [NL80211_PMSR_PEER_ATTR_REQ] =
 270                 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
 271         [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
 272 };
 273
 274 static const struct nla_policy
 275 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
 276         [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
 277         [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
 278         [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
 279         [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
 280         [NL80211_PMSR_ATTR_PEERS] =
 281                 NLA_POLICY_NESTED_ARRAY(nl80211_psmr_peer_attr_policy),
 282 };
 283
 284 const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 285         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 286         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 287                                       .len = 20-1 },
 288         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 289
 290         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 291         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 292         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 293         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 294         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 295
 296         [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 297         [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 298         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 299         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 300         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 301         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 302
 303         [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
 304         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 305         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 306
 307         [NL80211_ATTR_MAC] = { .type = NLA_EXACT_LEN_WARN, .len = ETH_ALEN },
 308         [NL80211_ATTR_PREV_BSSID] = {
 309                 .type = NLA_EXACT_LEN_WARN,
 310                 .len = ETH_ALEN
 311         },
 312
 313         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 314         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 315                                     .len = WLAN_MAX_KEY_LEN },
 316         [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 5),
 317         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 318         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 319         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 320         [NL80211_ATTR_KEY_TYPE] =
 321                 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
 322
 323         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 324         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 325         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 326                                        .len = IEEE80211_MAX_DATA_LEN },
 327         [NL80211_ATTR_BEACON_TAIL] =
 328                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 329                                        IEEE80211_MAX_DATA_LEN),
 330         [NL80211_ATTR_STA_AID] =
 331                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 332         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 333         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 334         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 335                                                .len = NL80211_MAX_SUPP_RATES },
 336         [NL80211_ATTR_STA_PLINK_ACTION] =
 337                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
 338         [NL80211_ATTR_STA_TX_POWER_SETTING] =
 339                 NLA_POLICY_RANGE(NLA_U8,
 340                                  NL80211_TX_POWER_AUTOMATIC,
 341                                  NL80211_TX_POWER_FIXED),
 342         [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 },
 343         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 344         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 345         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 346                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 347         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 348
 349         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 350         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 351
 352         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 353         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 354         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 355         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 356                                            .len = NL80211_MAX_SUPP_RATES },
 357         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 358
 359         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 360         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 361
 362         [NL80211_ATTR_HT_CAPABILITY] = {
 363                 .type = NLA_EXACT_LEN_WARN,
 364                 .len = NL80211_HT_CAPABILITY_LEN
 365         },
 366
 367         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 368         [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
 369                                                    validate_ie_attr,
 370                                                    IEEE80211_MAX_DATA_LEN),
 371         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 372         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 373
 374         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 375                                 .len = IEEE80211_MAX_SSID_LEN },
 376         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 377         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 378         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 379         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 380         [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
 381                                                   NL80211_MFP_NO,
 382                                                   NL80211_MFP_OPTIONAL),
 383         [NL80211_ATTR_STA_FLAGS2] = {
 384                 .len = sizeof(struct nl80211_sta_flag_update),
 385         },
 386         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 387         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 388         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 389         [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
 390         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 391         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 392         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 393         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 394         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 395         [NL80211_ATTR_PMKID] = {
 396                 .type = NLA_EXACT_LEN_WARN,
 397                 .len = WLAN_PMKID_LEN
 398         },
 399         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 400         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 401         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 402         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 403                                  .len = IEEE80211_MAX_DATA_LEN },
 404         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 405         [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
 406                                                    NL80211_PS_DISABLED,
 407                                                    NL80211_PS_ENABLED),
 408         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 409         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 410         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 411         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 412         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 413         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 414         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 415         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 416         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 417         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 418         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 419         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 420         [NL80211_ATTR_STA_PLINK_STATE] =
 421                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
 422         [NL80211_ATTR_MESH_PEER_AID] =
 423                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 424         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 425         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 426         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 427         [NL80211_ATTR_HIDDEN_SSID] =
 428                 NLA_POLICY_RANGE(NLA_U32,
 429                                  NL80211_HIDDEN_SSID_NOT_IN_USE,
 430                                  NL80211_HIDDEN_SSID_ZERO_CONTENTS),
 431         [NL80211_ATTR_IE_PROBE_RESP] =
 432                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 433                                        IEEE80211_MAX_DATA_LEN),
 434         [NL80211_ATTR_IE_ASSOC_RESP] =
 435                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 436                                        IEEE80211_MAX_DATA_LEN),
 437         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 438         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 439         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 440         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 441         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 442         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 443         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 444         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 445         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 446         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 447         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 448                                       .len = IEEE80211_MAX_DATA_LEN },
 449         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 450         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 451         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 452                 .len = NL80211_HT_CAPABILITY_LEN
 453         },
 454         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 455         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 456         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 457         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 458         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 459         [NL80211_ATTR_AUTH_DATA] = { .type = NLA_BINARY, },
 460         [NL80211_ATTR_VHT_CAPABILITY] = {
 461                 .type = NLA_EXACT_LEN_WARN,
 462                 .len = NL80211_VHT_CAPABILITY_LEN
 463         },
 464         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 465         [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
 466         [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
 467         [NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
 468                 NLA_POLICY_RANGE(NLA_U32,
 469                                  NL80211_MESH_POWER_UNKNOWN + 1,
 470                                  NL80211_MESH_POWER_MAX),
 471         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 472         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 473         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 474         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 475         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 476         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 477         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 478                 .len = NL80211_VHT_CAPABILITY_LEN,
 479         },
 480         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 481         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 482                                   .len = IEEE80211_MAX_DATA_LEN },
 483         [NL80211_ATTR_PEER_AID] =
 484                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 485         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 486         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 487         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 488         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 489         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 490         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 491         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 492         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 493         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 494         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 495         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 496         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 497         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 498                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 499         [NL80211_ATTR_MAC_HINT] = {
 500                 .type = NLA_EXACT_LEN_WARN,
 501                 .len = ETH_ALEN
 502         },
 503         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 504         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 505         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 506         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 507         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 508         [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
 509         [NL80211_ATTR_USER_PRIO] =
 510                 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
 511         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 512         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 513         [NL80211_ATTR_MAC_MASK] = {
 514                 .type = NLA_EXACT_LEN_WARN,
 515                 .len = ETH_ALEN
 516         },
 517         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 518         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 519         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 520         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 521         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 522         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 523         [NL80211_ATTR_STA_SUPPORT_P2P_PS] =
 524                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
 525         [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 526                 .len = VHT_MUMIMO_GROUPS_DATA_LEN
 527         },
 528         [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = {
 529                 .type = NLA_EXACT_LEN_WARN,
 530                 .len = ETH_ALEN
 531         },
 532         [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
 533         [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
 534         [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 535         [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
 536                                     .len = FILS_MAX_KEK_LEN },
 537         [NL80211_ATTR_FILS_NONCES] = {
 538                 .type = NLA_EXACT_LEN_WARN,
 539                 .len = 2 * FILS_NONCE_LEN
 540         },
 541         [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
 542         [NL80211_ATTR_BSSID] = { .type = NLA_EXACT_LEN_WARN, .len = ETH_ALEN },
 543         [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
 544         [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
 545                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 546         },
 547         [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
 548         [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
 549                                              .len = FILS_ERP_MAX_USERNAME_LEN },
 550         [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
 551                                           .len = FILS_ERP_MAX_REALM_LEN },
 552         [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
 553         [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
 554                                         .len = FILS_ERP_MAX_RRK_LEN },
 555         [NL80211_ATTR_FILS_CACHE_ID] = { .type = NLA_EXACT_LEN_WARN, .len = 2 },
 556         [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
 557         [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
 558         [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
 559
 560         [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
 561         [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
 562         [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
 563         [NL80211_ATTR_HE_CAPABILITY] = { .type = NLA_BINARY,
 564                                          .len = NL80211_HE_MAX_CAPABILITY_LEN },
 565
 566         [NL80211_ATTR_FTM_RESPONDER] = {
 567                 .type = NLA_NESTED,
 568                 .validation_data = nl80211_ftm_responder_policy,
 569         },
 570         [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
 571         [NL80211_ATTR_PEER_MEASUREMENTS] =
 572                 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
 573         [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
 574         [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY,
 575                                         .len = SAE_PASSWORD_MAX_LEN },
 576         [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG },
 577 };
 578
 579 /* policy for the key attributes */
 580 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 581         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 582         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 583         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 584         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 585         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 586         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 587         [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
 588         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 589         [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
 590 };
 591
 592 /* policy for the key default flags */
 593 static const struct nla_policy
 594 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 595         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 596         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 597 };
 598
 599 #ifdef CONFIG_PM
 600 /* policy for WoWLAN attributes */
 601 static const struct nla_policy
 602 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 603         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 604         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 605         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 606         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 607         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 608         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 609         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 610         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 611         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 612         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 613 };
 614
 615 static const struct nla_policy
 616 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 617         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 618         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 619         [NL80211_WOWLAN_TCP_DST_MAC] = {
 620                 .type = NLA_EXACT_LEN_WARN,
 621                 .len = ETH_ALEN
 622         },
 623         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 624         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 625         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .type = NLA_MIN_LEN, .len = 1 },
 626         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 627                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 628         },
 629         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 630                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 631         },
 632         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 633         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .type = NLA_MIN_LEN, .len = 1 },
 634         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .type = NLA_MIN_LEN, .len = 1 },
 635 };
 636 #endif /* CONFIG_PM */
 637
 638 /* policy for coalesce rule attributes */
 639 static const struct nla_policy
 640 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 641         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 642         [NL80211_ATTR_COALESCE_RULE_CONDITION] =
 643                 NLA_POLICY_RANGE(NLA_U32,
 644                                  NL80211_COALESCE_CONDITION_MATCH,
 645                                  NL80211_COALESCE_CONDITION_NO_MATCH),
 646         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 647 };
 648
 649 /* policy for GTK rekey offload attributes */
 650 static const struct nla_policy
 651 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 652         [NL80211_REKEY_DATA_KEK] = {
 653                 .type = NLA_EXACT_LEN_WARN,
 654                 .len = NL80211_KEK_LEN,
 655         },
 656         [NL80211_REKEY_DATA_KCK] = {
 657                 .type = NLA_EXACT_LEN_WARN,
 658                 .len = NL80211_KCK_LEN,
 659         },
 660         [NL80211_REKEY_DATA_REPLAY_CTR] = {
 661                 .type = NLA_EXACT_LEN_WARN,
 662                 .len = NL80211_REPLAY_CTR_LEN
 663         },
 664 };
 665
 666 static const struct nla_policy
 667 nl80211_match_band_rssi_policy[NUM_NL80211_BANDS] = {
 668         [NL80211_BAND_2GHZ] = { .type = NLA_S32 },
 669         [NL80211_BAND_5GHZ] = { .type = NLA_S32 },
 670         [NL80211_BAND_60GHZ] = { .type = NLA_S32 },
 671 };
 672
 673 static const struct nla_policy
 674 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 675         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 676                                                  .len = IEEE80211_MAX_SSID_LEN },
 677         [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = {
 678                 .type = NLA_EXACT_LEN_WARN,
 679                 .len = ETH_ALEN
 680         },
 681         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 682         [NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI] =
 683                 NLA_POLICY_NESTED(nl80211_match_band_rssi_policy),
 684 };
 685
 686 static const struct nla_policy
 687 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 688         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 689         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 690 };
 691
 692 static const struct nla_policy
 693 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 694         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 695         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 696         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 697                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 698         },
 699 };
 700
 701 /* policy for NAN function attributes */
 702 static const struct nla_policy
 703 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 704         [NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 },
 705         [NL80211_NAN_FUNC_SERVICE_ID] = {
 706                                     .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 707         [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 708         [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 709         [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 710         [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 711         [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 712         [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = {
 713                 .type = NLA_EXACT_LEN_WARN,
 714                 .len = ETH_ALEN
 715         },
 716         [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 717         [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 718         [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 719                         .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 720         [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 721         [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 722         [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 723         [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 724         [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 725 };
 726
 727 /* policy for Service Response Filter attributes */
 728 static const struct nla_policy
 729 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 730         [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 731         [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 732                                  .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 733         [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 734         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 735 };
 736
 737 /* policy for packet pattern attributes */
 738 static const struct nla_policy
 739 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
 740         [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
 741         [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
 742         [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
 743 };
 744
 745 int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
 746                               struct cfg80211_registered_device **rdev,
 747                               struct wireless_dev **wdev)
 748 {
 749         int err;
 750
 751         if (!cb->args[0]) {
 752                 err = nlmsg_parse_deprecated(cb->nlh,
 753                                              GENL_HDRLEN + nl80211_fam.hdrsize,
 754                                              genl_family_attrbuf(&nl80211_fam),
 755                                              nl80211_fam.maxattr,
 756                                              nl80211_policy, NULL);
 757                 if (err)
 758                         return err;
 759
 760                 *wdev = __cfg80211_wdev_from_attrs(
 761                                         sock_net(cb->skb->sk),
 762                                         genl_family_attrbuf(&nl80211_fam));
 763                 if (IS_ERR(*wdev))
 764                         return PTR_ERR(*wdev);
 765                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 766                 /* 0 is the first index - add 1 to parse only once */
 767                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 768                 cb->args[1] = (*wdev)->identifier;
 769         } else {
 770                 /* subtract the 1 again here */
 771                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 772                 struct wireless_dev *tmp;
 773
 774                 if (!wiphy)
 775                         return -ENODEV;
 776                 *rdev = wiphy_to_rdev(wiphy);
 777                 *wdev = NULL;
 778
 779                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
 780                         if (tmp->identifier == cb->args[1]) {
 781                                 *wdev = tmp;
 782                                 break;
 783                         }
 784                 }
 785
 786                 if (!*wdev)
 787                         return -ENODEV;
 788         }
 789
 790         return 0;
 791 }
 792
 793 /* message building helper */
 794 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 795                      int flags, u8 cmd)
 796 {
 797         /* since there is no private header just add the generic one */
 798         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 799 }
 800
 801 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
 802                                      const struct ieee80211_reg_rule *rule)
 803 {
 804         int j;
 805         struct nlattr *nl_wmm_rules =
 806                 nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM);
 807
 808         if (!nl_wmm_rules)
 809                 goto nla_put_failure;
 810
 811         for (j = 0; j < IEEE80211_NUM_ACS; j++) {
 812                 struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j);
 813
 814                 if (!nl_wmm_rule)
 815                         goto nla_put_failure;
 816
 817                 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
 818                                 rule->wmm_rule.client[j].cw_min) ||
 819                     nla_put_u16(msg, NL80211_WMMR_CW_MAX,
 820                                 rule->wmm_rule.client[j].cw_max) ||
 821                     nla_put_u8(msg, NL80211_WMMR_AIFSN,
 822                                rule->wmm_rule.client[j].aifsn) ||
 823                     nla_put_u16(msg, NL80211_WMMR_TXOP,
 824                                 rule->wmm_rule.client[j].cot))
 825                         goto nla_put_failure;
 826
 827                 nla_nest_end(msg, nl_wmm_rule);
 828         }
 829         nla_nest_end(msg, nl_wmm_rules);
 830
 831         return 0;
 832
 833 nla_put_failure:
 834         return -ENOBUFS;
 835 }
 836
 837 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
 838                                    struct ieee80211_channel *chan,
 839                                    bool large)
 840 {
 841         /* Some channels must be completely excluded from the
 842          * list to protect old user-space tools from breaking
 843          */
 844         if (!large && chan->flags &
 845             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 846                 return 0;
 847
 848         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 849                         chan->center_freq))
 850                 goto nla_put_failure;
 851
 852         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 853             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 854                 goto nla_put_failure;
 855         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 856                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 857                         goto nla_put_failure;
 858                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 859                         goto nla_put_failure;
 860         }
 861         if (chan->flags & IEEE80211_CHAN_RADAR) {
 862                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 863                         goto nla_put_failure;
 864                 if (large) {
 865                         u32 time;
 866
 867                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 868
 869                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 870                                         chan->dfs_state))
 871                                 goto nla_put_failure;
 872                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 873                                         time))
 874                                 goto nla_put_failure;
 875                         if (nla_put_u32(msg,
 876                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 877                                         chan->dfs_cac_ms))
 878                                 goto nla_put_failure;
 879                 }
 880         }
 881
 882         if (large) {
 883                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 884                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 885                         goto nla_put_failure;
 886                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 887                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 888                         goto nla_put_failure;
 889                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 890                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 891                         goto nla_put_failure;
 892                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 893                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 894                         goto nla_put_failure;
 895                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 896                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 897                         goto nla_put_failure;
 898                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
 899                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
 900                         goto nla_put_failure;
 901                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 902                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 903                         goto nla_put_failure;
 904                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 905                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 906                         goto nla_put_failure;
 907         }
 908
 909         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 910                         DBM_TO_MBM(chan->max_power)))
 911                 goto nla_put_failure;
 912
 913         if (large) {
 914                 const struct ieee80211_reg_rule *rule =
 915                         freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
 916
 917                 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
 918                         if (nl80211_msg_put_wmm_rules(msg, rule))
 919                                 goto nla_put_failure;
 920                 }
 921         }
 922
 923         return 0;
 924
 925  nla_put_failure:
 926         return -ENOBUFS;
 927 }
 928
 929 static bool nl80211_put_txq_stats(struct sk_buff *msg,
 930                                   struct cfg80211_txq_stats *txqstats,
 931                                   int attrtype)
 932 {
 933         struct nlattr *txqattr;
 934
 935 #define PUT_TXQVAL_U32(attr, memb) do {                                   \
 936         if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) &&         \
 937             nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
 938                 return false;                                             \
 939         } while (0)
 940
 941         txqattr = nla_nest_start_noflag(msg, attrtype);
 942         if (!txqattr)
 943                 return false;
 944
 945         PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
 946         PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
 947         PUT_TXQVAL_U32(FLOWS, flows);
 948         PUT_TXQVAL_U32(DROPS, drops);
 949         PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
 950         PUT_TXQVAL_U32(OVERLIMIT, overlimit);
 951         PUT_TXQVAL_U32(OVERMEMORY, overmemory);
 952         PUT_TXQVAL_U32(COLLISIONS, collisions);
 953         PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
 954         PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
 955         PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
 956         nla_nest_end(msg, txqattr);
 957
 958 #undef PUT_TXQVAL_U32
 959         return true;
 960 }
 961
 962 /* netlink command implementations */
 963
 964 struct key_parse {
 965         struct key_params p;
 966         int idx;
 967         int type;
 968         bool def, defmgmt;
 969         bool def_uni, def_multi;
 970 };
 971
 972 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
 973                                  struct key_parse *k)
 974 {
 975         struct nlattr *tb[NL80211_KEY_MAX + 1];
 976         int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key,
 977                                               nl80211_key_policy,
 978                                               info->extack);
 979         if (err)
 980                 return err;
 981
 982         k->def = !!tb[NL80211_KEY_DEFAULT];
 983         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 984
 985         if (k->def) {
 986                 k->def_uni = true;
 987                 k->def_multi = true;
 988         }
 989         if (k->defmgmt)
 990                 k->def_multi = true;
 991
 992         if (tb[NL80211_KEY_IDX])
 993                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 994
 995         if (tb[NL80211_KEY_DATA]) {
 996                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 997                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 998         }
 999
1000         if (tb[NL80211_KEY_SEQ]) {
1001                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
1002                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
1003         }
1004
1005         if (tb[NL80211_KEY_CIPHER])
1006                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
1007
1008         if (tb[NL80211_KEY_TYPE])
1009                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
1010
1011         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
1012                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1013
1014                 err = nla_parse_nested_deprecated(kdt,
1015                                                   NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1016                                                   tb[NL80211_KEY_DEFAULT_TYPES],
1017                                                   nl80211_key_default_policy,
1018                                                   info->extack);
1019                 if (err)
1020                         return err;
1021
1022                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1023                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1024         }
1025
1026         if (tb[NL80211_KEY_MODE])
1027                 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
1028
1029         return 0;
1030 }
1031
1032 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
1033 {
1034         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1035                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1036                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1037         }
1038
1039         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1040                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1041                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1042         }
1043
1044         if (info->attrs[NL80211_ATTR_KEY_IDX])
1045                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1046
1047         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
1048                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1049
1050         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
1051         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
1052
1053         if (k->def) {
1054                 k->def_uni = true;
1055                 k->def_multi = true;
1056         }
1057         if (k->defmgmt)
1058                 k->def_multi = true;
1059
1060         if (info->attrs[NL80211_ATTR_KEY_TYPE])
1061                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1062
1063         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
1064                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1065                 int err = nla_parse_nested_deprecated(kdt,
1066                                                       NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1067                                                       info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
1068                                                       nl80211_key_default_policy,
1069                                                       info->extack);
1070                 if (err)
1071                         return err;
1072
1073                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1074                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1075         }
1076
1077         return 0;
1078 }
1079
1080 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
1081 {
1082         int err;
1083
1084         memset(k, 0, sizeof(*k));
1085         k->idx = -1;
1086         k->type = -1;
1087
1088         if (info->attrs[NL80211_ATTR_KEY])
1089                 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
1090         else
1091                 err = nl80211_parse_key_old(info, k);
1092
1093         if (err)
1094                 return err;
1095
1096         if (k->def && k->defmgmt) {
1097                 GENL_SET_ERR_MSG(info, "key with def && defmgmt is invalid");
1098                 return -EINVAL;
1099         }
1100
1101         if (k->defmgmt) {
1102                 if (k->def_uni || !k->def_multi) {
1103                         GENL_SET_ERR_MSG(info, "defmgmt key must be mcast");
1104                         return -EINVAL;
1105                 }
1106         }
1107
1108         if (k->idx != -1) {
1109                 if (k->defmgmt) {
1110                         if (k->idx < 4 || k->idx > 5) {
1111                                 GENL_SET_ERR_MSG(info,
1112                                                  "defmgmt key idx not 4 or 5");
1113                                 return -EINVAL;
1114                         }
1115                 } else if (k->def) {
1116                         if (k->idx < 0 || k->idx > 3) {
1117                                 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1118                                 return -EINVAL;
1119                         }
1120                 } else {
1121                         if (k->idx < 0 || k->idx > 5) {
1122                                 GENL_SET_ERR_MSG(info, "key idx not 0-5");
1123                                 return -EINVAL;
1124                         }
1125                 }
1126         }
1127
1128         return 0;
1129 }
1130
1131 static struct cfg80211_cached_keys *
1132 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1133                        struct genl_info *info, bool *no_ht)
1134 {
1135         struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1136         struct key_parse parse;
1137         struct nlattr *key;
1138         struct cfg80211_cached_keys *result;
1139         int rem, err, def = 0;
1140         bool have_key = false;
1141
1142         nla_for_each_nested(key, keys, rem) {
1143                 have_key = true;
1144                 break;
1145         }
1146
1147         if (!have_key)
1148                 return NULL;
1149
1150         result = kzalloc(sizeof(*result), GFP_KERNEL);
1151         if (!result)
1152                 return ERR_PTR(-ENOMEM);
1153
1154         result->def = -1;
1155
1156         nla_for_each_nested(key, keys, rem) {
1157                 memset(&parse, 0, sizeof(parse));
1158                 parse.idx = -1;
1159
1160                 err = nl80211_parse_key_new(info, key, &parse);
1161                 if (err)
1162                         goto error;
1163                 err = -EINVAL;
1164                 if (!parse.p.key)
1165                         goto error;
1166                 if (parse.idx < 0 || parse.idx > 3) {
1167                         GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1168                         goto error;
1169                 }
1170                 if (parse.def) {
1171                         if (def) {
1172                                 GENL_SET_ERR_MSG(info,
1173                                                  "only one key can be default");
1174                                 goto error;
1175                         }
1176                         def = 1;
1177                         result->def = parse.idx;
1178                         if (!parse.def_uni || !parse.def_multi)
1179                                 goto error;
1180                 } else if (parse.defmgmt)
1181                         goto error;
1182                 err = cfg80211_validate_key_settings(rdev, &parse.p,
1183                                                      parse.idx, false, NULL);
1184                 if (err)
1185                         goto error;
1186                 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1187                     parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1188                         GENL_SET_ERR_MSG(info, "connect key must be WEP");
1189                         err = -EINVAL;
1190                         goto error;
1191                 }
1192                 result->params[parse.idx].cipher = parse.p.cipher;
1193                 result->params[parse.idx].key_len = parse.p.key_len;
1194                 result->params[parse.idx].key = result->data[parse.idx];
1195                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1196
1197                 /* must be WEP key if we got here */
1198                 if (no_ht)
1199                         *no_ht = true;
1200         }
1201
1202         if (result->def < 0) {
1203                 err = -EINVAL;
1204                 GENL_SET_ERR_MSG(info, "need a default/TX key");
1205                 goto error;
1206         }
1207
1208         return result;
1209  error:
1210         kfree(result);
1211         return ERR_PTR(err);
1212 }
1213
1214 static int nl80211_key_allowed(struct wireless_dev *wdev)
1215 {
1216         ASSERT_WDEV_LOCK(wdev);
1217
1218         switch (wdev->iftype) {
1219         case NL80211_IFTYPE_AP:
1220         case NL80211_IFTYPE_AP_VLAN:
1221         case NL80211_IFTYPE_P2P_GO:
1222         case NL80211_IFTYPE_MESH_POINT:
1223                 break;
1224         case NL80211_IFTYPE_ADHOC:
1225         case NL80211_IFTYPE_STATION:
1226         case NL80211_IFTYPE_P2P_CLIENT:
1227                 if (!wdev->current_bss)
1228                         return -ENOLINK;
1229                 break;
1230         case NL80211_IFTYPE_UNSPECIFIED:
1231         case NL80211_IFTYPE_OCB:
1232         case NL80211_IFTYPE_MONITOR:
1233         case NL80211_IFTYPE_NAN:
1234         case NL80211_IFTYPE_P2P_DEVICE:
1235         case NL80211_IFTYPE_WDS:
1236         case NUM_NL80211_IFTYPES:
1237                 return -EINVAL;
1238         }
1239
1240         return 0;
1241 }
1242
1243 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1244                                                         struct nlattr *tb)
1245 {
1246         struct ieee80211_channel *chan;
1247
1248         if (tb == NULL)
1249                 return NULL;
1250         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
1251         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1252                 return NULL;
1253         return chan;
1254 }
1255
1256 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1257 {
1258         struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr);
1259         int i;
1260
1261         if (!nl_modes)
1262                 goto nla_put_failure;
1263
1264         i = 0;
1265         while (ifmodes) {
1266                 if ((ifmodes & 1) && nla_put_flag(msg, i))
1267                         goto nla_put_failure;
1268                 ifmodes >>= 1;
1269                 i++;
1270         }
1271
1272         nla_nest_end(msg, nl_modes);
1273         return 0;
1274
1275 nla_put_failure:
1276         return -ENOBUFS;
1277 }
1278
1279 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1280                                           struct sk_buff *msg,
1281                                           bool large)
1282 {
1283         struct nlattr *nl_combis;
1284         int i, j;
1285
1286         nl_combis = nla_nest_start_noflag(msg,
1287                                           NL80211_ATTR_INTERFACE_COMBINATIONS);
1288         if (!nl_combis)
1289                 goto nla_put_failure;
1290
1291         for (i = 0; i < wiphy->n_iface_combinations; i++) {
1292                 const struct ieee80211_iface_combination *c;
1293                 struct nlattr *nl_combi, *nl_limits;
1294
1295                 c = &wiphy->iface_combinations[i];
1296
1297                 nl_combi = nla_nest_start_noflag(msg, i + 1);
1298                 if (!nl_combi)
1299                         goto nla_put_failure;
1300
1301                 nl_limits = nla_nest_start_noflag(msg,
1302                                                   NL80211_IFACE_COMB_LIMITS);
1303                 if (!nl_limits)
1304                         goto nla_put_failure;
1305
1306                 for (j = 0; j < c->n_limits; j++) {
1307                         struct nlattr *nl_limit;
1308
1309                         nl_limit = nla_nest_start_noflag(msg, j + 1);
1310                         if (!nl_limit)
1311                                 goto nla_put_failure;
1312                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1313                                         c->limits[j].max))
1314                                 goto nla_put_failure;
1315                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1316                                                 c->limits[j].types))
1317                                 goto nla_put_failure;
1318                         nla_nest_end(msg, nl_limit);
1319                 }
1320
1321                 nla_nest_end(msg, nl_limits);
1322
1323                 if (c->beacon_int_infra_match &&
1324                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1325                         goto nla_put_failure;
1326                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1327                                 c->num_different_channels) ||
1328                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1329                                 c->max_interfaces))
1330                         goto nla_put_failure;
1331                 if (large &&
1332                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1333                                 c->radar_detect_widths) ||
1334                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1335                                 c->radar_detect_regions)))
1336                         goto nla_put_failure;
1337                 if (c->beacon_int_min_gcd &&
1338                     nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1339                                 c->beacon_int_min_gcd))
1340                         goto nla_put_failure;
1341
1342                 nla_nest_end(msg, nl_combi);
1343         }
1344
1345         nla_nest_end(msg, nl_combis);
1346
1347         return 0;
1348 nla_put_failure:
1349         return -ENOBUFS;
1350 }
1351
1352 #ifdef CONFIG_PM
1353 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1354                                         struct sk_buff *msg)
1355 {
1356         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1357         struct nlattr *nl_tcp;
1358
1359         if (!tcp)
1360                 return 0;
1361
1362         nl_tcp = nla_nest_start_noflag(msg,
1363                                        NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1364         if (!nl_tcp)
1365                 return -ENOBUFS;
1366
1367         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1368                         tcp->data_payload_max))
1369                 return -ENOBUFS;
1370
1371         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1372                         tcp->data_payload_max))
1373                 return -ENOBUFS;
1374
1375         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1376                 return -ENOBUFS;
1377
1378         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1379                                 sizeof(*tcp->tok), tcp->tok))
1380                 return -ENOBUFS;
1381
1382         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1383                         tcp->data_interval_max))
1384                 return -ENOBUFS;
1385
1386         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1387                         tcp->wake_payload_max))
1388                 return -ENOBUFS;
1389
1390         nla_nest_end(msg, nl_tcp);
1391         return 0;
1392 }
1393
1394 static int nl80211_send_wowlan(struct sk_buff *msg,
1395                                struct cfg80211_registered_device *rdev,
1396                                bool large)
1397 {
1398         struct nlattr *nl_wowlan;
1399
1400         if (!rdev->wiphy.wowlan)
1401                 return 0;
1402
1403         nl_wowlan = nla_nest_start_noflag(msg,
1404                                           NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1405         if (!nl_wowlan)
1406                 return -ENOBUFS;
1407
1408         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1409              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1410             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1411              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1412             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1413              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1414             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1415              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1416             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1417              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1418             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1419              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1420             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1421              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1422             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1423              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1424                 return -ENOBUFS;
1425
1426         if (rdev->wiphy.wowlan->n_patterns) {
1427                 struct nl80211_pattern_support pat = {
1428                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1429                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1430                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1431                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1432                 };
1433
1434                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1435                             sizeof(pat), &pat))
1436                         return -ENOBUFS;
1437         }
1438
1439         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1440             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1441                         rdev->wiphy.wowlan->max_nd_match_sets))
1442                 return -ENOBUFS;
1443
1444         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1445                 return -ENOBUFS;
1446
1447         nla_nest_end(msg, nl_wowlan);
1448
1449         return 0;
1450 }
1451 #endif
1452
1453 static int nl80211_send_coalesce(struct sk_buff *msg,
1454                                  struct cfg80211_registered_device *rdev)
1455 {
1456         struct nl80211_coalesce_rule_support rule;
1457
1458         if (!rdev->wiphy.coalesce)
1459                 return 0;
1460
1461         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1462         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1463         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1464         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1465         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1466         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1467
1468         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1469                 return -ENOBUFS;
1470
1471         return 0;
1472 }
1473
1474 static int
1475 nl80211_send_iftype_data(struct sk_buff *msg,
1476                          const struct ieee80211_sband_iftype_data *iftdata)
1477 {
1478         const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1479
1480         if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1481                                 iftdata->types_mask))
1482                 return -ENOBUFS;
1483
1484         if (he_cap->has_he) {
1485                 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1486                             sizeof(he_cap->he_cap_elem.mac_cap_info),
1487                             he_cap->he_cap_elem.mac_cap_info) ||
1488                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1489                             sizeof(he_cap->he_cap_elem.phy_cap_info),
1490                             he_cap->he_cap_elem.phy_cap_info) ||
1491                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1492                             sizeof(he_cap->he_mcs_nss_supp),
1493                             &he_cap->he_mcs_nss_supp) ||
1494                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1495                             sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1496                         return -ENOBUFS;
1497         }
1498
1499         return 0;
1500 }
1501
1502 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1503                                       struct ieee80211_supported_band *sband)
1504 {
1505         struct nlattr *nl_rates, *nl_rate;
1506         struct ieee80211_rate *rate;
1507         int i;
1508
1509         /* add HT info */
1510         if (sband->ht_cap.ht_supported &&
1511             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1512                      sizeof(sband->ht_cap.mcs),
1513                      &sband->ht_cap.mcs) ||
1514              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1515                          sband->ht_cap.cap) ||
1516              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1517                         sband->ht_cap.ampdu_factor) ||
1518              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1519                         sband->ht_cap.ampdu_density)))
1520                 return -ENOBUFS;
1521
1522         /* add VHT info */
1523         if (sband->vht_cap.vht_supported &&
1524             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1525                      sizeof(sband->vht_cap.vht_mcs),
1526                      &sband->vht_cap.vht_mcs) ||
1527              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1528                          sband->vht_cap.cap)))
1529                 return -ENOBUFS;
1530
1531         if (sband->n_iftype_data) {
1532                 struct nlattr *nl_iftype_data =
1533                         nla_nest_start_noflag(msg,
1534                                               NL80211_BAND_ATTR_IFTYPE_DATA);
1535                 int err;
1536
1537                 if (!nl_iftype_data)
1538                         return -ENOBUFS;
1539
1540                 for (i = 0; i < sband->n_iftype_data; i++) {
1541                         struct nlattr *iftdata;
1542
1543                         iftdata = nla_nest_start_noflag(msg, i + 1);
1544                         if (!iftdata)
1545                                 return -ENOBUFS;
1546
1547                         err = nl80211_send_iftype_data(msg,
1548                                                        &sband->iftype_data[i]);
1549                         if (err)
1550                                 return err;
1551
1552                         nla_nest_end(msg, iftdata);
1553                 }
1554
1555                 nla_nest_end(msg, nl_iftype_data);
1556         }
1557
1558         /* add bitrates */
1559         nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES);
1560         if (!nl_rates)
1561                 return -ENOBUFS;
1562
1563         for (i = 0; i < sband->n_bitrates; i++) {
1564                 nl_rate = nla_nest_start_noflag(msg, i);
1565                 if (!nl_rate)
1566                         return -ENOBUFS;
1567
1568                 rate = &sband->bitrates[i];
1569                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1570                                 rate->bitrate))
1571                         return -ENOBUFS;
1572                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1573                     nla_put_flag(msg,
1574                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1575                         return -ENOBUFS;
1576
1577                 nla_nest_end(msg, nl_rate);
1578         }
1579
1580         nla_nest_end(msg, nl_rates);
1581
1582         return 0;
1583 }
1584
1585 static int
1586 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1587                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1588 {
1589         u16 stypes;
1590         struct nlattr *nl_ftypes, *nl_ifs;
1591         enum nl80211_iftype ift;
1592         int i;
1593
1594         if (!mgmt_stypes)
1595                 return 0;
1596
1597         nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES);
1598         if (!nl_ifs)
1599                 return -ENOBUFS;
1600
1601         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1602                 nl_ftypes = nla_nest_start_noflag(msg, ift);
1603                 if (!nl_ftypes)
1604                         return -ENOBUFS;
1605                 i = 0;
1606                 stypes = mgmt_stypes[ift].tx;
1607                 while (stypes) {
1608                         if ((stypes & 1) &&
1609                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1610                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1611                                 return -ENOBUFS;
1612                         stypes >>= 1;
1613                         i++;
1614                 }
1615                 nla_nest_end(msg, nl_ftypes);
1616         }
1617
1618         nla_nest_end(msg, nl_ifs);
1619
1620         nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES);
1621         if (!nl_ifs)
1622                 return -ENOBUFS;
1623
1624         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1625                 nl_ftypes = nla_nest_start_noflag(msg, ift);
1626                 if (!nl_ftypes)
1627                         return -ENOBUFS;
1628                 i = 0;
1629                 stypes = mgmt_stypes[ift].rx;
1630                 while (stypes) {
1631                         if ((stypes & 1) &&
1632                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1633                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1634                                 return -ENOBUFS;
1635                         stypes >>= 1;
1636                         i++;
1637                 }
1638                 nla_nest_end(msg, nl_ftypes);
1639         }
1640         nla_nest_end(msg, nl_ifs);
1641
1642         return 0;
1643 }
1644
1645 #define CMD(op, n)                                                      \
1646          do {                                                           \
1647                 if (rdev->ops->op) {                                    \
1648                         i++;                                            \
1649                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n))     \
1650                                 goto nla_put_failure;                   \
1651                 }                                                       \
1652         } while (0)
1653
1654 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
1655                                         struct sk_buff *msg)
1656 {
1657         int i = 0;
1658
1659         /*
1660          * do *NOT* add anything into this function, new things need to be
1661          * advertised only to new versions of userspace that can deal with
1662          * the split (and they can't possibly care about new features...
1663          */
1664         CMD(add_virtual_intf, NEW_INTERFACE);
1665         CMD(change_virtual_intf, SET_INTERFACE);
1666         CMD(add_key, NEW_KEY);
1667         CMD(start_ap, START_AP);
1668         CMD(add_station, NEW_STATION);
1669         CMD(add_mpath, NEW_MPATH);
1670         CMD(update_mesh_config, SET_MESH_CONFIG);
1671         CMD(change_bss, SET_BSS);
1672         CMD(auth, AUTHENTICATE);
1673         CMD(assoc, ASSOCIATE);
1674         CMD(deauth, DEAUTHENTICATE);
1675         CMD(disassoc, DISASSOCIATE);
1676         CMD(join_ibss, JOIN_IBSS);
1677         CMD(join_mesh, JOIN_MESH);
1678         CMD(set_pmksa, SET_PMKSA);
1679         CMD(del_pmksa, DEL_PMKSA);
1680         CMD(flush_pmksa, FLUSH_PMKSA);
1681         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1682                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1683         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1684         CMD(mgmt_tx, FRAME);
1685         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1686         if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1687                 i++;
1688                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1689                         goto nla_put_failure;
1690         }
1691         if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1692             rdev->ops->join_mesh) {
1693                 i++;
1694                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1695                         goto nla_put_failure;
1696         }
1697         CMD(set_wds_peer, SET_WDS_PEER);
1698         if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1699                 CMD(tdls_mgmt, TDLS_MGMT);
1700                 CMD(tdls_oper, TDLS_OPER);
1701         }
1702         if (rdev->wiphy.max_sched_scan_reqs)
1703                 CMD(sched_scan_start, START_SCHED_SCAN);
1704         CMD(probe_client, PROBE_CLIENT);
1705         CMD(set_noack_map, SET_NOACK_MAP);
1706         if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1707                 i++;
1708                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1709                         goto nla_put_failure;
1710         }
1711         CMD(start_p2p_device, START_P2P_DEVICE);
1712         CMD(set_mcast_rate, SET_MCAST_RATE);
1713 #ifdef CONFIG_NL80211_TESTMODE
1714         CMD(testmode_cmd, TESTMODE);
1715 #endif
1716
1717         if (rdev->ops->connect || rdev->ops->auth) {
1718                 i++;
1719                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1720                         goto nla_put_failure;
1721         }
1722
1723         if (rdev->ops->disconnect || rdev->ops->deauth) {
1724                 i++;
1725                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1726                         goto nla_put_failure;
1727         }
1728
1729         return i;
1730  nla_put_failure:
1731         return -ENOBUFS;
1732 }
1733
1734 static int
1735 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
1736                            struct sk_buff *msg)
1737 {
1738         struct nlattr *ftm;
1739
1740         if (!cap->ftm.supported)
1741                 return 0;
1742
1743         ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM);
1744         if (!ftm)
1745                 return -ENOBUFS;
1746
1747         if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
1748                 return -ENOBUFS;
1749         if (cap->ftm.non_asap &&
1750             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
1751                 return -ENOBUFS;
1752         if (cap->ftm.request_lci &&
1753             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
1754                 return -ENOBUFS;
1755         if (cap->ftm.request_civicloc &&
1756             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
1757                 return -ENOBUFS;
1758         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
1759                         cap->ftm.preambles))
1760                 return -ENOBUFS;
1761         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
1762                         cap->ftm.bandwidths))
1763                 return -ENOBUFS;
1764         if (cap->ftm.max_bursts_exponent >= 0 &&
1765             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
1766                         cap->ftm.max_bursts_exponent))
1767                 return -ENOBUFS;
1768         if (cap->ftm.max_ftms_per_burst &&
1769             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
1770                         cap->ftm.max_ftms_per_burst))
1771                 return -ENOBUFS;
1772
1773         nla_nest_end(msg, ftm);
1774         return 0;
1775 }
1776
1777 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
1778                                   struct sk_buff *msg)
1779 {
1780         const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
1781         struct nlattr *pmsr, *caps;
1782
1783         if (!cap)
1784                 return 0;
1785
1786         /*
1787          * we don't need to clean up anything here since the caller
1788          * will genlmsg_cancel() if we fail
1789          */
1790
1791         pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS);
1792         if (!pmsr)
1793                 return -ENOBUFS;
1794
1795         if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
1796                 return -ENOBUFS;
1797
1798         if (cap->report_ap_tsf &&
1799             nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
1800                 return -ENOBUFS;
1801
1802         if (cap->randomize_mac_addr &&
1803             nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
1804                 return -ENOBUFS;
1805
1806         caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
1807         if (!caps)
1808                 return -ENOBUFS;
1809
1810         if (nl80211_send_pmsr_ftm_capa(cap, msg))
1811                 return -ENOBUFS;
1812
1813         nla_nest_end(msg, caps);
1814         nla_nest_end(msg, pmsr);
1815
1816         return 0;
1817 }
1818
1819 struct nl80211_dump_wiphy_state {
1820         s64 filter_wiphy;
1821         long start;
1822         long split_start, band_start, chan_start, capa_start;
1823         bool split;
1824 };
1825
1826 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1827                               enum nl80211_commands cmd,
1828                               struct sk_buff *msg, u32 portid, u32 seq,
1829                               int flags, struct nl80211_dump_wiphy_state *state)
1830 {
1831         void *hdr;
1832         struct nlattr *nl_bands, *nl_band;
1833         struct nlattr *nl_freqs, *nl_freq;
1834         struct nlattr *nl_cmds;
1835         enum nl80211_band band;
1836         struct ieee80211_channel *chan;
1837         int i;
1838         const struct ieee80211_txrx_stypes *mgmt_stypes =
1839                                 rdev->wiphy.mgmt_stypes;
1840         u32 features;
1841
1842         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1843         if (!hdr)
1844                 return -ENOBUFS;
1845
1846         if (WARN_ON(!state))
1847                 return -EINVAL;
1848
1849         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1850             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1851                            wiphy_name(&rdev->wiphy)) ||
1852             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1853                         cfg80211_rdev_list_generation))
1854                 goto nla_put_failure;
1855
1856         if (cmd != NL80211_CMD_NEW_WIPHY)
1857                 goto finish;
1858
1859         switch (state->split_start) {
1860         case 0:
1861                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1862                                rdev->wiphy.retry_short) ||
1863                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1864                                rdev->wiphy.retry_long) ||
1865                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1866                                 rdev->wiphy.frag_threshold) ||
1867                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1868                                 rdev->wiphy.rts_threshold) ||
1869                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1870                                rdev->wiphy.coverage_class) ||
1871                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1872                                rdev->wiphy.max_scan_ssids) ||
1873                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1874                                rdev->wiphy.max_sched_scan_ssids) ||
1875                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1876                                 rdev->wiphy.max_scan_ie_len) ||
1877                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1878                                 rdev->wiphy.max_sched_scan_ie_len) ||
1879                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1880                                rdev->wiphy.max_match_sets) ||
1881                     nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1882                                 rdev->wiphy.max_sched_scan_plans) ||
1883                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1884                                 rdev->wiphy.max_sched_scan_plan_interval) ||
1885                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1886                                 rdev->wiphy.max_sched_scan_plan_iterations))
1887                         goto nla_put_failure;
1888
1889                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1890                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1891                         goto nla_put_failure;
1892                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1893                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1894                         goto nla_put_failure;
1895                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1896                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1897                         goto nla_put_failure;
1898                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1899                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1900                         goto nla_put_failure;
1901                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1902                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1903                         goto nla_put_failure;
1904                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1905                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1906                         goto nla_put_failure;
1907                 state->split_start++;
1908                 if (state->split)
1909                         break;
1910                 /* fall through */
1911         case 1:
1912                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1913                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1914                             rdev->wiphy.cipher_suites))
1915                         goto nla_put_failure;
1916
1917                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1918                                rdev->wiphy.max_num_pmkids))
1919                         goto nla_put_failure;
1920
1921                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1922                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1923                         goto nla_put_failure;
1924
1925                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1926                                 rdev->wiphy.available_antennas_tx) ||
1927                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1928                                 rdev->wiphy.available_antennas_rx))
1929                         goto nla_put_failure;
1930
1931                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1932                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1933                                 rdev->wiphy.probe_resp_offload))
1934                         goto nla_put_failure;
1935
1936                 if ((rdev->wiphy.available_antennas_tx ||
1937                      rdev->wiphy.available_antennas_rx) &&
1938                     rdev->ops->get_antenna) {
1939                         u32 tx_ant = 0, rx_ant = 0;
1940                         int res;
1941
1942                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1943                         if (!res) {
1944                                 if (nla_put_u32(msg,
1945                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1946                                                 tx_ant) ||
1947                                     nla_put_u32(msg,
1948                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1949                                                 rx_ant))
1950                                         goto nla_put_failure;
1951                         }
1952                 }
1953
1954                 state->split_start++;
1955                 if (state->split)
1956                         break;
1957                 /* fall through */
1958         case 2:
1959                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1960                                         rdev->wiphy.interface_modes))
1961                                 goto nla_put_failure;
1962                 state->split_start++;
1963                 if (state->split)
1964                         break;
1965                 /* fall through */
1966         case 3:
1967                 nl_bands = nla_nest_start_noflag(msg,
1968                                                  NL80211_ATTR_WIPHY_BANDS);
1969                 if (!nl_bands)
1970                         goto nla_put_failure;
1971
1972                 for (band = state->band_start;
1973                      band < NUM_NL80211_BANDS; band++) {
1974                         struct ieee80211_supported_band *sband;
1975
1976                         sband = rdev->wiphy.bands[band];
1977
1978                         if (!sband)
1979                                 continue;
1980
1981                         nl_band = nla_nest_start_noflag(msg, band);
1982                         if (!nl_band)
1983                                 goto nla_put_failure;
1984
1985                         switch (state->chan_start) {
1986                         case 0:
1987                                 if (nl80211_send_band_rateinfo(msg, sband))
1988                                         goto nla_put_failure;
1989                                 state->chan_start++;
1990                                 if (state->split)
1991                                         break;
1992                                 /* fall through */
1993                         default:
1994                                 /* add frequencies */
1995                                 nl_freqs = nla_nest_start_noflag(msg,
1996                                                                  NL80211_BAND_ATTR_FREQS);
1997                                 if (!nl_freqs)
1998                                         goto nla_put_failure;
1999
2000                                 for (i = state->chan_start - 1;
2001                                      i < sband->n_channels;
2002                                      i++) {
2003                                         nl_freq = nla_nest_start_noflag(msg,
2004                                                                         i);
2005                                         if (!nl_freq)
2006                                                 goto nla_put_failure;
2007
2008                                         chan = &sband->channels[i];
2009
2010                                         if (nl80211_msg_put_channel(
2011                                                         msg, &rdev->wiphy, chan,
2012                                                         state->split))
2013                                                 goto nla_put_failure;
2014
2015                                         nla_nest_end(msg, nl_freq);
2016                                         if (state->split)
2017                                                 break;
2018                                 }
2019                                 if (i < sband->n_channels)
2020                                         state->chan_start = i + 2;
2021                                 else
2022                                         state->chan_start = 0;
2023                                 nla_nest_end(msg, nl_freqs);
2024                         }
2025
2026                         nla_nest_end(msg, nl_band);
2027
2028                         if (state->split) {
2029                                 /* start again here */
2030                                 if (state->chan_start)
2031                                         band--;
2032                                 break;
2033                         }
2034                 }
2035                 nla_nest_end(msg, nl_bands);
2036
2037                 if (band < NUM_NL80211_BANDS)
2038                         state->band_start = band + 1;
2039                 else
2040                         state->band_start = 0;
2041
2042                 /* if bands & channels are done, continue outside */
2043                 if (state->band_start == 0 && state->chan_start == 0)
2044                         state->split_start++;
2045                 if (state->split)
2046                         break;
2047                 /* fall through */
2048         case 4:
2049                 nl_cmds = nla_nest_start_noflag(msg,
2050                                                 NL80211_ATTR_SUPPORTED_COMMANDS);
2051                 if (!nl_cmds)
2052                         goto nla_put_failure;
2053
2054                 i = nl80211_add_commands_unsplit(rdev, msg);
2055                 if (i < 0)
2056                         goto nla_put_failure;
2057                 if (state->split) {
2058                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
2059                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
2060                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
2061                                 CMD(channel_switch, CHANNEL_SWITCH);
2062                         CMD(set_qos_map, SET_QOS_MAP);
2063                         if (rdev->wiphy.features &
2064                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
2065                                 CMD(add_tx_ts, ADD_TX_TS);
2066                         CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
2067                         CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
2068                 }
2069 #undef CMD
2070
2071                 nla_nest_end(msg, nl_cmds);
2072                 state->split_start++;
2073                 if (state->split)
2074                         break;
2075                 /* fall through */
2076         case 5:
2077                 if (rdev->ops->remain_on_channel &&
2078                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
2079                     nla_put_u32(msg,
2080                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
2081                                 rdev->wiphy.max_remain_on_channel_duration))
2082                         goto nla_put_failure;
2083
2084                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
2085                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
2086                         goto nla_put_failure;
2087
2088                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
2089                         goto nla_put_failure;
2090                 state->split_start++;
2091                 if (state->split)
2092                         break;
2093                 /* fall through */
2094         case 6:
2095 #ifdef CONFIG_PM
2096                 if (nl80211_send_wowlan(msg, rdev, state->split))
2097                         goto nla_put_failure;
2098                 state->split_start++;
2099                 if (state->split)
2100                         break;
2101 #else
2102                 state->split_start++;
2103 #endif
2104                 /* fall through */
2105         case 7:
2106                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
2107                                         rdev->wiphy.software_iftypes))
2108                         goto nla_put_failure;
2109
2110                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
2111                                                    state->split))
2112                         goto nla_put_failure;
2113
2114                 state->split_start++;
2115                 if (state->split)
2116                         break;
2117                 /* fall through */
2118         case 8:
2119                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
2120                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
2121                                 rdev->wiphy.ap_sme_capa))
2122                         goto nla_put_failure;
2123
2124                 features = rdev->wiphy.features;
2125                 /*
2126                  * We can only add the per-channel limit information if the
2127                  * dump is split, otherwise it makes it too big. Therefore
2128                  * only advertise it in that case.
2129                  */
2130                 if (state->split)
2131                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
2132                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
2133                         goto nla_put_failure;
2134
2135                 if (rdev->wiphy.ht_capa_mod_mask &&
2136                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
2137                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
2138                             rdev->wiphy.ht_capa_mod_mask))
2139                         goto nla_put_failure;
2140
2141                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
2142                     rdev->wiphy.max_acl_mac_addrs &&
2143                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
2144                                 rdev->wiphy.max_acl_mac_addrs))
2145                         goto nla_put_failure;
2146
2147                 /*
2148                  * Any information below this point is only available to
2149                  * applications that can deal with it being split. This
2150                  * helps ensure that newly added capabilities don't break
2151                  * older tools by overrunning their buffers.
2152                  *
2153                  * We still increment split_start so that in the split
2154                  * case we'll continue with more data in the next round,
2155                  * but break unconditionally so unsplit data stops here.
2156                  */
2157                 state->split_start++;
2158                 break;
2159         case 9:
2160                 if (rdev->wiphy.extended_capabilities &&
2161                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
2162                              rdev->wiphy.extended_capabilities_len,
2163                              rdev->wiphy.extended_capabilities) ||
2164                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2165                              rdev->wiphy.extended_capabilities_len,
2166                              rdev->wiphy.extended_capabilities_mask)))
2167                         goto nla_put_failure;
2168
2169                 if (rdev->wiphy.vht_capa_mod_mask &&
2170                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
2171                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
2172                             rdev->wiphy.vht_capa_mod_mask))
2173                         goto nla_put_failure;
2174
2175                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
2176                             rdev->wiphy.perm_addr))
2177                         goto nla_put_failure;
2178
2179                 if (!is_zero_ether_addr(rdev->wiphy.addr_mask) &&
2180                     nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
2181                             rdev->wiphy.addr_mask))
2182                         goto nla_put_failure;
2183
2184                 if (rdev->wiphy.n_addresses > 1) {
2185                         void *attr;
2186
2187                         attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
2188                         if (!attr)
2189                                 goto nla_put_failure;
2190
2191                         for (i = 0; i < rdev->wiphy.n_addresses; i++)
2192                                 if (nla_put(msg, i + 1, ETH_ALEN,
2193                                             rdev->wiphy.addresses[i].addr))
2194                                         goto nla_put_failure;
2195
2196                         nla_nest_end(msg, attr);
2197                 }
2198
2199                 state->split_start++;
2200                 break;
2201         case 10:
2202                 if (nl80211_send_coalesce(msg, rdev))
2203                         goto nla_put_failure;
2204
2205                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
2206                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
2207                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
2208                         goto nla_put_failure;
2209
2210                 if (rdev->wiphy.max_ap_assoc_sta &&
2211                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
2212                                 rdev->wiphy.max_ap_assoc_sta))
2213                         goto nla_put_failure;
2214
2215                 state->split_start++;
2216                 break;
2217         case 11:
2218                 if (rdev->wiphy.n_vendor_commands) {
2219                         const struct nl80211_vendor_cmd_info *info;
2220                         struct nlattr *nested;
2221
2222                         nested = nla_nest_start_noflag(msg,
2223                                                        NL80211_ATTR_VENDOR_DATA);
2224                         if (!nested)
2225                                 goto nla_put_failure;
2226
2227                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
2228                                 info = &rdev->wiphy.vendor_commands[i].info;
2229                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2230                                         goto nla_put_failure;
2231                         }
2232                         nla_nest_end(msg, nested);
2233                 }
2234
2235                 if (rdev->wiphy.n_vendor_events) {
2236                         const struct nl80211_vendor_cmd_info *info;
2237                         struct nlattr *nested;
2238
2239                         nested = nla_nest_start_noflag(msg,
2240                                                        NL80211_ATTR_VENDOR_EVENTS);
2241                         if (!nested)
2242                                 goto nla_put_failure;
2243
2244                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
2245                                 info = &rdev->wiphy.vendor_events[i];
2246                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2247                                         goto nla_put_failure;
2248                         }
2249                         nla_nest_end(msg, nested);
2250                 }
2251                 state->split_start++;
2252                 break;
2253         case 12:
2254                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
2255                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
2256                                rdev->wiphy.max_num_csa_counters))
2257                         goto nla_put_failure;
2258
2259                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2260                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
2261                         goto nla_put_failure;
2262
2263                 if (rdev->wiphy.max_sched_scan_reqs &&
2264                     nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
2265                                 rdev->wiphy.max_sched_scan_reqs))
2266                         goto nla_put_failure;
2267
2268                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2269                             sizeof(rdev->wiphy.ext_features),
2270                             rdev->wiphy.ext_features))
2271                         goto nla_put_failure;
2272
2273                 if (rdev->wiphy.bss_select_support) {
2274                         struct nlattr *nested;
2275                         u32 bss_select_support = rdev->wiphy.bss_select_support;
2276
2277                         nested = nla_nest_start_noflag(msg,
2278                                                        NL80211_ATTR_BSS_SELECT);
2279                         if (!nested)
2280                                 goto nla_put_failure;
2281
2282                         i = 0;
2283                         while (bss_select_support) {
2284                                 if ((bss_select_support & 1) &&
2285                                     nla_put_flag(msg, i))
2286                                         goto nla_put_failure;
2287                                 i++;
2288                                 bss_select_support >>= 1;
2289                         }
2290                         nla_nest_end(msg, nested);
2291                 }
2292
2293                 state->split_start++;
2294                 break;
2295         case 13:
2296                 if (rdev->wiphy.num_iftype_ext_capab &&
2297                     rdev->wiphy.iftype_ext_capab) {
2298                         struct nlattr *nested_ext_capab, *nested;
2299
2300                         nested = nla_nest_start_noflag(msg,
2301                                                        NL80211_ATTR_IFTYPE_EXT_CAPA);
2302                         if (!nested)
2303                                 goto nla_put_failure;
2304
2305                         for (i = state->capa_start;
2306                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
2307                                 const struct wiphy_iftype_ext_capab *capab;
2308
2309                                 capab = &rdev->wiphy.iftype_ext_capab[i];
2310
2311                                 nested_ext_capab = nla_nest_start_noflag(msg,
2312                                                                          i);
2313                                 if (!nested_ext_capab ||
2314                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
2315                                                 capab->iftype) ||
2316                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
2317                                             capab->extended_capabilities_len,
2318                                             capab->extended_capabilities) ||
2319                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2320                                             capab->extended_capabilities_len,
2321                                             capab->extended_capabilities_mask))
2322                                         goto nla_put_failure;
2323
2324                                 nla_nest_end(msg, nested_ext_capab);
2325                                 if (state->split)
2326                                         break;
2327                         }
2328                         nla_nest_end(msg, nested);
2329                         if (i < rdev->wiphy.num_iftype_ext_capab) {
2330                                 state->capa_start = i + 1;
2331                                 break;
2332                         }
2333                 }
2334
2335                 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
2336                                 rdev->wiphy.nan_supported_bands))
2337                         goto nla_put_failure;
2338
2339                 if (wiphy_ext_feature_isset(&rdev->wiphy,
2340                                             NL80211_EXT_FEATURE_TXQS)) {
2341                         struct cfg80211_txq_stats txqstats = {};
2342                         int res;
2343
2344                         res = rdev_get_txq_stats(rdev, NULL, &txqstats);
2345                         if (!res &&
2346                             !nl80211_put_txq_stats(msg, &txqstats,
2347                                                    NL80211_ATTR_TXQ_STATS))
2348                                 goto nla_put_failure;
2349
2350                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
2351                                         rdev->wiphy.txq_limit))
2352                                 goto nla_put_failure;
2353                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
2354                                         rdev->wiphy.txq_memory_limit))
2355                                 goto nla_put_failure;
2356                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
2357                                         rdev->wiphy.txq_quantum))
2358                                 goto nla_put_failure;
2359                 }
2360
2361                 state->split_start++;
2362                 break;
2363         case 14:
2364                 if (nl80211_send_pmsr_capa(rdev, msg))
2365                         goto nla_put_failure;
2366
2367                 state->split_start++;
2368                 break;
2369         case 15:
2370                 if (rdev->wiphy.akm_suites &&
2371                     nla_put(msg, NL80211_ATTR_AKM_SUITES,
2372                             sizeof(u32) * rdev->wiphy.n_akm_suites,
2373                             rdev->wiphy.akm_suites))
2374                         goto nla_put_failure;
2375
2376                 /* done */
2377                 state->split_start = 0;
2378                 break;
2379         }
2380  finish:
2381         genlmsg_end(msg, hdr);
2382         return 0;
2383
2384  nla_put_failure:
2385         genlmsg_cancel(msg, hdr);
2386         return -EMSGSIZE;
2387 }
2388
2389 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
2390                                     struct netlink_callback *cb,
2391                                     struct nl80211_dump_wiphy_state *state)
2392 {
2393         struct nlattr **tb = genl_family_attrbuf(&nl80211_fam);
2394         int ret = nlmsg_parse_deprecated(cb->nlh,
2395                                          GENL_HDRLEN + nl80211_fam.hdrsize,
2396                                          tb, nl80211_fam.maxattr,
2397                                          nl80211_policy, NULL);
2398         /* ignore parse errors for backward compatibility */
2399         if (ret)
2400                 return 0;
2401
2402         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
2403         if (tb[NL80211_ATTR_WIPHY])
2404                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
2405         if (tb[NL80211_ATTR_WDEV])
2406                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
2407         if (tb[NL80211_ATTR_IFINDEX]) {
2408                 struct net_device *netdev;
2409                 struct cfg80211_registered_device *rdev;
2410                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2411
2412                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2413                 if (!netdev)
2414                         return -ENODEV;
2415                 if (netdev->ieee80211_ptr) {
2416                         rdev = wiphy_to_rdev(
2417                                 netdev->ieee80211_ptr->wiphy);
2418                         state->filter_wiphy = rdev->wiphy_idx;
2419                 }
2420         }
2421
2422         return 0;
2423 }
2424
2425 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
2426 {
2427         int idx = 0, ret;
2428         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
2429         struct cfg80211_registered_device *rdev;
2430
2431         rtnl_lock();
2432         if (!state) {
2433                 state = kzalloc(sizeof(*state), GFP_KERNEL);
2434                 if (!state) {
2435                         rtnl_unlock();
2436                         return -ENOMEM;
2437                 }
2438                 state->filter_wiphy = -1;
2439                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
2440                 if (ret) {
2441                         kfree(state);
2442                         rtnl_unlock();
2443                         return ret;
2444                 }
2445                 cb->args[0] = (long)state;
2446         }
2447
2448         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2449                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2450                         continue;
2451                 if (++idx <= state->start)
2452                         continue;
2453                 if (state->filter_wiphy != -1 &&
2454                     state->filter_wiphy != rdev->wiphy_idx)
2455                         continue;
2456                 /* attempt to fit multiple wiphy data chunks into the skb */
2457                 do {
2458                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
2459                                                  skb,
2460                                                  NETLINK_CB(cb->skb).portid,
2461                                                  cb->nlh->nlmsg_seq,
2462                                                  NLM_F_MULTI, state);
2463                         if (ret < 0) {
2464                                 /*
2465                                  * If sending the wiphy data didn't fit (ENOBUFS
2466                                  * or EMSGSIZE returned), this SKB is still
2467                                  * empty (so it's not too big because another
2468                                  * wiphy dataset is already in the skb) and
2469                                  * we've not tried to adjust the dump allocation
2470                                  * yet ... then adjust the alloc size to be
2471                                  * bigger, and return 1 but with the empty skb.
2472                                  * This results in an empty message being RX'ed
2473                                  * in userspace, but that is ignored.
2474                                  *
2475                                  * We can then retry with the larger buffer.
2476                                  */
2477                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
2478                                     !skb->len && !state->split &&
2479                                     cb->min_dump_alloc < 4096) {
2480                                         cb->min_dump_alloc = 4096;
2481                                         state->split_start = 0;
2482                                         rtnl_unlock();
2483                                         return 1;
2484                                 }
2485                                 idx--;
2486                                 break;
2487                         }
2488                 } while (state->split_start > 0);
2489                 break;
2490         }
2491         rtnl_unlock();
2492
2493         state->start = idx;
2494
2495         return skb->len;
2496 }
2497
2498 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
2499 {
2500         kfree((void *)cb->args[0]);
2501         return 0;
2502 }
2503
2504 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
2505 {
2506         struct sk_buff *msg;
2507         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2508         struct nl80211_dump_wiphy_state state = {};
2509
2510         msg = nlmsg_new(4096, GFP_KERNEL);
2511         if (!msg)
2512                 return -ENOMEM;
2513
2514         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
2515                                info->snd_portid, info->snd_seq, 0,
2516                                &state) < 0) {
2517                 nlmsg_free(msg);
2518                 return -ENOBUFS;
2519         }
2520
2521         return genlmsg_reply(msg, info);
2522 }
2523
2524 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2525         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
2526         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
2527         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
2528         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
2529         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
2530 };
2531
2532 static int parse_txq_params(struct nlattr *tb[],
2533                             struct ieee80211_txq_params *txq_params)
2534 {
2535         u8 ac;
2536
2537         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2538             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2539             !tb[NL80211_TXQ_ATTR_AIFS])
2540                 return -EINVAL;
2541
2542         ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2543         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2544         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2545         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2546         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2547
2548         if (ac >= NL80211_NUM_ACS)
2549                 return -EINVAL;
2550         txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
2551         return 0;
2552 }
2553
2554 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2555 {
2556         /*
2557          * You can only set the channel explicitly for WDS interfaces,
2558          * all others have their channel managed via their respective
2559          * "establish a connection" command (connect, join, ...)
2560          *
2561          * For AP/GO and mesh mode, the channel can be set with the
2562          * channel userspace API, but is only stored and passed to the
2563          * low-level driver when the AP starts or the mesh is joined.
2564          * This is for backward compatibility, userspace can also give
2565          * the channel in the start-ap or join-mesh commands instead.
2566          *
2567          * Monitors are special as they are normally slaved to
2568          * whatever else is going on, so they have their own special
2569          * operation to set the monitor channel if possible.
2570          */
2571         return !wdev ||
2572                 wdev->iftype == NL80211_IFTYPE_AP ||
2573                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2574                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
2575                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
2576 }
2577
2578 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2579                           struct genl_info *info,
2580                           struct cfg80211_chan_def *chandef)
2581 {
2582         struct netlink_ext_ack *extack = info->extack;
2583         struct nlattr **attrs = info->attrs;
2584         u32 control_freq;
2585
2586         if (!attrs[NL80211_ATTR_WIPHY_FREQ])
2587                 return -EINVAL;
2588
2589         control_freq = nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ]);
2590
2591         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
2592         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2593         chandef->center_freq1 = control_freq;
2594         chandef->center_freq2 = 0;
2595
2596         /* Primary channel not allowed */
2597         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) {
2598                 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
2599                                     "Channel is disabled");
2600                 return -EINVAL;
2601         }
2602
2603         if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2604                 enum nl80211_channel_type chantype;
2605
2606                 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2607
2608                 switch (chantype) {
2609                 case NL80211_CHAN_NO_HT:
2610                 case NL80211_CHAN_HT20:
2611                 case NL80211_CHAN_HT40PLUS:
2612                 case NL80211_CHAN_HT40MINUS:
2613                         cfg80211_chandef_create(chandef, chandef->chan,
2614                                                 chantype);
2615                         /* user input for center_freq is incorrect */
2616                         if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
2617                             chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
2618                                 NL_SET_ERR_MSG_ATTR(extack,
2619                                                     attrs[NL80211_ATTR_CENTER_FREQ1],
2620                                                     "bad center frequency 1");
2621                                 return -EINVAL;
2622                         }
2623                         /* center_freq2 must be zero */
2624                         if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
2625                             nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
2626                                 NL_SET_ERR_MSG_ATTR(extack,
2627                                                     attrs[NL80211_ATTR_CENTER_FREQ2],
2628                                                     "center frequency 2 can't be used");
2629                                 return -EINVAL;
2630                         }
2631                         break;
2632                 default:
2633                         NL_SET_ERR_MSG_ATTR(extack,
2634                                             attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
2635                                             "invalid channel type");
2636                         return -EINVAL;
2637                 }
2638         } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2639                 chandef->width =
2640                         nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2641                 if (attrs[NL80211_ATTR_CENTER_FREQ1])
2642                         chandef->center_freq1 =
2643                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
2644                 if (attrs[NL80211_ATTR_CENTER_FREQ2])
2645                         chandef->center_freq2 =
2646                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
2647         }
2648
2649         if (!cfg80211_chandef_valid(chandef)) {
2650                 NL_SET_ERR_MSG(extack, "invalid channel definition");
2651                 return -EINVAL;
2652         }
2653
2654         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2655                                      IEEE80211_CHAN_DISABLED)) {
2656                 NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
2657                 return -EINVAL;
2658         }
2659
2660         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2661              chandef->width == NL80211_CHAN_WIDTH_10) &&
2662             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
2663                 NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
2664                 return -EINVAL;
2665         }
2666
2667         return 0;
2668 }
2669
2670 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
2671                                  struct net_device *dev,
2672                                  struct genl_info *info)
2673 {
2674         struct cfg80211_chan_def chandef;
2675         int result;
2676         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2677         struct wireless_dev *wdev = NULL;
2678
2679         if (dev)
2680                 wdev = dev->ieee80211_ptr;
2681         if (!nl80211_can_set_dev_channel(wdev))
2682                 return -EOPNOTSUPP;
2683         if (wdev)
2684                 iftype = wdev->iftype;
2685
2686         result = nl80211_parse_chandef(rdev, info, &chandef);
2687         if (result)
2688                 return result;
2689
2690         switch (iftype) {
2691         case NL80211_IFTYPE_AP:
2692         case NL80211_IFTYPE_P2P_GO:
2693                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2694                                                    iftype)) {
2695                         result = -EINVAL;
2696                         break;
2697                 }
2698                 if (wdev->beacon_interval) {
2699                         if (!dev || !rdev->ops->set_ap_chanwidth ||
2700                             !(rdev->wiphy.features &
2701                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2702                                 result = -EBUSY;
2703                                 break;
2704                         }
2705
2706                         /* Only allow dynamic channel width changes */
2707                         if (chandef.chan != wdev->preset_chandef.chan) {
2708                                 result = -EBUSY;
2709                                 break;
2710                         }
2711                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2712                         if (result)
2713                                 break;
2714                 }
2715                 wdev->preset_chandef = chandef;
2716                 result = 0;
2717                 break;
2718         case NL80211_IFTYPE_MESH_POINT:
2719                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2720                 break;
2721         case NL80211_IFTYPE_MONITOR:
2722                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2723                 break;
2724         default:
2725                 result = -EINVAL;
2726         }
2727
2728         return result;
2729 }
2730
2731 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2732 {
2733         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2734         struct net_device *netdev = info->user_ptr[1];
2735
2736         return __nl80211_set_channel(rdev, netdev, info);
2737 }
2738
2739 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2740 {
2741         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2742         struct net_device *dev = info->user_ptr[1];
2743         struct wireless_dev *wdev = dev->ieee80211_ptr;
2744         const u8 *bssid;
2745
2746         if (!info->attrs[NL80211_ATTR_MAC])
2747                 return -EINVAL;
2748
2749         if (netif_running(dev))
2750                 return -EBUSY;
2751
2752         if (!rdev->ops->set_wds_peer)
2753                 return -EOPNOTSUPP;
2754
2755         if (wdev->iftype != NL80211_IFTYPE_WDS)
2756                 return -EOPNOTSUPP;
2757
2758         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2759         return rdev_set_wds_peer(rdev, dev, bssid);
2760 }
2761
2762 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2763 {
2764         struct cfg80211_registered_device *rdev;
2765         struct net_device *netdev = NULL;
2766         struct wireless_dev *wdev;
2767         int result = 0, rem_txq_params = 0;
2768         struct nlattr *nl_txq_params;
2769         u32 changed;
2770         u8 retry_short = 0, retry_long = 0;
2771         u32 frag_threshold = 0, rts_threshold = 0;
2772         u8 coverage_class = 0;
2773         u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
2774
2775         ASSERT_RTNL();
2776
2777         /*
2778          * Try to find the wiphy and netdev. Normally this
2779          * function shouldn't need the netdev, but this is
2780          * done for backward compatibility -- previously
2781          * setting the channel was done per wiphy, but now
2782          * it is per netdev. Previous userland like hostapd
2783          * also passed a netdev to set_wiphy, so that it is
2784          * possible to let that go to the right netdev!
2785          */
2786
2787         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2788                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2789
2790                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2791                 if (netdev && netdev->ieee80211_ptr)
2792                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2793                 else
2794                         netdev = NULL;
2795         }
2796
2797         if (!netdev) {
2798                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2799                                                   info->attrs);
2800                 if (IS_ERR(rdev))
2801                         return PTR_ERR(rdev);
2802                 wdev = NULL;
2803                 netdev = NULL;
2804                 result = 0;
2805         } else
2806                 wdev = netdev->ieee80211_ptr;
2807
2808         /*
2809          * end workaround code, by now the rdev is available
2810          * and locked, and wdev may or may not be NULL.
2811          */
2812
2813         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2814                 result = cfg80211_dev_rename(
2815                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2816
2817         if (result)
2818                 return result;
2819
2820         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2821                 struct ieee80211_txq_params txq_params;
2822                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2823
2824                 if (!rdev->ops->set_txq_params)
2825                         return -EOPNOTSUPP;
2826
2827                 if (!netdev)
2828                         return -EINVAL;
2829
2830                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2831                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2832                         return -EINVAL;
2833
2834                 if (!netif_running(netdev))
2835                         return -ENETDOWN;
2836
2837                 nla_for_each_nested(nl_txq_params,
2838                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2839                                     rem_txq_params) {
2840                         result = nla_parse_nested_deprecated(tb,
2841                                                              NL80211_TXQ_ATTR_MAX,
2842                                                              nl_txq_params,
2843                                                              txq_params_policy,
2844                                                              info->extack);
2845                         if (result)
2846                                 return result;
2847                         result = parse_txq_params(tb, &txq_params);
2848                         if (result)
2849                                 return result;
2850
2851                         result = rdev_set_txq_params(rdev, netdev,
2852                                                      &txq_params);
2853                         if (result)
2854                                 return result;
2855                 }
2856         }
2857
2858         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2859                 result = __nl80211_set_channel(
2860                         rdev,
2861                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2862                         info);
2863                 if (result)
2864                         return result;
2865         }
2866
2867         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2868                 struct wireless_dev *txp_wdev = wdev;
2869                 enum nl80211_tx_power_setting type;
2870                 int idx, mbm = 0;
2871
2872                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2873                         txp_wdev = NULL;
2874
2875                 if (!rdev->ops->set_tx_power)
2876                         return -EOPNOTSUPP;
2877
2878                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2879                 type = nla_get_u32(info->attrs[idx]);
2880
2881                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2882                     (type != NL80211_TX_POWER_AUTOMATIC))
2883                         return -EINVAL;
2884
2885                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2886                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2887                         mbm = nla_get_u32(info->attrs[idx]);
2888                 }
2889
2890                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2891                 if (result)
2892                         return result;
2893         }
2894
2895         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2896             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2897                 u32 tx_ant, rx_ant;
2898
2899                 if ((!rdev->wiphy.available_antennas_tx &&
2900                      !rdev->wiphy.available_antennas_rx) ||
2901                     !rdev->ops->set_antenna)
2902                         return -EOPNOTSUPP;
2903
2904                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2905                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2906
2907                 /* reject antenna configurations which don't match the
2908                  * available antenna masks, except for the "all" mask */
2909                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2910                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2911                         return -EINVAL;
2912
2913                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2914                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2915
2916                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2917                 if (result)
2918                         return result;
2919         }
2920
2921         changed = 0;
2922
2923         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2924                 retry_short = nla_get_u8(
2925                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2926
2927                 changed |= WIPHY_PARAM_RETRY_SHORT;
2928         }
2929
2930         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2931                 retry_long = nla_get_u8(
2932                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2933
2934                 changed |= WIPHY_PARAM_RETRY_LONG;
2935         }
2936
2937         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2938                 frag_threshold = nla_get_u32(
2939                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2940                 if (frag_threshold < 256)
2941                         return -EINVAL;
2942
2943                 if (frag_threshold != (u32) -1) {
2944                         /*
2945                          * Fragments (apart from the last one) are required to
2946                          * have even length. Make the fragmentation code
2947                          * simpler by stripping LSB should someone try to use
2948                          * odd threshold value.
2949                          */
2950                         frag_threshold &= ~0x1;
2951                 }
2952                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2953         }
2954
2955         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2956                 rts_threshold = nla_get_u32(
2957                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2958                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2959         }
2960
2961         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2962                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2963                         return -EINVAL;
2964
2965                 coverage_class = nla_get_u8(
2966                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2967                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2968         }
2969
2970         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2971                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2972                         return -EOPNOTSUPP;
2973
2974                 changed |= WIPHY_PARAM_DYN_ACK;
2975         }
2976
2977         if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
2978                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2979                                              NL80211_EXT_FEATURE_TXQS))
2980                         return -EOPNOTSUPP;
2981                 txq_limit = nla_get_u32(
2982                         info->attrs[NL80211_ATTR_TXQ_LIMIT]);
2983                 changed |= WIPHY_PARAM_TXQ_LIMIT;
2984         }
2985
2986         if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
2987                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2988                                              NL80211_EXT_FEATURE_TXQS))
2989                         return -EOPNOTSUPP;
2990                 txq_memory_limit = nla_get_u32(
2991                         info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
2992                 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
2993         }
2994
2995         if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
2996                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2997                                              NL80211_EXT_FEATURE_TXQS))
2998                         return -EOPNOTSUPP;
2999                 txq_quantum = nla_get_u32(
3000                         info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
3001                 changed |= WIPHY_PARAM_TXQ_QUANTUM;
3002         }
3003
3004         if (changed) {
3005                 u8 old_retry_short, old_retry_long;
3006                 u32 old_frag_threshold, old_rts_threshold;
3007                 u8 old_coverage_class;
3008                 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
3009
3010                 if (!rdev->ops->set_wiphy_params)
3011                         return -EOPNOTSUPP;
3012
3013                 old_retry_short = rdev->wiphy.retry_short;
3014                 old_retry_long = rdev->wiphy.retry_long;
3015                 old_frag_threshold = rdev->wiphy.frag_threshold;
3016                 old_rts_threshold = rdev->wiphy.rts_threshold;
3017                 old_coverage_class = rdev->wiphy.coverage_class;
3018                 old_txq_limit = rdev->wiphy.txq_limit;
3019                 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
3020                 old_txq_quantum = rdev->wiphy.txq_quantum;
3021
3022                 if (changed & WIPHY_PARAM_RETRY_SHORT)
3023                         rdev->wiphy.retry_short = retry_short;
3024                 if (changed & WIPHY_PARAM_RETRY_LONG)
3025                         rdev->wiphy.retry_long = retry_long;
3026                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
3027                         rdev->wiphy.frag_threshold = frag_threshold;
3028                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
3029                         rdev->wiphy.rts_threshold = rts_threshold;
3030                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
3031                         rdev->wiphy.coverage_class = coverage_class;
3032                 if (changed & WIPHY_PARAM_TXQ_LIMIT)
3033                         rdev->wiphy.txq_limit = txq_limit;
3034                 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
3035                         rdev->wiphy.txq_memory_limit = txq_memory_limit;
3036                 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
3037                         rdev->wiphy.txq_quantum = txq_quantum;
3038
3039                 result = rdev_set_wiphy_params(rdev, changed);
3040                 if (result) {
3041                         rdev->wiphy.retry_short = old_retry_short;
3042                         rdev->wiphy.retry_long = old_retry_long;
3043                         rdev->wiphy.frag_threshold = old_frag_threshold;
3044                         rdev->wiphy.rts_threshold = old_rts_threshold;
3045                         rdev->wiphy.coverage_class = old_coverage_class;
3046                         rdev->wiphy.txq_limit = old_txq_limit;
3047                         rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
3048                         rdev->wiphy.txq_quantum = old_txq_quantum;
3049                         return result;
3050                 }
3051         }
3052         return 0;
3053 }
3054
3055 static int nl80211_send_chandef(struct sk_buff *msg,
3056                                 const struct cfg80211_chan_def *chandef)
3057 {
3058         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
3059                 return -EINVAL;
3060
3061         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
3062                         chandef->chan->center_freq))
3063                 return -ENOBUFS;
3064         switch (chandef->width) {
3065         case NL80211_CHAN_WIDTH_20_NOHT:
3066         case NL80211_CHAN_WIDTH_20:
3067         case NL80211_CHAN_WIDTH_40:
3068                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3069                                 cfg80211_get_chandef_type(chandef)))
3070                         return -ENOBUFS;
3071                 break;
3072         default:
3073                 break;
3074         }
3075         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
3076                 return -ENOBUFS;
3077         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
3078                 return -ENOBUFS;
3079         if (chandef->center_freq2 &&
3080             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
3081                 return -ENOBUFS;
3082         return 0;
3083 }
3084
3085 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
3086                               struct cfg80211_registered_device *rdev,
3087                               struct wireless_dev *wdev,
3088                               enum nl80211_commands cmd)
3089 {
3090         struct net_device *dev = wdev->netdev;
3091         void *hdr;
3092
3093         WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
3094                 cmd != NL80211_CMD_DEL_INTERFACE &&
3095                 cmd != NL80211_CMD_SET_INTERFACE);
3096
3097         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3098         if (!hdr)
3099                 return -1;
3100
3101         if (dev &&
3102             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3103              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
3104                 goto nla_put_failure;
3105
3106         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
3107             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
3108             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
3109                               NL80211_ATTR_PAD) ||
3110             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
3111             nla_put_u32(msg, NL80211_ATTR_GENERATION,
3112                         rdev->devlist_generation ^
3113                         (cfg80211_rdev_list_generation << 2)) ||
3114             nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr))
3115                 goto nla_put_failure;
3116
3117         if (rdev->ops->get_channel) {
3118                 int ret;
3119                 struct cfg80211_chan_def chandef;
3120
3121                 ret = rdev_get_channel(rdev, wdev, &chandef);
3122                 if (ret == 0) {
3123                         if (nl80211_send_chandef(msg, &chandef))
3124                                 goto nla_put_failure;
3125                 }
3126         }
3127
3128         if (rdev->ops->get_tx_power) {
3129                 int dbm, ret;
3130
3131                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
3132                 if (ret == 0 &&
3133                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
3134                                 DBM_TO_MBM(dbm)))
3135                         goto nla_put_failure;
3136         }
3137
3138         wdev_lock(wdev);
3139         switch (wdev->iftype) {
3140         case NL80211_IFTYPE_AP:
3141                 if (wdev->ssid_len &&
3142                     nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
3143                         goto nla_put_failure_locked;
3144                 break;
3145         case NL80211_IFTYPE_STATION:
3146         case NL80211_IFTYPE_P2P_CLIENT:
3147         case NL80211_IFTYPE_ADHOC: {
3148                 const u8 *ssid_ie;
3149                 if (!wdev->current_bss)
3150                         break;
3151                 rcu_read_lock();
3152                 ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
3153                                                WLAN_EID_SSID);
3154                 if (ssid_ie &&
3155                     nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2))
3156                         goto nla_put_failure_rcu_locked;
3157                 rcu_read_unlock();
3158                 break;
3159                 }
3160         default:
3161                 /* nothing */
3162                 break;
3163         }
3164         wdev_unlock(wdev);
3165
3166         if (rdev->ops->get_txq_stats) {
3167                 struct cfg80211_txq_stats txqstats = {};
3168                 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
3169
3170                 if (ret == 0 &&
3171                     !nl80211_put_txq_stats(msg, &txqstats,
3172                                            NL80211_ATTR_TXQ_STATS))
3173                         goto nla_put_failure;
3174         }
3175
3176         genlmsg_end(msg, hdr);
3177         return 0;
3178
3179  nla_put_failure_rcu_locked:
3180         rcu_read_unlock();
3181  nla_put_failure_locked:
3182         wdev_unlock(wdev);
3183  nla_put_failure:
3184         genlmsg_cancel(msg, hdr);
3185         return -EMSGSIZE;
3186 }
3187
3188 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
3189 {
3190         int wp_idx = 0;
3191         int if_idx = 0;
3192         int wp_start = cb->args[0];
3193         int if_start = cb->args[1];
3194         int filter_wiphy = -1;
3195         struct cfg80211_registered_device *rdev;
3196         struct wireless_dev *wdev;
3197         int ret;
3198
3199         rtnl_lock();
3200         if (!cb->args[2]) {
3201                 struct nl80211_dump_wiphy_state state = {
3202                         .filter_wiphy = -1,
3203                 };
3204
3205                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
3206                 if (ret)
3207                         goto out_unlock;
3208
3209                 filter_wiphy = state.filter_wiphy;
3210
3211                 /*
3212                  * if filtering, set cb->args[2] to +1 since 0 is the default
3213                  * value needed to determine that parsing is necessary.
3214                  */
3215                 if (filter_wiphy >= 0)
3216                         cb->args[2] = filter_wiphy + 1;
3217                 else
3218                         cb->args[2] = -1;
3219         } else if (cb->args[2] > 0) {
3220                 filter_wiphy = cb->args[2] - 1;
3221         }
3222
3223         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3224                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3225                         continue;
3226                 if (wp_idx < wp_start) {
3227                         wp_idx++;
3228                         continue;
3229                 }
3230
3231                 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
3232                         continue;
3233
3234                 if_idx = 0;
3235
3236                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3237                         if (if_idx < if_start) {
3238                                 if_idx++;
3239                                 continue;
3240                         }
3241                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
3242                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
3243                                                rdev, wdev,
3244                                                NL80211_CMD_NEW_INTERFACE) < 0) {
3245                                 goto out;
3246                         }
3247                         if_idx++;
3248                 }
3249
3250                 wp_idx++;
3251         }
3252  out:
3253         cb->args[0] = wp_idx;
3254         cb->args[1] = if_idx;
3255
3256         ret = skb->len;
3257  out_unlock:
3258         rtnl_unlock();
3259
3260         return ret;
3261 }
3262
3263 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
3264 {
3265         struct sk_buff *msg;
3266         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3267         struct wireless_dev *wdev = info->user_ptr[1];
3268
3269         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3270         if (!msg)
3271                 return -ENOMEM;
3272
3273         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3274                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
3275                 nlmsg_free(msg);
3276                 return -ENOBUFS;
3277         }
3278
3279         return genlmsg_reply(msg, info);
3280 }
3281
3282 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
3283         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
3284         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
3285         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
3286         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
3287         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
3288         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
3289 };
3290
3291 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
3292 {
3293         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
3294         int flag;
3295
3296         *mntrflags = 0;
3297
3298         if (!nla)
3299                 return -EINVAL;
3300
3301         if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL))
3302                 return -EINVAL;
3303
3304         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
3305                 if (flags[flag])
3306                         *mntrflags |= (1<<flag);
3307
3308         *mntrflags |= MONITOR_FLAG_CHANGED;
3309
3310         return 0;
3311 }
3312
3313 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
3314                                      enum nl80211_iftype type,
3315                                      struct genl_info *info,
3316                                      struct vif_params *params)
3317 {
3318         bool change = false;
3319         int err;
3320
3321         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
3322                 if (type != NL80211_IFTYPE_MONITOR)
3323                         return -EINVAL;
3324
3325                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
3326                                           &params->flags);
3327                 if (err)
3328                         return err;
3329
3330                 change = true;
3331         }
3332
3333         if (params->flags & MONITOR_FLAG_ACTIVE &&
3334             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
3335                 return -EOPNOTSUPP;
3336
3337         if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
3338                 const u8 *mumimo_groups;
3339                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3340
3341                 if (type != NL80211_IFTYPE_MONITOR)
3342                         return -EINVAL;
3343
3344                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3345                         return -EOPNOTSUPP;
3346
3347                 mumimo_groups =
3348                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
3349
3350                 /* bits 0 and 63 are reserved and must be zero */
3351                 if ((mumimo_groups[0] & BIT(0)) ||
3352                     (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
3353                         return -EINVAL;
3354
3355                 params->vht_mumimo_groups = mumimo_groups;
3356                 change = true;
3357         }
3358
3359         if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
3360                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3361
3362                 if (type != NL80211_IFTYPE_MONITOR)
3363                         return -EINVAL;
3364
3365                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3366                         return -EOPNOTSUPP;
3367
3368                 params->vht_mumimo_follow_addr =
3369                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
3370                 change = true;
3371         }
3372
3373         return change ? 1 : 0;
3374 }
3375
3376 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
3377                                struct net_device *netdev, u8 use_4addr,
3378                                enum nl80211_iftype iftype)
3379 {
3380         if (!use_4addr) {
3381                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
3382                         return -EBUSY;
3383                 return 0;
3384         }
3385
3386         switch (iftype) {
3387         case NL80211_IFTYPE_AP_VLAN:
3388                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
3389                         return 0;
3390                 break;
3391         case NL80211_IFTYPE_STATION:
3392                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
3393                         return 0;
3394                 break;
3395         default:
3396                 break;
3397         }
3398
3399         return -EOPNOTSUPP;
3400 }
3401
3402 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
3403 {
3404         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3405         struct vif_params params;
3406         int err;
3407         enum nl80211_iftype otype, ntype;
3408         struct net_device *dev = info->user_ptr[1];
3409         bool change = false;
3410
3411         memset(&params, 0, sizeof(params));
3412
3413         otype = ntype = dev->ieee80211_ptr->iftype;
3414
3415         if (info->attrs[NL80211_ATTR_IFTYPE]) {
3416                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3417                 if (otype != ntype)
3418                         change = true;
3419         }
3420
3421         if (info->attrs[NL80211_ATTR_MESH_ID]) {
3422                 struct wireless_dev *wdev = dev->ieee80211_ptr;
3423
3424                 if (ntype != NL80211_IFTYPE_MESH_POINT)
3425                         return -EINVAL;
3426                 if (netif_running(dev))
3427                         return -EBUSY;
3428
3429                 wdev_lock(wdev);
3430                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3431                              IEEE80211_MAX_MESH_ID_LEN);
3432                 wdev->mesh_id_up_len =
3433                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3434                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3435                        wdev->mesh_id_up_len);
3436                 wdev_unlock(wdev);
3437         }
3438
3439         if (info->attrs[NL80211_ATTR_4ADDR]) {
3440                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3441                 change = true;
3442                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
3443                 if (err)
3444                         return err;
3445         } else {
3446                 params.use_4addr = -1;
3447         }
3448
3449         err = nl80211_parse_mon_options(rdev, ntype, info, &params);
3450         if (err < 0)
3451                 return err;
3452         if (err > 0)
3453                 change = true;
3454
3455         if (change)
3456                 err = cfg80211_change_iface(rdev, dev, ntype, &params);
3457         else
3458                 err = 0;
3459
3460         if (!err && params.use_4addr != -1)
3461                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
3462
3463         if (change && !err) {
3464                 struct wireless_dev *wdev = dev->ieee80211_ptr;
3465
3466                 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
3467         }
3468
3469         return err;
3470 }
3471
3472 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
3473 {
3474         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3475         struct vif_params params;
3476         struct wireless_dev *wdev;
3477         struct sk_buff *msg;
3478         int err;
3479         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
3480
3481         /* to avoid failing a new interface creation due to pending removal */
3482         cfg80211_destroy_ifaces(rdev);
3483
3484         memset(&params, 0, sizeof(params));
3485
3486         if (!info->attrs[NL80211_ATTR_IFNAME])
3487                 return -EINVAL;
3488
3489         if (info->attrs[NL80211_ATTR_IFTYPE])
3490                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3491
3492         if (!rdev->ops->add_virtual_intf)
3493                 return -EOPNOTSUPP;
3494
3495         if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
3496              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
3497             info->attrs[NL80211_ATTR_MAC]) {
3498                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
3499                            ETH_ALEN);
3500                 if (!is_valid_ether_addr(params.macaddr))
3501                         return -EADDRNOTAVAIL;
3502         }
3503
3504         if (info->attrs[NL80211_ATTR_4ADDR]) {
3505                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3506                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
3507                 if (err)
3508                         return err;
3509         }
3510
3511         if (!(rdev->wiphy.interface_modes & (1 << type)) &&
3512             !(type == NL80211_IFTYPE_AP_VLAN && params.use_4addr &&
3513               rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP))
3514                 return -EOPNOTSUPP;
3515
3516         err = nl80211_parse_mon_options(rdev, type, info, &params);
3517         if (err < 0)
3518                 return err;
3519
3520         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3521         if (!msg)
3522                 return -ENOMEM;
3523
3524         wdev = rdev_add_virtual_intf(rdev,
3525                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
3526                                 NET_NAME_USER, type, &params);
3527         if (WARN_ON(!wdev)) {
3528                 nlmsg_free(msg);
3529                 return -EPROTO;
3530         } else if (IS_ERR(wdev)) {
3531                 nlmsg_free(msg);
3532                 return PTR_ERR(wdev);
3533         }
3534
3535         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
3536                 wdev->owner_nlportid = info->snd_portid;
3537
3538         switch (type) {
3539         case NL80211_IFTYPE_MESH_POINT:
3540                 if (!info->attrs[NL80211_ATTR_MESH_ID])
3541                         break;
3542                 wdev_lock(wdev);
3543                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3544                              IEEE80211_MAX_MESH_ID_LEN);
3545                 wdev->mesh_id_up_len =
3546                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3547                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3548                        wdev->mesh_id_up_len);
3549                 wdev_unlock(wdev);
3550                 break;
3551         case NL80211_IFTYPE_NAN:
3552         case NL80211_IFTYPE_P2P_DEVICE:
3553                 /*
3554                  * P2P Device and NAN do not have a netdev, so don't go
3555                  * through the netdev notifier and must be added here
3556                  */
3557                 cfg80211_init_wdev(rdev, wdev);
3558                 break;
3559         default:
3560                 break;
3561         }
3562
3563         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3564                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
3565                 nlmsg_free(msg);
3566                 return -ENOBUFS;
3567         }
3568
3569         return genlmsg_reply(msg, info);
3570 }
3571
3572 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
3573 {
3574         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3575         struct wireless_dev *wdev = info->user_ptr[1];
3576
3577         if (!rdev->ops->del_virtual_intf)
3578                 return -EOPNOTSUPP;
3579
3580         /*
3581          * If we remove a wireless device without a netdev then clear
3582          * user_ptr[1] so that nl80211_post_doit won't dereference it
3583          * to check if it needs to do dev_put(). Otherwise it crashes
3584          * since the wdev has been freed, unlike with a netdev where
3585          * we need the dev_put() for the netdev to really be freed.
3586          */
3587         if (!wdev->netdev)
3588                 info->user_ptr[1] = NULL;
3589
3590         return rdev_del_virtual_intf(rdev, wdev);
3591 }
3592
3593 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
3594 {
3595         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3596         struct net_device *dev = info->user_ptr[1];
3597         u16 noack_map;
3598
3599         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
3600                 return -EINVAL;
3601
3602         if (!rdev->ops->set_noack_map)
3603                 return -EOPNOTSUPP;
3604
3605         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
3606
3607         return rdev_set_noack_map(rdev, dev, noack_map);
3608 }
3609
3610 struct get_key_cookie {
3611         struct sk_buff *msg;
3612         int error;
3613         int idx;
3614 };
3615
3616 static void get_key_callback(void *c, struct key_params *params)
3617 {
3618         struct nlattr *key;
3619         struct get_key_cookie *cookie = c;
3620
3621         if ((params->key &&
3622              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
3623                      params->key_len, params->key)) ||
3624             (params->seq &&
3625              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
3626                      params->seq_len, params->seq)) ||
3627             (params->cipher &&
3628              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
3629                          params->cipher)))
3630                 goto nla_put_failure;
3631
3632         key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY);
3633         if (!key)
3634                 goto nla_put_failure;
3635
3636         if ((params->key &&
3637              nla_put(cookie->msg, NL80211_KEY_DATA,
3638                      params->key_len, params->key)) ||
3639             (params->seq &&
3640              nla_put(cookie->msg, NL80211_KEY_SEQ,
3641                      params->seq_len, params->seq)) ||
3642             (params->cipher &&
3643              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
3644                          params->cipher)))
3645                 goto nla_put_failure;
3646
3647         if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
3648                 goto nla_put_failure;
3649
3650         nla_nest_end(cookie->msg, key);
3651
3652         return;
3653  nla_put_failure:
3654         cookie->error = 1;
3655 }
3656
3657 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
3658 {
3659         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3660         int err;
3661         struct net_device *dev = info->user_ptr[1];
3662         u8 key_idx = 0;
3663         const u8 *mac_addr = NULL;
3664         bool pairwise;
3665         struct get_key_cookie cookie = {
3666                 .error = 0,
3667         };
3668         void *hdr;
3669         struct sk_buff *msg;
3670
3671         if (info->attrs[NL80211_ATTR_KEY_IDX])
3672                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
3673
3674         if (info->attrs[NL80211_ATTR_MAC])
3675                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3676
3677         pairwise = !!mac_addr;
3678         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
3679                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
3680
3681                 if (kt != NL80211_KEYTYPE_GROUP &&
3682                     kt != NL80211_KEYTYPE_PAIRWISE)
3683                         return -EINVAL;
3684                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
3685         }
3686
3687         if (!rdev->ops->get_key)
3688                 return -EOPNOTSUPP;
3689
3690         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3691                 return -ENOENT;
3692
3693         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3694         if (!msg)
3695                 return -ENOMEM;
3696
3697         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3698                              NL80211_CMD_NEW_KEY);
3699         if (!hdr)
3700                 goto nla_put_failure;
3701
3702         cookie.msg = msg;
3703         cookie.idx = key_idx;
3704
3705         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3706             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
3707                 goto nla_put_failure;
3708         if (mac_addr &&
3709             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
3710                 goto nla_put_failure;
3711
3712         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
3713                            get_key_callback);
3714
3715         if (err)
3716                 goto free_msg;
3717
3718         if (cookie.error)
3719                 goto nla_put_failure;
3720
3721         genlmsg_end(msg, hdr);
3722         return genlmsg_reply(msg, info);
3723
3724  nla_put_failure:
3725         err = -ENOBUFS;
3726  free_msg:
3727         nlmsg_free(msg);
3728         return err;
3729 }
3730
3731 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
3732 {
3733         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3734         struct key_parse key;
3735         int err;
3736         struct net_device *dev = info->user_ptr[1];
3737
3738         err = nl80211_parse_key(info, &key);
3739         if (err)
3740                 return err;
3741
3742         if (key.idx < 0)
3743                 return -EINVAL;
3744
3745         /* Only support setting default key and
3746          * Extended Key ID action NL80211_KEY_SET_TX.
3747          */
3748         if (!key.def && !key.defmgmt &&
3749             !(key.p.mode == NL80211_KEY_SET_TX))
3750                 return -EINVAL;
3751
3752         wdev_lock(dev->ieee80211_ptr);
3753
3754         if (key.def) {
3755                 if (!rdev->ops->set_default_key) {
3756                         err = -EOPNOTSUPP;
3757                         goto out;
3758                 }
3759
3760                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3761                 if (err)
3762                         goto out;
3763
3764                 err = rdev_set_default_key(rdev, dev, key.idx,
3765                                                  key.def_uni, key.def_multi);
3766
3767                 if (err)
3768                         goto out;
3769
3770 #ifdef CONFIG_CFG80211_WEXT
3771                 dev->ieee80211_ptr->wext.default_key = key.idx;
3772 #endif
3773         } else if (key.defmgmt) {
3774                 if (key.def_uni || !key.def_multi) {
3775                         err = -EINVAL;
3776                         goto out;
3777                 }
3778
3779                 if (!rdev->ops->set_default_mgmt_key) {
3780                         err = -EOPNOTSUPP;
3781                         goto out;
3782                 }
3783
3784                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3785                 if (err)
3786                         goto out;
3787
3788                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
3789                 if (err)
3790                         goto out;
3791
3792 #ifdef CONFIG_CFG80211_WEXT
3793                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3794 #endif
3795         } else if (key.p.mode == NL80211_KEY_SET_TX &&
3796                    wiphy_ext_feature_isset(&rdev->wiphy,
3797                                            NL80211_EXT_FEATURE_EXT_KEY_ID)) {
3798                 u8 *mac_addr = NULL;
3799
3800                 if (info->attrs[NL80211_ATTR_MAC])
3801                         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3802
3803                 if (!mac_addr || key.idx < 0 || key.idx > 1) {
3804                         err = -EINVAL;
3805                         goto out;
3806                 }
3807
3808                 err = rdev_add_key(rdev, dev, key.idx,
3809                                    NL80211_KEYTYPE_PAIRWISE,
3810                                    mac_addr, &key.p);
3811         } else {
3812                 err = -EINVAL;
3813         }
3814  out:
3815         wdev_unlock(dev->ieee80211_ptr);
3816
3817         return err;
3818 }
3819
3820 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3821 {
3822         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3823         int err;
3824         struct net_device *dev = info->user_ptr[1];
3825         struct key_parse key;
3826         const u8 *mac_addr = NULL;
3827
3828         err = nl80211_parse_key(info, &key);
3829         if (err)
3830                 return err;
3831
3832         if (!key.p.key)
3833                 return -EINVAL;
3834
3835         if (info->attrs[NL80211_ATTR_MAC])
3836                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3837
3838         if (key.type == -1) {
3839                 if (mac_addr)
3840                         key.type = NL80211_KEYTYPE_PAIRWISE;
3841                 else
3842                         key.type = NL80211_KEYTYPE_GROUP;
3843         }
3844
3845         /* for now */
3846         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3847             key.type != NL80211_KEYTYPE_GROUP)
3848                 return -EINVAL;
3849
3850         if (!rdev->ops->add_key)
3851                 return -EOPNOTSUPP;
3852
3853         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3854                                            key.type == NL80211_KEYTYPE_PAIRWISE,
3855                                            mac_addr))
3856                 return -EINVAL;
3857
3858         wdev_lock(dev->ieee80211_ptr);
3859         err = nl80211_key_allowed(dev->ieee80211_ptr);
3860         if (!err)
3861                 err = rdev_add_key(rdev, dev, key.idx,
3862                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3863                                     mac_addr, &key.p);
3864         wdev_unlock(dev->ieee80211_ptr);
3865
3866         return err;
3867 }
3868
3869 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3870 {
3871         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3872         int err;
3873         struct net_device *dev = info->user_ptr[1];
3874         u8 *mac_addr = NULL;
3875         struct key_parse key;
3876
3877         err = nl80211_parse_key(info, &key);
3878         if (err)
3879                 return err;
3880
3881         if (info->attrs[NL80211_ATTR_MAC])
3882                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3883
3884         if (key.type == -1) {
3885                 if (mac_addr)
3886                         key.type = NL80211_KEYTYPE_PAIRWISE;
3887                 else
3888                         key.type = NL80211_KEYTYPE_GROUP;
3889         }
3890
3891         /* for now */
3892         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3893             key.type != NL80211_KEYTYPE_GROUP)
3894                 return -EINVAL;
3895
3896         if (!rdev->ops->del_key)
3897                 return -EOPNOTSUPP;
3898
3899         wdev_lock(dev->ieee80211_ptr);
3900         err = nl80211_key_allowed(dev->ieee80211_ptr);
3901
3902         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3903             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3904                 err = -ENOENT;
3905
3906         if (!err)
3907                 err = rdev_del_key(rdev, dev, key.idx,
3908                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3909                                    mac_addr);
3910
3911 #ifdef CONFIG_CFG80211_WEXT
3912         if (!err) {
3913                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3914                         dev->ieee80211_ptr->wext.default_key = -1;
3915                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3916                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3917         }
3918 #endif
3919         wdev_unlock(dev->ieee80211_ptr);
3920
3921         return err;
3922 }
3923
3924 /* This function returns an error or the number of nested attributes */
3925 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3926 {
3927         struct nlattr *attr;
3928         int n_entries = 0, tmp;
3929
3930         nla_for_each_nested(attr, nl_attr, tmp) {
3931                 if (nla_len(attr) != ETH_ALEN)
3932                         return -EINVAL;
3933
3934                 n_entries++;
3935         }
3936
3937         return n_entries;
3938 }
3939
3940 /*
3941  * This function parses ACL information and allocates memory for ACL data.
3942  * On successful return, the calling function is responsible to free the
3943  * ACL buffer returned by this function.
3944  */
3945 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3946                                                 struct genl_info *info)
3947 {
3948         enum nl80211_acl_policy acl_policy;
3949         struct nlattr *attr;
3950         struct cfg80211_acl_data *acl;
3951         int i = 0, n_entries, tmp;
3952
3953         if (!wiphy->max_acl_mac_addrs)
3954                 return ERR_PTR(-EOPNOTSUPP);
3955
3956         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3957                 return ERR_PTR(-EINVAL);
3958
3959         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3960         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3961             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3962                 return ERR_PTR(-EINVAL);
3963
3964         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3965                 return ERR_PTR(-EINVAL);
3966
3967         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3968         if (n_entries < 0)
3969                 return ERR_PTR(n_entries);
3970
3971         if (n_entries > wiphy->max_acl_mac_addrs)
3972                 return ERR_PTR(-ENOTSUPP);
3973
3974         acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL);
3975         if (!acl)
3976                 return ERR_PTR(-ENOMEM);
3977
3978         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3979                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3980                 i++;
3981         }
3982
3983         acl->n_acl_entries = n_entries;
3984         acl->acl_policy = acl_policy;
3985
3986         return acl;
3987 }
3988
3989 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3990 {
3991         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3992         struct net_device *dev = info->user_ptr[1];
3993         struct cfg80211_acl_data *acl;
3994         int err;
3995
3996         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3997             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3998                 return -EOPNOTSUPP;
3999
4000         if (!dev->ieee80211_ptr->beacon_interval)
4001                 return -EINVAL;
4002
4003         acl = parse_acl_data(&rdev->wiphy, info);
4004         if (IS_ERR(acl))
4005                 return PTR_ERR(acl);
4006
4007         err = rdev_set_mac_acl(rdev, dev, acl);
4008
4009         kfree(acl);
4010
4011         return err;
4012 }
4013
4014 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4015                            u8 *rates, u8 rates_len)
4016 {
4017         u8 i;
4018         u32 mask = 0;
4019
4020         for (i = 0; i < rates_len; i++) {
4021                 int rate = (rates[i] & 0x7f) * 5;
4022                 int ridx;
4023
4024                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4025                         struct ieee80211_rate *srate =
4026                                 &sband->bitrates[ridx];
4027                         if (rate == srate->bitrate) {
4028                                 mask |= 1 << ridx;
4029                                 break;
4030                         }
4031                 }
4032                 if (ridx == sband->n_bitrates)
4033                         return 0; /* rate not found */
4034         }
4035
4036         return mask;
4037 }
4038
4039 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
4040                                u8 *rates, u8 rates_len,
4041                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
4042 {
4043         u8 i;
4044
4045         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
4046
4047         for (i = 0; i < rates_len; i++) {
4048                 int ridx, rbit;
4049
4050                 ridx = rates[i] / 8;
4051                 rbit = BIT(rates[i] % 8);
4052
4053                 /* check validity */
4054                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
4055                         return false;
4056
4057                 /* check availability */
4058                 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
4059                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
4060                         mcs[ridx] |= rbit;
4061                 else
4062                         return false;
4063         }
4064
4065         return true;
4066 }
4067
4068 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
4069 {
4070         u16 mcs_mask = 0;
4071
4072         switch (vht_mcs_map) {
4073         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
4074                 break;
4075         case IEEE80211_VHT_MCS_SUPPORT_0_7:
4076                 mcs_mask = 0x00FF;
4077                 break;
4078         case IEEE80211_VHT_MCS_SUPPORT_0_8:
4079                 mcs_mask = 0x01FF;
4080                 break;
4081         case IEEE80211_VHT_MCS_SUPPORT_0_9:
4082                 mcs_mask = 0x03FF;
4083                 break;
4084         default:
4085                 break;
4086         }
4087
4088         return mcs_mask;
4089 }
4090
4091 static void vht_build_mcs_mask(u16 vht_mcs_map,
4092                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
4093 {
4094         u8 nss;
4095
4096         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
4097                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
4098                 vht_mcs_map >>= 2;
4099         }
4100 }
4101
4102 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
4103                              struct nl80211_txrate_vht *txrate,
4104                              u16 mcs[NL80211_VHT_NSS_MAX])
4105 {
4106         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4107         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
4108         u8 i;
4109
4110         if (!sband->vht_cap.vht_supported)
4111                 return false;
4112
4113         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
4114
4115         /* Build vht_mcs_mask from VHT capabilities */
4116         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
4117
4118         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
4119                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
4120                         mcs[i] = txrate->mcs[i];
4121                 else
4122                         return false;
4123         }
4124
4125         return true;
4126 }
4127
4128 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
4129         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
4130                                     .len = NL80211_MAX_SUPP_RATES },
4131         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
4132                                 .len = NL80211_MAX_SUPP_HT_RATES },
4133         [NL80211_TXRATE_VHT] = {
4134                 .type = NLA_EXACT_LEN_WARN,
4135                 .len = sizeof(struct nl80211_txrate_vht),
4136         },
4137         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
4138 };
4139
4140 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
4141                                          struct cfg80211_bitrate_mask *mask)
4142 {
4143         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
4144         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4145         int rem, i;
4146         struct nlattr *tx_rates;
4147         struct ieee80211_supported_band *sband;
4148         u16 vht_tx_mcs_map;
4149
4150         memset(mask, 0, sizeof(*mask));
4151         /* Default to all rates enabled */
4152         for (i = 0; i < NUM_NL80211_BANDS; i++) {
4153                 sband = rdev->wiphy.bands[i];
4154
4155                 if (!sband)
4156                         continue;
4157
4158                 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
4159                 memcpy(mask->control[i].ht_mcs,
4160                        sband->ht_cap.mcs.rx_mask,
4161                        sizeof(mask->control[i].ht_mcs));
4162
4163                 if (!sband->vht_cap.vht_supported)
4164                         continue;
4165
4166                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4167                 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
4168         }
4169
4170         /* if no rates are given set it back to the defaults */
4171         if (!info->attrs[NL80211_ATTR_TX_RATES])
4172                 goto out;
4173
4174         /* The nested attribute uses enum nl80211_band as the index. This maps
4175          * directly to the enum nl80211_band values used in cfg80211.
4176          */
4177         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
4178         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
4179                 enum nl80211_band band = nla_type(tx_rates);
4180                 int err;
4181
4182                 if (band < 0 || band >= NUM_NL80211_BANDS)
4183                         return -EINVAL;
4184                 sband = rdev->wiphy.bands[band];
4185                 if (sband == NULL)
4186                         return -EINVAL;
4187                 err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX,
4188                                                   tx_rates,
4189                                                   nl80211_txattr_policy,
4190                                                   info->extack);
4191                 if (err)
4192                         return err;
4193                 if (tb[NL80211_TXRATE_LEGACY]) {
4194                         mask->control[band].legacy = rateset_to_mask(
4195                                 sband,
4196                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
4197                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
4198                         if ((mask->control[band].legacy == 0) &&
4199                             nla_len(tb[NL80211_TXRATE_LEGACY]))
4200                                 return -EINVAL;
4201                 }
4202                 if (tb[NL80211_TXRATE_HT]) {
4203                         if (!ht_rateset_to_mask(
4204                                         sband,
4205                                         nla_data(tb[NL80211_TXRATE_HT]),
4206                                         nla_len(tb[NL80211_TXRATE_HT]),
4207                                         mask->control[band].ht_mcs))
4208                                 return -EINVAL;
4209                 }
4210                 if (tb[NL80211_TXRATE_VHT]) {
4211                         if (!vht_set_mcs_mask(
4212                                         sband,
4213                                         nla_data(tb[NL80211_TXRATE_VHT]),
4214                                         mask->control[band].vht_mcs))
4215                                 return -EINVAL;
4216                 }
4217                 if (tb[NL80211_TXRATE_GI]) {
4218                         mask->control[band].gi =
4219                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
4220                         if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
4221                                 return -EINVAL;
4222                 }
4223
4224                 if (mask->control[band].legacy == 0) {
4225                         /* don't allow empty legacy rates if HT or VHT
4226                          * are not even supported.
4227                          */
4228                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
4229                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
4230                                 return -EINVAL;
4231
4232                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
4233                                 if (mask->control[band].ht_mcs[i])
4234                                         goto out;
4235
4236                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
4237                                 if (mask->control[band].vht_mcs[i])
4238                                         goto out;
4239
4240                         /* legacy and mcs rates may not be both empty */
4241                         return -EINVAL;
4242                 }
4243         }
4244
4245 out:
4246         return 0;
4247 }
4248
4249 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
4250                                    enum nl80211_band band,
4251                                    struct cfg80211_bitrate_mask *beacon_rate)
4252 {
4253         u32 count_ht, count_vht, i;
4254         u32 rate = beacon_rate->control[band].legacy;
4255
4256         /* Allow only one rate */
4257         if (hweight32(rate) > 1)
4258                 return -EINVAL;
4259
4260         count_ht = 0;
4261         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
4262                 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
4263                         return -EINVAL;
4264                 } else if (beacon_rate->control[band].ht_mcs[i]) {
4265                         count_ht++;
4266                         if (count_ht > 1)
4267                                 return -EINVAL;
4268                 }
4269                 if (count_ht && rate)
4270                         return -EINVAL;
4271         }
4272
4273         count_vht = 0;
4274         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
4275                 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
4276                         return -EINVAL;
4277                 } else if (beacon_rate->control[band].vht_mcs[i]) {
4278                         count_vht++;
4279                         if (count_vht > 1)
4280                                 return -EINVAL;
4281                 }
4282                 if (count_vht && rate)
4283                         return -EINVAL;
4284         }
4285
4286         if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht))
4287                 return -EINVAL;
4288
4289         if (rate &&
4290             !wiphy_ext_feature_isset(&rdev->wiphy,
4291                                      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
4292                 return -EINVAL;
4293         if (count_ht &&
4294             !wiphy_ext_feature_isset(&rdev->wiphy,
4295                                      NL80211_EXT_FEATURE_BEACON_RATE_HT))
4296                 return -EINVAL;
4297         if (count_vht &&
4298             !wiphy_ext_feature_isset(&rdev->wiphy,
4299                                      NL80211_EXT_FEATURE_BEACON_RATE_VHT))
4300                 return -EINVAL;
4301
4302         return 0;
4303 }
4304
4305 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
4306                                 struct nlattr *attrs[],
4307                                 struct cfg80211_beacon_data *bcn)
4308 {
4309         bool haveinfo = false;
4310         int err;
4311
4312         memset(bcn, 0, sizeof(*bcn));
4313
4314         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
4315                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
4316                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
4317                 if (!bcn->head_len)
4318                         return -EINVAL;
4319                 haveinfo = true;
4320         }
4321
4322         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
4323                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
4324                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
4325                 haveinfo = true;
4326         }
4327
4328         if (!haveinfo)
4329                 return -EINVAL;
4330
4331         if (attrs[NL80211_ATTR_IE]) {
4332                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
4333                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
4334         }
4335
4336         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
4337                 bcn->proberesp_ies =
4338                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4339                 bcn->proberesp_ies_len =
4340                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4341         }
4342
4343         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
4344                 bcn->assocresp_ies =
4345                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4346                 bcn->assocresp_ies_len =
4347                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4348         }
4349
4350         if (attrs[NL80211_ATTR_PROBE_RESP]) {
4351                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
4352                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
4353         }
4354
4355         if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
4356                 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
4357
4358                 err = nla_parse_nested_deprecated(tb,
4359                                                   NL80211_FTM_RESP_ATTR_MAX,
4360                                                   attrs[NL80211_ATTR_FTM_RESPONDER],
4361                                                   NULL, NULL);
4362                 if (err)
4363                         return err;
4364
4365                 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
4366                     wiphy_ext_feature_isset(&rdev->wiphy,
4367                                             NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
4368                         bcn->ftm_responder = 1;
4369                 else
4370                         return -EOPNOTSUPP;
4371
4372                 if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
4373                         bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
4374                         bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
4375                 }
4376
4377                 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
4378                         bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
4379                         bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
4380                 }
4381         } else {
4382                 bcn->ftm_responder = -1;
4383         }
4384
4385         return 0;
4386 }
4387
4388 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
4389                                             const u8 *rates)
4390 {
4391         int i;
4392
4393         if (!rates)
4394                 return;
4395
4396         for (i = 0; i < rates[1]; i++) {
4397                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
4398                         params->ht_required = true;
4399                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
4400                         params->vht_required = true;
4401         }
4402 }
4403
4404 /*
4405  * Since the nl80211 API didn't include, from the beginning, attributes about
4406  * HT/VHT requirements/capabilities, we parse them out of the IEs for the
4407  * benefit of drivers that rebuild IEs in the firmware.
4408  */
4409 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
4410 {
4411         const struct cfg80211_beacon_data *bcn = &params->beacon;
4412         size_t ies_len = bcn->tail_len;
4413         const u8 *ies = bcn->tail;
4414         const u8 *rates;
4415         const u8 *cap;
4416
4417         rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len);
4418         nl80211_check_ap_rate_selectors(params, rates);
4419
4420         rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
4421         nl80211_check_ap_rate_selectors(params, rates);
4422
4423         cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len);
4424         if (cap && cap[1] >= sizeof(*params->ht_cap))
4425                 params->ht_cap = (void *)(cap + 2);
4426         cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
4427         if (cap && cap[1] >= sizeof(*params->vht_cap))
4428                 params->vht_cap = (void *)(cap + 2);
4429         cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
4430         if (cap && cap[1] >= sizeof(*params->he_cap) + 1)
4431                 params->he_cap = (void *)(cap + 3);
4432 }
4433
4434 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
4435                                    struct cfg80211_ap_settings *params)
4436 {
4437         struct wireless_dev *wdev;
4438         bool ret = false;
4439
4440         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
4441                 if (wdev->iftype != NL80211_IFTYPE_AP &&
4442                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
4443                         continue;
4444
4445                 if (!wdev->preset_chandef.chan)
4446                         continue;
4447
4448                 params->chandef = wdev->preset_chandef;
4449                 ret = true;
4450                 break;
4451         }
4452
4453         return ret;
4454 }
4455
4456 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
4457                                     enum nl80211_auth_type auth_type,
4458                                     enum nl80211_commands cmd)
4459 {
4460         if (auth_type > NL80211_AUTHTYPE_MAX)
4461                 return false;
4462
4463         switch (cmd) {
4464         case NL80211_CMD_AUTHENTICATE:
4465                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
4466                     auth_type == NL80211_AUTHTYPE_SAE)
4467                         return false;
4468                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
4469                                              NL80211_EXT_FEATURE_FILS_STA) &&
4470                     (auth_type == NL80211_AUTHTYPE_FILS_SK ||
4471                      auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4472                      auth_type == NL80211_AUTHTYPE_FILS_PK))
4473                         return false;
4474                 return true;
4475         case NL80211_CMD_CONNECT:
4476                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
4477                     !wiphy_ext_feature_isset(&rdev->wiphy,
4478                                              NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
4479                     auth_type == NL80211_AUTHTYPE_SAE)
4480                         return false;
4481
4482                 /* FILS with SK PFS or PK not supported yet */
4483                 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4484                     auth_type == NL80211_AUTHTYPE_FILS_PK)
4485                         return false;
4486                 if (!wiphy_ext_feature_isset(
4487                             &rdev->wiphy,
4488                             NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
4489                     auth_type == NL80211_AUTHTYPE_FILS_SK)
4490                         return false;
4491                 return true;
4492         case NL80211_CMD_START_AP:
4493                 /* SAE not supported yet */
4494                 if (auth_type == NL80211_AUTHTYPE_SAE)
4495                         return false;
4496                 /* FILS not supported yet */
4497                 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
4498                     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4499                     auth_type == NL80211_AUTHTYPE_FILS_PK)
4500                         return false;
4501                 return true;
4502         default:
4503                 return false;
4504         }
4505 }
4506
4507 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
4508 {
4509         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4510         struct net_device *dev = info->user_ptr[1];
4511         struct wireless_dev *wdev = dev->ieee80211_ptr;
4512         struct cfg80211_ap_settings params;
4513         int err;
4514
4515         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4516             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4517                 return -EOPNOTSUPP;
4518
4519         if (!rdev->ops->start_ap)
4520                 return -EOPNOTSUPP;
4521
4522         if (wdev->beacon_interval)
4523                 return -EALREADY;
4524
4525         memset(&params, 0, sizeof(params));
4526
4527         /* these are required for START_AP */
4528         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
4529             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
4530             !info->attrs[NL80211_ATTR_BEACON_HEAD])
4531                 return -EINVAL;
4532
4533         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon);
4534         if (err)
4535                 return err;
4536
4537         params.beacon_interval =
4538                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
4539         params.dtim_period =
4540                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
4541
4542         err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
4543                                            params.beacon_interval);
4544         if (err)
4545                 return err;
4546
4547         /*
4548          * In theory, some of these attributes should be required here
4549          * but since they were not used when the command was originally
4550          * added, keep them optional for old user space programs to let
4551          * them continue to work with drivers that do not need the
4552          * additional information -- drivers must check!
4553          */
4554         if (info->attrs[NL80211_ATTR_SSID]) {
4555                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4556                 params.ssid_len =
4557                         nla_len(info->attrs[NL80211_ATTR_SSID]);
4558                 if (params.ssid_len == 0 ||
4559                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
4560                         return -EINVAL;
4561         }
4562
4563         if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
4564                 params.hidden_ssid = nla_get_u32(
4565                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
4566
4567         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
4568
4569         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4570                 params.auth_type = nla_get_u32(
4571                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
4572                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
4573                                              NL80211_CMD_START_AP))
4574                         return -EINVAL;
4575         } else
4576                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4577
4578         err = nl80211_crypto_settings(rdev, info, &params.crypto,
4579                                       NL80211_MAX_NR_CIPHER_SUITES);
4580         if (err)
4581                 return err;
4582
4583         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
4584                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
4585                         return -EOPNOTSUPP;
4586                 params.inactivity_timeout = nla_get_u16(
4587                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
4588         }
4589
4590         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4591                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4592                         return -EINVAL;
4593                 params.p2p_ctwindow =
4594                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4595                 if (params.p2p_ctwindow != 0 &&
4596                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4597                         return -EINVAL;
4598         }
4599
4600         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4601                 u8 tmp;
4602
4603                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4604                         return -EINVAL;
4605                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4606                 params.p2p_opp_ps = tmp;
4607                 if (params.p2p_opp_ps != 0 &&
4608                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4609                         return -EINVAL;
4610         }
4611
4612         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4613                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
4614                 if (err)
4615                         return err;
4616         } else if (wdev->preset_chandef.chan) {
4617                 params.chandef = wdev->preset_chandef;
4618         } else if (!nl80211_get_ap_channel(rdev, &params))
4619                 return -EINVAL;
4620
4621         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
4622                                            wdev->iftype))
4623                 return -EINVAL;
4624
4625         if (info->attrs[NL80211_ATTR_TX_RATES]) {
4626                 err = nl80211_parse_tx_bitrate_mask(info, &params.beacon_rate);
4627                 if (err)
4628                         return err;
4629
4630                 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
4631                                               &params.beacon_rate);
4632                 if (err)
4633                         return err;
4634         }
4635
4636         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
4637                 params.smps_mode =
4638                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
4639                 switch (params.smps_mode) {
4640                 case NL80211_SMPS_OFF:
4641                         break;
4642                 case NL80211_SMPS_STATIC:
4643                         if (!(rdev->wiphy.features &
4644                               NL80211_FEATURE_STATIC_SMPS))
4645                                 return -EINVAL;
4646                         break;
4647                 case NL80211_SMPS_DYNAMIC:
4648                         if (!(rdev->wiphy.features &
4649                               NL80211_FEATURE_DYNAMIC_SMPS))
4650                                 return -EINVAL;
4651                         break;
4652                 default:
4653                         return -EINVAL;
4654                 }
4655         } else {
4656                 params.smps_mode = NL80211_SMPS_OFF;
4657         }
4658
4659         params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
4660         if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
4661                 return -EOPNOTSUPP;
4662
4663         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
4664                 params.acl = parse_acl_data(&rdev->wiphy, info);
4665                 if (IS_ERR(params.acl))
4666                         return PTR_ERR(params.acl);
4667         }
4668
4669         params.twt_responder =
4670                     nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]);
4671
4672         nl80211_calculate_ap_params(&params);
4673
4674         if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
4675                 params.flags |= AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
4676
4677         wdev_lock(wdev);
4678         err = rdev_start_ap(rdev, dev, &params);
4679         if (!err) {
4680                 wdev->preset_chandef = params.chandef;
4681                 wdev->beacon_interval = params.beacon_interval;
4682                 wdev->chandef = params.chandef;
4683                 wdev->ssid_len = params.ssid_len;
4684                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
4685
4686                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4687                         wdev->conn_owner_nlportid = info->snd_portid;
4688         }
4689         wdev_unlock(wdev);
4690
4691         kfree(params.acl);
4692
4693         return err;
4694 }
4695
4696 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
4697 {
4698         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4699         struct net_device *dev = info->user_ptr[1];
4700         struct wireless_dev *wdev = dev->ieee80211_ptr;
4701         struct cfg80211_beacon_data params;
4702         int err;
4703
4704         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4705             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4706                 return -EOPNOTSUPP;
4707
4708         if (!rdev->ops->change_beacon)
4709                 return -EOPNOTSUPP;
4710
4711         if (!wdev->beacon_interval)
4712                 return -EINVAL;
4713
4714         err = nl80211_parse_beacon(rdev, info->attrs, &params);
4715         if (err)
4716                 return err;
4717
4718         wdev_lock(wdev);
4719         err = rdev_change_beacon(rdev, dev, &params);
4720         wdev_unlock(wdev);
4721
4722         return err;
4723 }
4724
4725 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
4726 {
4727         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4728         struct net_device *dev = info->user_ptr[1];
4729
4730         return cfg80211_stop_ap(rdev, dev, false);
4731 }
4732
4733 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
4734         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
4735         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
4736         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
4737         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
4738         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
4739         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
4740 };
4741
4742 static int parse_station_flags(struct genl_info *info,
4743                                enum nl80211_iftype iftype,
4744                                struct station_parameters *params)
4745 {
4746         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
4747         struct nlattr *nla;
4748         int flag;
4749
4750         /*
4751          * Try parsing the new attribute first so userspace
4752          * can specify both for older kernels.
4753          */
4754         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
4755         if (nla) {
4756                 struct nl80211_sta_flag_update *sta_flags;
4757
4758                 sta_flags = nla_data(nla);
4759                 params->sta_flags_mask = sta_flags->mask;
4760                 params->sta_flags_set = sta_flags->set;
4761                 params->sta_flags_set &= params->sta_flags_mask;
4762                 if ((params->sta_flags_mask |
4763                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
4764                         return -EINVAL;
4765                 return 0;
4766         }
4767
4768         /* if present, parse the old attribute */
4769
4770         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
4771         if (!nla)
4772                 return 0;
4773
4774         if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack))
4775                 return -EINVAL;
4776
4777         /*
4778          * Only allow certain flags for interface types so that
4779          * other attributes are silently ignored. Remember that
4780          * this is backward compatibility code with old userspace
4781          * and shouldn't be hit in other cases anyway.
4782          */
4783         switch (iftype) {
4784         case NL80211_IFTYPE_AP:
4785         case NL80211_IFTYPE_AP_VLAN:
4786         case NL80211_IFTYPE_P2P_GO:
4787                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4788                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4789                                          BIT(NL80211_STA_FLAG_WME) |
4790                                          BIT(NL80211_STA_FLAG_MFP);
4791                 break;
4792         case NL80211_IFTYPE_P2P_CLIENT:
4793         case NL80211_IFTYPE_STATION:
4794                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4795                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
4796                 break;
4797         case NL80211_IFTYPE_MESH_POINT:
4798                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4799                                          BIT(NL80211_STA_FLAG_MFP) |
4800                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
4801                 break;
4802         default:
4803                 return -EINVAL;
4804         }
4805
4806         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
4807                 if (flags[flag]) {
4808                         params->sta_flags_set |= (1<<flag);
4809
4810                         /* no longer support new API additions in old API */
4811                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
4812                                 return -EINVAL;
4813                 }
4814         }
4815
4816         return 0;
4817 }
4818
4819 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
4820 {
4821         struct nlattr *rate;
4822         u32 bitrate;
4823         u16 bitrate_compat;
4824         enum nl80211_rate_info rate_flg;
4825
4826         rate = nla_nest_start_noflag(msg, attr);
4827         if (!rate)
4828                 return false;
4829
4830         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
4831         bitrate = cfg80211_calculate_bitrate(info);
4832         /* report 16-bit bitrate only if we can */
4833         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
4834         if (bitrate > 0 &&
4835             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
4836                 return false;
4837         if (bitrate_compat > 0 &&
4838             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
4839                 return false;
4840
4841         switch (info->bw) {
4842         case RATE_INFO_BW_5:
4843                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
4844                 break;
4845         case RATE_INFO_BW_10:
4846                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
4847                 break;
4848         default:
4849                 WARN_ON(1);
4850                 /* fall through */
4851         case RATE_INFO_BW_20:
4852                 rate_flg = 0;
4853                 break;
4854         case RATE_INFO_BW_40:
4855                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
4856                 break;
4857         case RATE_INFO_BW_80:
4858                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
4859                 break;
4860         case RATE_INFO_BW_160:
4861                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
4862                 break;
4863         case RATE_INFO_BW_HE_RU:
4864                 rate_flg = 0;
4865                 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
4866         }
4867
4868         if (rate_flg && nla_put_flag(msg, rate_flg))
4869                 return false;
4870
4871         if (info->flags & RATE_INFO_FLAGS_MCS) {
4872                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
4873                         return false;
4874                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4875                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4876                         return false;
4877         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
4878                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
4879                         return false;
4880                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
4881                         return false;
4882                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4883                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4884                         return false;
4885         } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
4886                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
4887                         return false;
4888                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
4889                         return false;
4890                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
4891                         return false;
4892                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
4893                         return false;
4894                 if (info->bw == RATE_INFO_BW_HE_RU &&
4895                     nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
4896                                info->he_ru_alloc))
4897                         return false;
4898         }
4899
4900         nla_nest_end(msg, rate);
4901         return true;
4902 }
4903
4904 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
4905                                int id)
4906 {
4907         void *attr;
4908         int i = 0;
4909
4910         if (!mask)
4911                 return true;
4912
4913         attr = nla_nest_start_noflag(msg, id);
4914         if (!attr)
4915                 return false;
4916
4917         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
4918                 if (!(mask & BIT(i)))
4919                         continue;
4920
4921                 if (nla_put_u8(msg, i, signal[i]))
4922                         return false;
4923         }
4924
4925         nla_nest_end(msg, attr);
4926
4927         return true;
4928 }
4929
4930 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
4931                                 u32 seq, int flags,
4932                                 struct cfg80211_registered_device *rdev,
4933                                 struct net_device *dev,
4934                                 const u8 *mac_addr, struct station_info *sinfo)
4935 {
4936         void *hdr;
4937         struct nlattr *sinfoattr, *bss_param;
4938
4939         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
4940         if (!hdr) {
4941                 cfg80211_sinfo_release_content(sinfo);
4942                 return -1;
4943         }
4944
4945         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4946             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
4947             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
4948                 goto nla_put_failure;
4949
4950         sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
4951         if (!sinfoattr)
4952                 goto nla_put_failure;
4953
4954 #define PUT_SINFO(attr, memb, type) do {                                \
4955         BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
4956         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
4957             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
4958                              sinfo->memb))                              \
4959                 goto nla_put_failure;                                   \
4960         } while (0)
4961 #define PUT_SINFO_U64(attr, memb) do {                                  \
4962         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
4963             nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
4964                               sinfo->memb, NL80211_STA_INFO_PAD))       \
4965                 goto nla_put_failure;                                   \
4966         } while (0)
4967
4968         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
4969         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
4970
4971         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
4972                              BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
4973             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
4974                         (u32)sinfo->rx_bytes))
4975                 goto nla_put_failure;
4976
4977         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
4978                              BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
4979             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
4980                         (u32)sinfo->tx_bytes))
4981                 goto nla_put_failure;
4982
4983         PUT_SINFO_U64(RX_BYTES64, rx_bytes);
4984         PUT_SINFO_U64(TX_BYTES64, tx_bytes);
4985         PUT_SINFO(LLID, llid, u16);
4986         PUT_SINFO(PLID, plid, u16);
4987         PUT_SINFO(PLINK_STATE, plink_state, u8);
4988         PUT_SINFO_U64(RX_DURATION, rx_duration);
4989         PUT_SINFO_U64(TX_DURATION, tx_duration);
4990
4991         if (wiphy_ext_feature_isset(&rdev->wiphy,
4992                                     NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
4993                 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
4994
4995         switch (rdev->wiphy.signal_type) {
4996         case CFG80211_SIGNAL_TYPE_MBM:
4997                 PUT_SINFO(SIGNAL, signal, u8);
4998                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
4999                 break;
5000         default:
5001                 break;
5002         }
5003         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
5004                 if (!nl80211_put_signal(msg, sinfo->chains,
5005                                         sinfo->chain_signal,
5006                                         NL80211_STA_INFO_CHAIN_SIGNAL))
5007                         goto nla_put_failure;
5008         }
5009         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
5010                 if (!nl80211_put_signal(msg, sinfo->chains,
5011                                         sinfo->chain_signal_avg,
5012                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
5013                         goto nla_put_failure;
5014         }
5015         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
5016                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
5017                                           NL80211_STA_INFO_TX_BITRATE))
5018                         goto nla_put_failure;
5019         }
5020         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
5021                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
5022                                           NL80211_STA_INFO_RX_BITRATE))
5023                         goto nla_put_failure;
5024         }
5025
5026         PUT_SINFO(RX_PACKETS, rx_packets, u32);
5027         PUT_SINFO(TX_PACKETS, tx_packets, u32);
5028         PUT_SINFO(TX_RETRIES, tx_retries, u32);
5029         PUT_SINFO(TX_FAILED, tx_failed, u32);
5030         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
5031         PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32);
5032         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
5033         PUT_SINFO(LOCAL_PM, local_pm, u32);
5034         PUT_SINFO(PEER_PM, peer_pm, u32);
5035         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
5036         PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8);
5037
5038         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
5039                 bss_param = nla_nest_start_noflag(msg,
5040                                                   NL80211_STA_INFO_BSS_PARAM);
5041                 if (!bss_param)
5042                         goto nla_put_failure;
5043
5044                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
5045                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
5046                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
5047                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
5048                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
5049                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
5050                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
5051                                sinfo->bss_param.dtim_period) ||
5052                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
5053                                 sinfo->bss_param.beacon_interval))
5054                         goto nla_put_failure;
5055
5056                 nla_nest_end(msg, bss_param);
5057         }
5058         if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
5059             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
5060                     sizeof(struct nl80211_sta_flag_update),
5061                     &sinfo->sta_flags))
5062                 goto nla_put_failure;
5063
5064         PUT_SINFO_U64(T_OFFSET, t_offset);
5065         PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
5066         PUT_SINFO_U64(BEACON_RX, rx_beacon);
5067         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
5068         PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
5069         PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
5070         if (wiphy_ext_feature_isset(&rdev->wiphy,
5071                                     NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
5072                 PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
5073                 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
5074         }
5075
5076 #undef PUT_SINFO
5077 #undef PUT_SINFO_U64
5078
5079         if (sinfo->pertid) {
5080                 struct nlattr *tidsattr;
5081                 int tid;
5082
5083                 tidsattr = nla_nest_start_noflag(msg,
5084                                                  NL80211_STA_INFO_TID_STATS);
5085                 if (!tidsattr)
5086                         goto nla_put_failure;
5087
5088                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
5089                         struct cfg80211_tid_stats *tidstats;
5090                         struct nlattr *tidattr;
5091
5092                         tidstats = &sinfo->pertid[tid];
5093
5094                         if (!tidstats->filled)
5095                                 continue;
5096
5097                         tidattr = nla_nest_start_noflag(msg, tid + 1);
5098                         if (!tidattr)
5099                                 goto nla_put_failure;
5100
5101 #define PUT_TIDVAL_U64(attr, memb) do {                                 \
5102         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
5103             nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,          \
5104                               tidstats->memb, NL80211_TID_STATS_PAD))   \
5105                 goto nla_put_failure;                                   \
5106         } while (0)
5107
5108                         PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
5109                         PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
5110                         PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
5111                         PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
5112
5113 #undef PUT_TIDVAL_U64
5114                         if ((tidstats->filled &
5115                              BIT(NL80211_TID_STATS_TXQ_STATS)) &&
5116                             !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
5117                                                    NL80211_TID_STATS_TXQ_STATS))
5118                                 goto nla_put_failure;
5119
5120                         nla_nest_end(msg, tidattr);
5121                 }
5122
5123                 nla_nest_end(msg, tidsattr);
5124         }
5125
5126         nla_nest_end(msg, sinfoattr);
5127
5128         if (sinfo->assoc_req_ies_len &&
5129             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
5130                     sinfo->assoc_req_ies))
5131                 goto nla_put_failure;
5132
5133         cfg80211_sinfo_release_content(sinfo);
5134         genlmsg_end(msg, hdr);
5135         return 0;
5136
5137  nla_put_failure:
5138         cfg80211_sinfo_release_content(sinfo);
5139         genlmsg_cancel(msg, hdr);
5140         return -EMSGSIZE;
5141 }
5142
5143 static int nl80211_dump_station(struct sk_buff *skb,
5144                                 struct netlink_callback *cb)
5145 {
5146         struct station_info sinfo;
5147         struct cfg80211_registered_device *rdev;
5148         struct wireless_dev *wdev;
5149         u8 mac_addr[ETH_ALEN];
5150         int sta_idx = cb->args[2];
5151         int err;
5152
5153         rtnl_lock();
5154         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
5155         if (err)
5156                 goto out_err;
5157
5158         if (!wdev->netdev) {
5159                 err = -EINVAL;
5160                 goto out_err;
5161         }
5162
5163         if (!rdev->ops->dump_station) {
5164                 err = -EOPNOTSUPP;
5165                 goto out_err;
5166         }
5167
5168         while (1) {
5169                 memset(&sinfo, 0, sizeof(sinfo));
5170                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
5171                                         mac_addr, &sinfo);
5172                 if (err == -ENOENT)
5173                         break;
5174                 if (err)
5175                         goto out_err;
5176
5177                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
5178                                 NETLINK_CB(cb->skb).portid,
5179                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5180                                 rdev, wdev->netdev, mac_addr,
5181                                 &sinfo) < 0)
5182                         goto out;
5183
5184                 sta_idx++;
5185         }
5186
5187  out:
5188         cb->args[2] = sta_idx;
5189         err = skb->len;
5190  out_err:
5191         rtnl_unlock();
5192
5193         return err;
5194 }
5195
5196 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
5197 {
5198         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5199         struct net_device *dev = info->user_ptr[1];
5200         struct station_info sinfo;
5201         struct sk_buff *msg;
5202         u8 *mac_addr = NULL;
5203         int err;
5204
5205         memset(&sinfo, 0, sizeof(sinfo));
5206
5207         if (!info->attrs[NL80211_ATTR_MAC])
5208                 return -EINVAL;
5209
5210         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5211
5212         if (!rdev->ops->get_station)
5213                 return -EOPNOTSUPP;
5214
5215         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
5216         if (err)
5217                 return err;
5218
5219         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5220         if (!msg) {
5221                 cfg80211_sinfo_release_content(&sinfo);
5222                 return -ENOMEM;
5223         }
5224
5225         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
5226                                  info->snd_portid, info->snd_seq, 0,
5227                                  rdev, dev, mac_addr, &sinfo) < 0) {
5228                 nlmsg_free(msg);
5229                 return -ENOBUFS;
5230         }
5231
5232         return genlmsg_reply(msg, info);
5233 }
5234
5235 int cfg80211_check_station_change(struct wiphy *wiphy,
5236                                   struct station_parameters *params,
5237                                   enum cfg80211_station_type statype)
5238 {
5239         if (params->listen_interval != -1 &&
5240             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
5241                 return -EINVAL;
5242
5243         if (params->support_p2p_ps != -1 &&
5244             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
5245                 return -EINVAL;
5246
5247         if (params->aid &&
5248             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
5249             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
5250                 return -EINVAL;
5251
5252         /* When you run into this, adjust the code below for the new flag */
5253         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
5254
5255         switch (statype) {
5256         case CFG80211_STA_MESH_PEER_KERNEL:
5257         case CFG80211_STA_MESH_PEER_USER:
5258                 /*
5259                  * No ignoring the TDLS flag here -- the userspace mesh
5260                  * code doesn't have the bug of including TDLS in the
5261                  * mask everywhere.
5262                  */
5263                 if (params->sta_flags_mask &
5264                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5265                                   BIT(NL80211_STA_FLAG_MFP) |
5266                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
5267                         return -EINVAL;
5268                 break;
5269         case CFG80211_STA_TDLS_PEER_SETUP:
5270         case CFG80211_STA_TDLS_PEER_ACTIVE:
5271                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
5272                         return -EINVAL;
5273                 /* ignore since it can't change */
5274                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5275                 break;
5276         default:
5277                 /* disallow mesh-specific things */
5278                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
5279                         return -EINVAL;
5280                 if (params->local_pm)
5281                         return -EINVAL;
5282                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
5283                         return -EINVAL;
5284         }
5285
5286         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
5287             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
5288                 /* TDLS can't be set, ... */
5289                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
5290                         return -EINVAL;
5291                 /*
5292                  * ... but don't bother the driver with it. This works around
5293                  * a hostapd/wpa_supplicant issue -- it always includes the
5294                  * TLDS_PEER flag in the mask even for AP mode.
5295                  */
5296                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5297         }
5298
5299         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
5300             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
5301                 /* reject other things that can't change */
5302                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
5303                         return -EINVAL;
5304                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
5305                         return -EINVAL;
5306                 if (params->supported_rates)
5307                         return -EINVAL;
5308                 if (params->ext_capab || params->ht_capa || params->vht_capa ||
5309                     params->he_capa)
5310                         return -EINVAL;
5311         }
5312
5313         if (statype != CFG80211_STA_AP_CLIENT &&
5314             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
5315                 if (params->vlan)
5316                         return -EINVAL;
5317         }
5318
5319         switch (statype) {
5320         case CFG80211_STA_AP_MLME_CLIENT:
5321                 /* Use this only for authorizing/unauthorizing a station */
5322                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
5323                         return -EOPNOTSUPP;
5324                 break;
5325         case CFG80211_STA_AP_CLIENT:
5326         case CFG80211_STA_AP_CLIENT_UNASSOC:
5327                 /* accept only the listed bits */
5328                 if (params->sta_flags_mask &
5329                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
5330                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5331                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
5332                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
5333                                   BIT(NL80211_STA_FLAG_WME) |
5334                                   BIT(NL80211_STA_FLAG_MFP)))
5335                         return -EINVAL;
5336
5337                 /* but authenticated/associated only if driver handles it */
5338                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5339                     params->sta_flags_mask &
5340                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5341                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
5342                         return -EINVAL;
5343                 break;
5344         case CFG80211_STA_IBSS:
5345         case CFG80211_STA_AP_STA:
5346                 /* reject any changes other than AUTHORIZED */
5347                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
5348                         return -EINVAL;
5349                 break;
5350         case CFG80211_STA_TDLS_PEER_SETUP:
5351                 /* reject any changes other than AUTHORIZED or WME */
5352                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
5353                                                BIT(NL80211_STA_FLAG_WME)))
5354                         return -EINVAL;
5355                 /* force (at least) rates when authorizing */
5356                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
5357                     !params->supported_rates)
5358                         return -EINVAL;
5359                 break;
5360         case CFG80211_STA_TDLS_PEER_ACTIVE:
5361                 /* reject any changes */
5362                 return -EINVAL;
5363         case CFG80211_STA_MESH_PEER_KERNEL:
5364                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
5365                         return -EINVAL;
5366                 break;
5367         case CFG80211_STA_MESH_PEER_USER:
5368                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
5369                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
5370                         return -EINVAL;
5371                 break;
5372         }
5373
5374         /*
5375          * Older kernel versions ignored this attribute entirely, so don't
5376          * reject attempts to update it but mark it as unused instead so the
5377          * driver won't look at the data.
5378          */
5379         if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
5380             statype != CFG80211_STA_TDLS_PEER_SETUP)
5381                 params->opmode_notif_used = false;
5382
5383         return 0;
5384 }
5385 EXPORT_SYMBOL(cfg80211_check_station_change);
5386
5387 /*
5388  * Get vlan interface making sure it is running and on the right wiphy.
5389  */
5390 static struct net_device *get_vlan(struct genl_info *info,
5391                                    struct cfg80211_registered_device *rdev)
5392 {
5393         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
5394         struct net_device *v;
5395         int ret;
5396
5397         if (!vlanattr)
5398                 return NULL;
5399
5400         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
5401         if (!v)
5402                 return ERR_PTR(-ENODEV);
5403
5404         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
5405                 ret = -EINVAL;
5406                 goto error;
5407         }
5408
5409         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5410             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5411             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
5412                 ret = -EINVAL;
5413                 goto error;
5414         }
5415
5416         if (!netif_running(v)) {
5417                 ret = -ENETDOWN;
5418                 goto error;
5419         }
5420
5421         return v;
5422  error:
5423         dev_put(v);
5424         return ERR_PTR(ret);
5425 }
5426
5427 static const struct nla_policy
5428 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
5429         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
5430         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
5431 };
5432
5433 static int nl80211_parse_sta_wme(struct genl_info *info,
5434                                  struct station_parameters *params)
5435 {
5436         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
5437         struct nlattr *nla;
5438         int err;
5439
5440         /* parse WME attributes if present */
5441         if (!info->attrs[NL80211_ATTR_STA_WME])
5442                 return 0;
5443
5444         nla = info->attrs[NL80211_ATTR_STA_WME];
5445         err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla,
5446                                           nl80211_sta_wme_policy,
5447                                           info->extack);
5448         if (err)
5449                 return err;
5450
5451         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
5452                 params->uapsd_queues = nla_get_u8(
5453                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
5454         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
5455                 return -EINVAL;
5456
5457         if (tb[NL80211_STA_WME_MAX_SP])
5458                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
5459
5460         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
5461                 return -EINVAL;
5462
5463         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
5464
5465         return 0;
5466 }
5467
5468 static int nl80211_parse_sta_channel_info(struct genl_info *info,
5469                                       struct station_parameters *params)
5470 {
5471         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
5472                 params->supported_channels =
5473                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
5474                 params->supported_channels_len =
5475                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
5476                 /*
5477                  * Need to include at least one (first channel, number of
5478                  * channels) tuple for each subband, and must have proper
5479                  * tuples for the rest of the data as well.
5480                  */
5481                 if (params->supported_channels_len < 2)
5482                         return -EINVAL;
5483                 if (params->supported_channels_len % 2)
5484                         return -EINVAL;
5485         }
5486
5487         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
5488                 params->supported_oper_classes =
5489                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
5490                 params->supported_oper_classes_len =
5491                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
5492                 /*
5493                  * The value of the Length field of the Supported Operating
5494                  * Classes element is between 2 and 253.
5495                  */
5496                 if (params->supported_oper_classes_len < 2 ||
5497                     params->supported_oper_classes_len > 253)
5498                         return -EINVAL;
5499         }
5500         return 0;
5501 }
5502
5503 static int nl80211_set_station_tdls(struct genl_info *info,
5504                                     struct station_parameters *params)
5505 {
5506         int err;
5507         /* Dummy STA entry gets updated once the peer capabilities are known */
5508         if (info->attrs[NL80211_ATTR_PEER_AID])
5509                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5510         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5511                 params->ht_capa =
5512                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5513         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5514                 params->vht_capa =
5515                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5516         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
5517                 params->he_capa =
5518                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5519                 params->he_capa_len =
5520                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5521
5522                 if (params->he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN)
5523                         return -EINVAL;
5524         }
5525
5526         err = nl80211_parse_sta_channel_info(info, params);
5527         if (err)
5528                 return err;
5529
5530         return nl80211_parse_sta_wme(info, params);
5531 }
5532
5533 static int nl80211_parse_sta_txpower_setting(struct genl_info *info,
5534                                              struct station_parameters *params)
5535 {
5536         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5537         int idx;
5538
5539         if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) {
5540                 if (!rdev->ops->set_tx_power ||
5541                     !wiphy_ext_feature_isset(&rdev->wiphy,
5542                                          NL80211_EXT_FEATURE_STA_TX_PWR))
5543                         return -EOPNOTSUPP;
5544
5545                 idx = NL80211_ATTR_STA_TX_POWER_SETTING;
5546                 params->txpwr.type = nla_get_u8(info->attrs[idx]);
5547
5548                 if (params->txpwr.type == NL80211_TX_POWER_LIMITED) {
5549                         idx = NL80211_ATTR_STA_TX_POWER;
5550
5551                         if (info->attrs[idx])
5552                                 params->txpwr.power =
5553                                         nla_get_s16(info->attrs[idx]);
5554                         else
5555                                 return -EINVAL;
5556                 }
5557                 params->sta_modify_mask |= STATION_PARAM_APPLY_STA_TXPOWER;
5558         }
5559
5560         return 0;
5561 }
5562
5563 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
5564 {
5565         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5566         struct net_device *dev = info->user_ptr[1];
5567         struct station_parameters params;
5568         u8 *mac_addr;
5569         int err;
5570
5571         memset(&params, 0, sizeof(params));
5572
5573         if (!rdev->ops->change_station)
5574                 return -EOPNOTSUPP;
5575
5576         /*
5577          * AID and listen_interval properties can be set only for unassociated
5578          * station. Include these parameters here and will check them in
5579          * cfg80211_check_station_change().
5580          */
5581         if (info->attrs[NL80211_ATTR_STA_AID])
5582                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5583
5584         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5585                 params.listen_interval =
5586                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5587         else
5588                 params.listen_interval = -1;
5589
5590         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
5591                 params.support_p2p_ps =
5592                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5593         else
5594                 params.support_p2p_ps = -1;
5595
5596         if (!info->attrs[NL80211_ATTR_MAC])
5597                 return -EINVAL;
5598
5599         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5600
5601         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
5602                 params.supported_rates =
5603                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5604                 params.supported_rates_len =
5605                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5606         }
5607
5608         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5609                 params.capability =
5610                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5611                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5612         }
5613
5614         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5615                 params.ext_capab =
5616                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5617                 params.ext_capab_len =
5618                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5619         }
5620
5621         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5622                 return -EINVAL;
5623
5624         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
5625                 params.plink_action =
5626                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5627
5628         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
5629                 params.plink_state =
5630                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
5631                 if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
5632                         params.peer_aid = nla_get_u16(
5633                                 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
5634                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
5635         }
5636
5637         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
5638                 params.local_pm = nla_get_u32(
5639                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
5640
5641         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5642                 params.opmode_notif_used = true;
5643                 params.opmode_notif =
5644                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5645         }
5646
5647         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
5648                 params.airtime_weight =
5649                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
5650
5651         if (params.airtime_weight &&
5652             !wiphy_ext_feature_isset(&rdev->wiphy,
5653                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
5654                 return -EOPNOTSUPP;
5655
5656         err = nl80211_parse_sta_txpower_setting(info, &params);
5657         if (err)
5658                 return err;
5659
5660         /* Include parameters for TDLS peer (will check later) */
5661         err = nl80211_set_station_tdls(info, &params);
5662         if (err)
5663                 return err;
5664
5665         params.vlan = get_vlan(info, rdev);
5666         if (IS_ERR(params.vlan))
5667                 return PTR_ERR(params.vlan);
5668
5669         switch (dev->ieee80211_ptr->iftype) {
5670         case NL80211_IFTYPE_AP:
5671         case NL80211_IFTYPE_AP_VLAN:
5672         case NL80211_IFTYPE_P2P_GO:
5673         case NL80211_IFTYPE_P2P_CLIENT:
5674         case NL80211_IFTYPE_STATION:
5675         case NL80211_IFTYPE_ADHOC:
5676         case NL80211_IFTYPE_MESH_POINT:
5677                 break;
5678         default:
5679                 err = -EOPNOTSUPP;
5680                 goto out_put_vlan;
5681         }
5682
5683         /* driver will call cfg80211_check_station_change() */
5684         err = rdev_change_station(rdev, dev, mac_addr, &params);
5685
5686  out_put_vlan:
5687         if (params.vlan)
5688                 dev_put(params.vlan);
5689
5690         return err;
5691 }
5692
5693 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
5694 {
5695         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5696         int err;
5697         struct net_device *dev = info->user_ptr[1];
5698         struct station_parameters params;
5699         u8 *mac_addr = NULL;
5700         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5701                          BIT(NL80211_STA_FLAG_ASSOCIATED);
5702
5703         memset(&params, 0, sizeof(params));
5704
5705         if (!rdev->ops->add_station)
5706                 return -EOPNOTSUPP;
5707
5708         if (!info->attrs[NL80211_ATTR_MAC])
5709                 return -EINVAL;
5710
5711         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5712                 return -EINVAL;
5713
5714         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
5715                 return -EINVAL;
5716
5717         if (!info->attrs[NL80211_ATTR_STA_AID] &&
5718             !info->attrs[NL80211_ATTR_PEER_AID])
5719                 return -EINVAL;
5720
5721         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5722         params.supported_rates =
5723                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5724         params.supported_rates_len =
5725                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5726         params.listen_interval =
5727                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5728
5729         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
5730                 params.support_p2p_ps =
5731                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5732         } else {
5733                 /*
5734                  * if not specified, assume it's supported for P2P GO interface,
5735                  * and is NOT supported for AP interface
5736                  */
5737                 params.support_p2p_ps =
5738                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
5739         }
5740
5741         if (info->attrs[NL80211_ATTR_PEER_AID])
5742                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5743         else
5744                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5745
5746         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5747                 params.capability =
5748                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5749                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5750         }
5751
5752         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5753                 params.ext_capab =
5754                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5755                 params.ext_capab_len =
5756                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5757         }
5758
5759         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5760                 params.ht_capa =
5761                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5762
5763         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5764                 params.vht_capa =
5765                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5766
5767         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
5768                 params.he_capa =
5769                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5770                 params.he_capa_len =
5771                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5772
5773                 /* max len is validated in nla policy */
5774                 if (params.he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN)
5775                         return -EINVAL;
5776         }
5777
5778         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5779                 params.opmode_notif_used = true;
5780                 params.opmode_notif =
5781                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5782         }
5783
5784         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
5785                 params.plink_action =
5786                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5787
5788         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
5789                 params.airtime_weight =
5790                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
5791
5792         if (params.airtime_weight &&
5793             !wiphy_ext_feature_isset(&rdev->wiphy,
5794                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
5795                 return -EOPNOTSUPP;
5796
5797         err = nl80211_parse_sta_txpower_setting(info, &params);
5798         if (err)
5799                 return err;
5800
5801         err = nl80211_parse_sta_channel_info(info, &params);
5802         if (err)
5803                 return err;
5804
5805         err = nl80211_parse_sta_wme(info, &params);
5806         if (err)
5807                 return err;
5808
5809         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5810                 return -EINVAL;
5811
5812         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
5813          * as userspace might just pass through the capabilities from the IEs
5814          * directly, rather than enforcing this restriction and returning an
5815          * error in this case.
5816          */
5817         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
5818                 params.ht_capa = NULL;
5819                 params.vht_capa = NULL;
5820
5821                 /* HE requires WME */
5822                 if (params.he_capa_len)
5823                         return -EINVAL;
5824         }
5825
5826         /* When you run into this, adjust the code below for the new flag */
5827         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
5828
5829         switch (dev->ieee80211_ptr->iftype) {
5830         case NL80211_IFTYPE_AP:
5831         case NL80211_IFTYPE_AP_VLAN:
5832         case NL80211_IFTYPE_P2P_GO:
5833                 /* ignore WME attributes if iface/sta is not capable */
5834                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
5835                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
5836                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5837
5838                 /* TDLS peers cannot be added */
5839                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5840                     info->attrs[NL80211_ATTR_PEER_AID])
5841                         return -EINVAL;
5842                 /* but don't bother the driver with it */
5843                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5844
5845                 /* allow authenticated/associated only if driver handles it */
5846                 if (!(rdev->wiphy.features &
5847                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5848                     params.sta_flags_mask & auth_assoc)
5849                         return -EINVAL;
5850
5851                 /* Older userspace, or userspace wanting to be compatible with
5852                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
5853                  * and assoc flags in the mask, but assumes the station will be
5854                  * added as associated anyway since this was the required driver
5855                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
5856                  * introduced.
5857                  * In order to not bother drivers with this quirk in the API
5858                  * set the flags in both the mask and set for new stations in
5859                  * this case.
5860                  */
5861                 if (!(params.sta_flags_mask & auth_assoc)) {
5862                         params.sta_flags_mask |= auth_assoc;
5863                         params.sta_flags_set |= auth_assoc;
5864                 }
5865
5866                 /* must be last in here for error handling */
5867                 params.vlan = get_vlan(info, rdev);
5868                 if (IS_ERR(params.vlan))
5869                         return PTR_ERR(params.vlan);
5870                 break;
5871         case NL80211_IFTYPE_MESH_POINT:
5872                 /* ignore uAPSD data */
5873                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5874
5875                 /* associated is disallowed */
5876                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
5877                         return -EINVAL;
5878                 /* TDLS peers cannot be added */
5879                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5880                     info->attrs[NL80211_ATTR_PEER_AID])
5881                         return -EINVAL;
5882                 break;
5883         case NL80211_IFTYPE_STATION:
5884         case NL80211_IFTYPE_P2P_CLIENT:
5885                 /* ignore uAPSD data */
5886                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5887
5888                 /* these are disallowed */
5889                 if (params.sta_flags_mask &
5890                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
5891                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
5892                         return -EINVAL;
5893                 /* Only TDLS peers can be added */
5894                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
5895                         return -EINVAL;
5896                 /* Can only add if TDLS ... */
5897                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
5898                         return -EOPNOTSUPP;
5899                 /* ... with external setup is supported */
5900                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
5901                         return -EOPNOTSUPP;
5902                 /*
5903                  * Older wpa_supplicant versions always mark the TDLS peer
5904                  * as authorized, but it shouldn't yet be.
5905                  */
5906                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
5907                 break;
5908         default:
5909                 return -EOPNOTSUPP;
5910         }
5911
5912         /* be aware of params.vlan when changing code here */
5913
5914         err = rdev_add_station(rdev, dev, mac_addr, &params);
5915
5916         if (params.vlan)
5917                 dev_put(params.vlan);
5918         return err;
5919 }
5920
5921 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
5922 {
5923         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5924         struct net_device *dev = info->user_ptr[1];
5925         struct station_del_parameters params;
5926
5927         memset(&params, 0, sizeof(params));
5928
5929         if (info->attrs[NL80211_ATTR_MAC])
5930                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
5931
5932         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5933             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5934             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5935             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5936                 return -EINVAL;
5937
5938         if (!rdev->ops->del_station)
5939                 return -EOPNOTSUPP;
5940
5941         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
5942                 params.subtype =
5943                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
5944                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
5945                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
5946                         return -EINVAL;
5947         } else {
5948                 /* Default to Deauthentication frame */
5949                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
5950         }
5951
5952         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
5953                 params.reason_code =
5954                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5955                 if (params.reason_code == 0)
5956                         return -EINVAL; /* 0 is reserved */
5957         } else {
5958                 /* Default to reason code 2 */
5959                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
5960         }
5961
5962         return rdev_del_station(rdev, dev, &params);
5963 }
5964
5965 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
5966                                 int flags, struct net_device *dev,
5967                                 u8 *dst, u8 *next_hop,
5968                                 struct mpath_info *pinfo)
5969 {
5970         void *hdr;
5971         struct nlattr *pinfoattr;
5972
5973         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
5974         if (!hdr)
5975                 return -1;
5976
5977         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5978             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
5979             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
5980             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
5981                 goto nla_put_failure;
5982
5983         pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO);
5984         if (!pinfoattr)
5985                 goto nla_put_failure;
5986         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
5987             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
5988                         pinfo->frame_qlen))
5989                 goto nla_put_failure;
5990         if (((pinfo->filled & MPATH_INFO_SN) &&
5991              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
5992             ((pinfo->filled & MPATH_INFO_METRIC) &&
5993              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
5994                          pinfo->metric)) ||
5995             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
5996              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
5997                          pinfo->exptime)) ||
5998             ((pinfo->filled & MPATH_INFO_FLAGS) &&
5999              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
6000                         pinfo->flags)) ||
6001             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
6002              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
6003                          pinfo->discovery_timeout)) ||
6004             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
6005              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
6006                         pinfo->discovery_retries)) ||
6007             ((pinfo->filled & MPATH_INFO_HOP_COUNT) &&
6008              nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT,
6009                         pinfo->hop_count)) ||
6010             ((pinfo->filled & MPATH_INFO_PATH_CHANGE) &&
6011              nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE,
6012                          pinfo->path_change_count)))
6013                 goto nla_put_failure;
6014
6015         nla_nest_end(msg, pinfoattr);
6016
6017         genlmsg_end(msg, hdr);
6018         return 0;
6019
6020  nla_put_failure:
6021         genlmsg_cancel(msg, hdr);
6022         return -EMSGSIZE;
6023 }
6024
6025 static int nl80211_dump_mpath(struct sk_buff *skb,
6026                               struct netlink_callback *cb)
6027 {
6028         struct mpath_info pinfo;
6029         struct cfg80211_registered_device *rdev;
6030         struct wireless_dev *wdev;
6031         u8 dst[ETH_ALEN];
6032         u8 next_hop[ETH_ALEN];
6033         int path_idx = cb->args[2];
6034         int err;
6035
6036         rtnl_lock();
6037         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
6038         if (err)
6039                 goto out_err;
6040
6041         if (!rdev->ops->dump_mpath) {
6042                 err = -EOPNOTSUPP;
6043                 goto out_err;
6044         }
6045
6046         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
6047                 err = -EOPNOTSUPP;
6048                 goto out_err;
6049         }
6050
6051         while (1) {
6052                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
6053                                       next_hop, &pinfo);
6054                 if (err == -ENOENT)
6055                         break;
6056                 if (err)
6057                         goto out_err;
6058
6059                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
6060                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
6061                                        wdev->netdev, dst, next_hop,
6062                                        &pinfo) < 0)
6063                         goto out;
6064
6065                 path_idx++;
6066         }
6067
6068  out:
6069         cb->args[2] = path_idx;
6070         err = skb->len;
6071  out_err:
6072         rtnl_unlock();
6073         return err;
6074 }
6075
6076 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
6077 {
6078         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6079         int err;
6080         struct net_device *dev = info->user_ptr[1];
6081         struct mpath_info pinfo;
6082         struct sk_buff *msg;
6083         u8 *dst = NULL;
6084         u8 next_hop[ETH_ALEN];
6085
6086         memset(&pinfo, 0, sizeof(pinfo));
6087
6088         if (!info->attrs[NL80211_ATTR_MAC])
6089                 return -EINVAL;
6090
6091         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6092
6093         if (!rdev->ops->get_mpath)
6094                 return -EOPNOTSUPP;
6095
6096         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6097                 return -EOPNOTSUPP;
6098
6099         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
6100         if (err)
6101                 return err;
6102
6103         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6104         if (!msg)
6105                 return -ENOMEM;
6106
6107         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
6108                                  dev, dst, next_hop, &pinfo) < 0) {
6109                 nlmsg_free(msg);
6110                 return -ENOBUFS;
6111         }
6112
6113         return genlmsg_reply(msg, info);
6114 }
6115
6116 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
6117 {
6118         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6119         struct net_device *dev = info->user_ptr[1];
6120         u8 *dst = NULL;
6121         u8 *next_hop = NULL;
6122
6123         if (!info->attrs[NL80211_ATTR_MAC])
6124                 return -EINVAL;
6125
6126         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
6127                 return -EINVAL;
6128
6129         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6130         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
6131
6132         if (!rdev->ops->change_mpath)
6133                 return -EOPNOTSUPP;
6134
6135         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6136                 return -EOPNOTSUPP;
6137
6138         return rdev_change_mpath(rdev, dev, dst, next_hop);
6139 }
6140
6141 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
6142 {
6143         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6144         struct net_device *dev = info->user_ptr[1];
6145         u8 *dst = NULL;
6146         u8 *next_hop = NULL;
6147
6148         if (!info->attrs[NL80211_ATTR_MAC])
6149                 return -EINVAL;
6150
6151         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
6152                 return -EINVAL;
6153
6154         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6155         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
6156
6157         if (!rdev->ops->add_mpath)
6158                 return -EOPNOTSUPP;
6159
6160         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6161                 return -EOPNOTSUPP;
6162
6163         return rdev_add_mpath(rdev, dev, dst, next_hop);
6164 }
6165
6166 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
6167 {
6168         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6169         struct net_device *dev = info->user_ptr[1];
6170         u8 *dst = NULL;
6171
6172         if (info->attrs[NL80211_ATTR_MAC])
6173                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6174
6175         if (!rdev->ops->del_mpath)
6176                 return -EOPNOTSUPP;
6177
6178         return rdev_del_mpath(rdev, dev, dst);
6179 }
6180
6181 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
6182 {
6183         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6184         int err;
6185         struct net_device *dev = info->user_ptr[1];
6186         struct mpath_info pinfo;
6187         struct sk_buff *msg;
6188         u8 *dst = NULL;
6189         u8 mpp[ETH_ALEN];
6190
6191         memset(&pinfo, 0, sizeof(pinfo));
6192
6193         if (!info->attrs[NL80211_ATTR_MAC])
6194                 return -EINVAL;
6195
6196         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6197
6198         if (!rdev->ops->get_mpp)
6199                 return -EOPNOTSUPP;
6200
6201         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6202                 return -EOPNOTSUPP;
6203
6204         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
6205         if (err)
6206                 return err;
6207
6208         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6209         if (!msg)
6210                 return -ENOMEM;
6211
6212         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
6213                                dev, dst, mpp, &pinfo) < 0) {
6214                 nlmsg_free(msg);
6215                 return -ENOBUFS;
6216         }
6217
6218         return genlmsg_reply(msg, info);
6219 }
6220
6221 static int nl80211_dump_mpp(struct sk_buff *skb,
6222                             struct netlink_callback *cb)
6223 {
6224         struct mpath_info pinfo;
6225         struct cfg80211_registered_device *rdev;
6226         struct wireless_dev *wdev;
6227         u8 dst[ETH_ALEN];
6228         u8 mpp[ETH_ALEN];
6229         int path_idx = cb->args[2];
6230         int err;
6231
6232         rtnl_lock();
6233         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
6234         if (err)
6235                 goto out_err;
6236
6237         if (!rdev->ops->dump_mpp) {
6238                 err = -EOPNOTSUPP;
6239                 goto out_err;
6240         }
6241
6242         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
6243                 err = -EOPNOTSUPP;
6244                 goto out_err;
6245         }
6246
6247         while (1) {
6248                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
6249                                     mpp, &pinfo);
6250                 if (err == -ENOENT)
6251                         break;
6252                 if (err)
6253                         goto out_err;
6254
6255                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
6256                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
6257                                        wdev->netdev, dst, mpp,
6258                                        &pinfo) < 0)
6259                         goto out;
6260
6261                 path_idx++;
6262         }
6263
6264  out:
6265         cb->args[2] = path_idx;
6266         err = skb->len;
6267  out_err:
6268         rtnl_unlock();
6269         return err;
6270 }
6271
6272 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
6273 {
6274         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6275         struct net_device *dev = info->user_ptr[1];
6276         struct wireless_dev *wdev = dev->ieee80211_ptr;
6277         struct bss_parameters params;
6278         int err;
6279
6280         memset(&params, 0, sizeof(params));
6281         /* default to not changing parameters */
6282         params.use_cts_prot = -1;
6283         params.use_short_preamble = -1;
6284         params.use_short_slot_time = -1;
6285         params.ap_isolate = -1;
6286         params.ht_opmode = -1;
6287         params.p2p_ctwindow = -1;
6288         params.p2p_opp_ps = -1;
6289
6290         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
6291                 params.use_cts_prot =
6292                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
6293         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
6294                 params.use_short_preamble =
6295                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
6296         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
6297                 params.use_short_slot_time =
6298                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
6299         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6300                 params.basic_rates =
6301                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6302                 params.basic_rates_len =
6303                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6304         }
6305         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
6306                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
6307         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
6308                 params.ht_opmode =
6309                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
6310
6311         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
6312                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6313                         return -EINVAL;
6314                 params.p2p_ctwindow =
6315                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
6316                 if (params.p2p_ctwindow != 0 &&
6317                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
6318                         return -EINVAL;
6319         }
6320
6321         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
6322                 u8 tmp;
6323
6324                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6325                         return -EINVAL;
6326                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
6327                 params.p2p_opp_ps = tmp;
6328                 if (params.p2p_opp_ps &&
6329                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
6330                         return -EINVAL;
6331         }
6332
6333         if (!rdev->ops->change_bss)
6334                 return -EOPNOTSUPP;
6335
6336         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6337             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6338                 return -EOPNOTSUPP;
6339
6340         wdev_lock(wdev);
6341         err = rdev_change_bss(rdev, dev, &params);
6342         wdev_unlock(wdev);
6343
6344         return err;
6345 }
6346
6347 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
6348 {
6349         char *data = NULL;
6350         bool is_indoor;
6351         enum nl80211_user_reg_hint_type user_reg_hint_type;
6352         u32 owner_nlportid;
6353
6354         /*
6355          * You should only get this when cfg80211 hasn't yet initialized
6356          * completely when built-in to the kernel right between the time
6357          * window between nl80211_init() and regulatory_init(), if that is
6358          * even possible.
6359          */
6360         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
6361                 return -EINPROGRESS;
6362
6363         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
6364                 user_reg_hint_type =
6365                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
6366         else
6367                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
6368
6369         switch (user_reg_hint_type) {
6370         case NL80211_USER_REG_HINT_USER:
6371         case NL80211_USER_REG_HINT_CELL_BASE:
6372                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6373                         return -EINVAL;
6374
6375                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6376                 return regulatory_hint_user(data, user_reg_hint_type);
6377         case NL80211_USER_REG_HINT_INDOOR:
6378                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
6379                         owner_nlportid = info->snd_portid;
6380                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
6381                 } else {
6382                         owner_nlportid = 0;
6383                         is_indoor = true;
6384                 }
6385
6386                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
6387         default:
6388                 return -EINVAL;
6389         }
6390 }
6391
6392 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
6393 {
6394         return reg_reload_regdb();
6395 }
6396
6397 static int nl80211_get_mesh_config(struct sk_buff *skb,
6398                                    struct genl_info *info)
6399 {
6400         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6401         struct net_device *dev = info->user_ptr[1];
6402         struct wireless_dev *wdev = dev->ieee80211_ptr;
6403         struct mesh_config cur_params;
6404         int err = 0;
6405         void *hdr;
6406         struct nlattr *pinfoattr;
6407         struct sk_buff *msg;
6408
6409         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6410                 return -EOPNOTSUPP;
6411
6412         if (!rdev->ops->get_mesh_config)
6413                 return -EOPNOTSUPP;
6414
6415         wdev_lock(wdev);
6416         /* If not connected, get default parameters */
6417         if (!wdev->mesh_id_len)
6418                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
6419         else
6420                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
6421         wdev_unlock(wdev);
6422
6423         if (err)
6424                 return err;
6425
6426         /* Draw up a netlink message to send back */
6427         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6428         if (!msg)
6429                 return -ENOMEM;
6430         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6431                              NL80211_CMD_GET_MESH_CONFIG);
6432         if (!hdr)
6433                 goto out;
6434         pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG);
6435         if (!pinfoattr)
6436                 goto nla_put_failure;
6437         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6438             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
6439                         cur_params.dot11MeshRetryTimeout) ||
6440             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
6441                         cur_params.dot11MeshConfirmTimeout) ||
6442             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
6443                         cur_params.dot11MeshHoldingTimeout) ||
6444             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
6445                         cur_params.dot11MeshMaxPeerLinks) ||
6446             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
6447                        cur_params.dot11MeshMaxRetries) ||
6448             nla_put_u8(msg, NL80211_MESHCONF_TTL,
6449                        cur_params.dot11MeshTTL) ||
6450             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
6451                        cur_params.element_ttl) ||
6452             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
6453                        cur_params.auto_open_plinks) ||
6454             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
6455                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
6456             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
6457                        cur_params.dot11MeshHWMPmaxPREQretries) ||
6458             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
6459                         cur_params.path_refresh_time) ||
6460             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
6461                         cur_params.min_discovery_timeout) ||
6462             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
6463                         cur_params.dot11MeshHWMPactivePathTimeout) ||
6464             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
6465                         cur_params.dot11MeshHWMPpreqMinInterval) ||
6466             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
6467                         cur_params.dot11MeshHWMPperrMinInterval) ||
6468             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
6469                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
6470             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
6471                        cur_params.dot11MeshHWMPRootMode) ||
6472             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
6473                         cur_params.dot11MeshHWMPRannInterval) ||
6474             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
6475                        cur_params.dot11MeshGateAnnouncementProtocol) ||
6476             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
6477                        cur_params.dot11MeshForwarding) ||
6478             nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
6479                         cur_params.rssi_threshold) ||
6480             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
6481                         cur_params.ht_opmode) ||
6482             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6483                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
6484             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6485                         cur_params.dot11MeshHWMProotInterval) ||
6486             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6487                         cur_params.dot11MeshHWMPconfirmationInterval) ||
6488             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
6489                         cur_params.power_mode) ||
6490             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
6491                         cur_params.dot11MeshAwakeWindowDuration) ||
6492             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
6493                         cur_params.plink_timeout) ||
6494             nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE,
6495                        cur_params.dot11MeshConnectedToMeshGate))
6496                 goto nla_put_failure;
6497         nla_nest_end(msg, pinfoattr);
6498         genlmsg_end(msg, hdr);
6499         return genlmsg_reply(msg, info);
6500
6501  nla_put_failure:
6502  out:
6503         nlmsg_free(msg);
6504         return -ENOBUFS;
6505 }
6506
6507 static const struct nla_policy
6508 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
6509         [NL80211_MESHCONF_RETRY_TIMEOUT] =
6510                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
6511         [NL80211_MESHCONF_CONFIRM_TIMEOUT] =
6512                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
6513         [NL80211_MESHCONF_HOLDING_TIMEOUT] =
6514                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
6515         [NL80211_MESHCONF_MAX_PEER_LINKS] =
6516                 NLA_POLICY_RANGE(NLA_U16, 0, 255),
6517         [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
6518         [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
6519         [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
6520         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
6521         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
6522                 NLA_POLICY_RANGE(NLA_U32, 1, 255),
6523         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
6524         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
6525         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
6526         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
6527         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
6528                 NLA_POLICY_MIN(NLA_U16, 1),
6529         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
6530                 NLA_POLICY_MIN(NLA_U16, 1),
6531         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
6532                 NLA_POLICY_MIN(NLA_U16, 1),
6533         [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
6534         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
6535                 NLA_POLICY_MIN(NLA_U16, 1),
6536         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
6537         [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
6538         [NL80211_MESHCONF_RSSI_THRESHOLD] =
6539                 NLA_POLICY_RANGE(NLA_S32, -255, 0),
6540         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
6541         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
6542         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
6543                 NLA_POLICY_MIN(NLA_U16, 1),
6544         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
6545                 NLA_POLICY_MIN(NLA_U16, 1),
6546         [NL80211_MESHCONF_POWER_MODE] =
6547                 NLA_POLICY_RANGE(NLA_U32,
6548                                  NL80211_MESH_POWER_ACTIVE,
6549                                  NL80211_MESH_POWER_MAX),
6550         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
6551         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
6552         [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
6553 };
6554
6555 static const struct nla_policy
6556         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
6557         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
6558         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
6559         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
6560         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
6561         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
6562         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
6563         [NL80211_MESH_SETUP_IE] =
6564                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
6565                                        IEEE80211_MAX_DATA_LEN),
6566         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
6567 };
6568
6569 static int nl80211_parse_mesh_config(struct genl_info *info,
6570                                      struct mesh_config *cfg,
6571                                      u32 *mask_out)
6572 {
6573         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
6574         u32 mask = 0;
6575         u16 ht_opmode;
6576
6577 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn)       \
6578 do {                                                                    \
6579         if (tb[attr]) {                                                 \
6580                 cfg->param = fn(tb[attr]);                              \
6581                 mask |= BIT((attr) - 1);                                \
6582         }                                                               \
6583 } while (0)
6584
6585         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
6586                 return -EINVAL;
6587         if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack))
6588                 return -EINVAL;
6589
6590         /* This makes sure that there aren't more than 32 mesh config
6591          * parameters (otherwise our bitfield scheme would not work.) */
6592         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
6593
6594         /* Fill in the params struct */
6595         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
6596                                   NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
6597         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
6598                                   NL80211_MESHCONF_CONFIRM_TIMEOUT,
6599                                   nla_get_u16);
6600         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
6601                                   NL80211_MESHCONF_HOLDING_TIMEOUT,
6602                                   nla_get_u16);
6603         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
6604                                   NL80211_MESHCONF_MAX_PEER_LINKS,
6605                                   nla_get_u16);
6606         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
6607                                   NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
6608         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
6609                                   NL80211_MESHCONF_TTL, nla_get_u8);
6610         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
6611                                   NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
6612         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
6613                                   NL80211_MESHCONF_AUTO_OPEN_PLINKS,
6614                                   nla_get_u8);
6615         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
6616                                   mask,
6617                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
6618                                   nla_get_u32);
6619         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
6620                                   NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
6621                                   nla_get_u8);
6622         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
6623                                   NL80211_MESHCONF_PATH_REFRESH_TIME,
6624                                   nla_get_u32);
6625         if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
6626             (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
6627                 return -EINVAL;
6628         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
6629                                   NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
6630                                   nla_get_u16);
6631         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
6632                                   mask,
6633                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
6634                                   nla_get_u32);
6635         if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
6636             (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
6637              cfg->dot11MeshHWMPactivePathTimeout > 65535))
6638                 return -EINVAL;
6639         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
6640                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
6641                                   nla_get_u16);
6642         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
6643                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
6644                                   nla_get_u16);
6645         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6646                                   dot11MeshHWMPnetDiameterTraversalTime, mask,
6647                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
6648                                   nla_get_u16);
6649         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
6650                                   NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
6651         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
6652                                   NL80211_MESHCONF_HWMP_RANN_INTERVAL,
6653                                   nla_get_u16);
6654         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
6655                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
6656                                   nla_get_u8);
6657         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
6658                                   NL80211_MESHCONF_FORWARDING, nla_get_u8);
6659         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
6660                                   NL80211_MESHCONF_RSSI_THRESHOLD,
6661                                   nla_get_s32);
6662         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask,
6663                                   NL80211_MESHCONF_CONNECTED_TO_GATE,
6664                                   nla_get_u8);
6665         /*
6666          * Check HT operation mode based on
6667          * IEEE 802.11-2016 9.4.2.57 HT Operation element.
6668          */
6669         if (tb[NL80211_MESHCONF_HT_OPMODE]) {
6670                 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
6671
6672                 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
6673                                   IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
6674                                   IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
6675                         return -EINVAL;
6676
6677                 /* NON_HT_STA bit is reserved, but some programs set it */
6678                 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
6679
6680                 cfg->ht_opmode = ht_opmode;
6681                 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
6682         }
6683         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6684                                   dot11MeshHWMPactivePathToRootTimeout, mask,
6685                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6686                                   nla_get_u32);
6687         if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
6688             (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
6689              cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
6690                 return -EINVAL;
6691         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
6692                                   NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6693                                   nla_get_u16);
6694         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
6695                                   mask,
6696                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6697                                   nla_get_u16);
6698         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
6699                                   NL80211_MESHCONF_POWER_MODE, nla_get_u32);
6700         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
6701                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
6702         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
6703                                   NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
6704         if (mask_out)
6705                 *mask_out = mask;
6706
6707         return 0;
6708
6709 #undef FILL_IN_MESH_PARAM_IF_SET
6710 }
6711
6712 static int nl80211_parse_mesh_setup(struct genl_info *info,
6713                                      struct mesh_setup *setup)
6714 {
6715         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6716         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
6717
6718         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
6719                 return -EINVAL;
6720         if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack))
6721                 return -EINVAL;
6722
6723         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
6724                 setup->sync_method =
6725                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
6726                  IEEE80211_SYNC_METHOD_VENDOR :
6727                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
6728
6729         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
6730                 setup->path_sel_proto =
6731                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
6732                  IEEE80211_PATH_PROTOCOL_VENDOR :
6733                  IEEE80211_PATH_PROTOCOL_HWMP;
6734
6735         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
6736                 setup->path_metric =
6737                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
6738                  IEEE80211_PATH_METRIC_VENDOR :
6739                  IEEE80211_PATH_METRIC_AIRTIME;
6740
6741         if (tb[NL80211_MESH_SETUP_IE]) {
6742                 struct nlattr *ieattr =
6743                         tb[NL80211_MESH_SETUP_IE];
6744                 setup->ie = nla_data(ieattr);
6745                 setup->ie_len = nla_len(ieattr);
6746         }
6747         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
6748             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
6749                 return -EINVAL;
6750         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
6751         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
6752         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
6753         if (setup->is_secure)
6754                 setup->user_mpm = true;
6755
6756         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
6757                 if (!setup->user_mpm)
6758                         return -EINVAL;
6759                 setup->auth_id =
6760                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
6761         }
6762
6763         return 0;
6764 }
6765
6766 static int nl80211_update_mesh_config(struct sk_buff *skb,
6767                                       struct genl_info *info)
6768 {
6769         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6770         struct net_device *dev = info->user_ptr[1];
6771         struct wireless_dev *wdev = dev->ieee80211_ptr;
6772         struct mesh_config cfg;
6773         u32 mask;
6774         int err;
6775
6776         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6777                 return -EOPNOTSUPP;
6778
6779         if (!rdev->ops->update_mesh_config)
6780                 return -EOPNOTSUPP;
6781
6782         err = nl80211_parse_mesh_config(info, &cfg, &mask);
6783         if (err)
6784                 return err;
6785
6786         wdev_lock(wdev);
6787         if (!wdev->mesh_id_len)
6788                 err = -ENOLINK;
6789
6790         if (!err)
6791                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
6792
6793         wdev_unlock(wdev);
6794
6795         return err;
6796 }
6797
6798 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
6799                               struct sk_buff *msg)
6800 {
6801         struct nlattr *nl_reg_rules;
6802         unsigned int i;
6803
6804         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
6805             (regdom->dfs_region &&
6806              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
6807                 goto nla_put_failure;
6808
6809         nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES);
6810         if (!nl_reg_rules)
6811                 goto nla_put_failure;
6812
6813         for (i = 0; i < regdom->n_reg_rules; i++) {
6814                 struct nlattr *nl_reg_rule;
6815                 const struct ieee80211_reg_rule *reg_rule;
6816                 const struct ieee80211_freq_range *freq_range;
6817                 const struct ieee80211_power_rule *power_rule;
6818                 unsigned int max_bandwidth_khz;
6819
6820                 reg_rule = &regdom->reg_rules[i];
6821                 freq_range = &reg_rule->freq_range;
6822                 power_rule = &reg_rule->power_rule;
6823
6824                 nl_reg_rule = nla_nest_start_noflag(msg, i);
6825                 if (!nl_reg_rule)
6826                         goto nla_put_failure;
6827
6828                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
6829                 if (!max_bandwidth_khz)
6830                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
6831                                                                   reg_rule);
6832
6833                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
6834                                 reg_rule->flags) ||
6835                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
6836                                 freq_range->start_freq_khz) ||
6837                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
6838                                 freq_range->end_freq_khz) ||
6839                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
6840                                 max_bandwidth_khz) ||
6841                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
6842                                 power_rule->max_antenna_gain) ||
6843                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
6844                                 power_rule->max_eirp) ||
6845                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
6846                                 reg_rule->dfs_cac_ms))
6847                         goto nla_put_failure;
6848
6849                 nla_nest_end(msg, nl_reg_rule);
6850         }
6851
6852         nla_nest_end(msg, nl_reg_rules);
6853         return 0;
6854
6855 nla_put_failure:
6856         return -EMSGSIZE;
6857 }
6858
6859 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
6860 {
6861         const struct ieee80211_regdomain *regdom = NULL;
6862         struct cfg80211_registered_device *rdev;
6863         struct wiphy *wiphy = NULL;
6864         struct sk_buff *msg;
6865         void *hdr;
6866
6867         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6868         if (!msg)
6869                 return -ENOBUFS;
6870
6871         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6872                              NL80211_CMD_GET_REG);
6873         if (!hdr)
6874                 goto put_failure;
6875
6876         if (info->attrs[NL80211_ATTR_WIPHY]) {
6877                 bool self_managed;
6878
6879                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
6880                 if (IS_ERR(rdev)) {
6881                         nlmsg_free(msg);
6882                         return PTR_ERR(rdev);
6883                 }
6884
6885                 wiphy = &rdev->wiphy;
6886                 self_managed = wiphy->regulatory_flags &
6887                                REGULATORY_WIPHY_SELF_MANAGED;
6888                 regdom = get_wiphy_regdom(wiphy);
6889
6890                 /* a self-managed-reg device must have a private regdom */
6891                 if (WARN_ON(!regdom && self_managed)) {
6892                         nlmsg_free(msg);
6893                         return -EINVAL;
6894                 }
6895
6896                 if (regdom &&
6897                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6898                         goto nla_put_failure;
6899         }
6900
6901         if (!wiphy && reg_last_request_cell_base() &&
6902             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6903                         NL80211_USER_REG_HINT_CELL_BASE))
6904                 goto nla_put_failure;
6905
6906         rcu_read_lock();
6907
6908         if (!regdom)
6909                 regdom = rcu_dereference(cfg80211_regdomain);
6910
6911         if (nl80211_put_regdom(regdom, msg))
6912                 goto nla_put_failure_rcu;
6913
6914         rcu_read_unlock();
6915
6916         genlmsg_end(msg, hdr);
6917         return genlmsg_reply(msg, info);
6918
6919 nla_put_failure_rcu:
6920         rcu_read_unlock();
6921 nla_put_failure:
6922 put_failure:
6923         nlmsg_free(msg);
6924         return -EMSGSIZE;
6925 }
6926
6927 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
6928                                u32 seq, int flags, struct wiphy *wiphy,
6929                                const struct ieee80211_regdomain *regdom)
6930 {
6931         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6932                                    NL80211_CMD_GET_REG);
6933
6934         if (!hdr)
6935                 return -1;
6936
6937         genl_dump_check_consistent(cb, hdr);
6938
6939         if (nl80211_put_regdom(regdom, msg))
6940                 goto nla_put_failure;
6941
6942         if (!wiphy && reg_last_request_cell_base() &&
6943             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6944                         NL80211_USER_REG_HINT_CELL_BASE))
6945                 goto nla_put_failure;
6946
6947         if (wiphy &&
6948             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6949                 goto nla_put_failure;
6950
6951         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
6952             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
6953                 goto nla_put_failure;
6954
6955         genlmsg_end(msg, hdr);
6956         return 0;
6957
6958 nla_put_failure:
6959         genlmsg_cancel(msg, hdr);
6960         return -EMSGSIZE;
6961 }
6962
6963 static int nl80211_get_reg_dump(struct sk_buff *skb,
6964                                 struct netlink_callback *cb)
6965 {
6966         const struct ieee80211_regdomain *regdom = NULL;
6967         struct cfg80211_registered_device *rdev;
6968         int err, reg_idx, start = cb->args[2];
6969
6970         rtnl_lock();
6971
6972         if (cfg80211_regdomain && start == 0) {
6973                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6974                                           NLM_F_MULTI, NULL,
6975                                           rtnl_dereference(cfg80211_regdomain));
6976                 if (err < 0)
6977                         goto out_err;
6978         }
6979
6980         /* the global regdom is idx 0 */
6981         reg_idx = 1;
6982         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
6983                 regdom = get_wiphy_regdom(&rdev->wiphy);
6984                 if (!regdom)
6985                         continue;
6986
6987                 if (++reg_idx <= start)
6988                         continue;
6989
6990                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6991                                           NLM_F_MULTI, &rdev->wiphy, regdom);
6992                 if (err < 0) {
6993                         reg_idx--;
6994                         break;
6995                 }
6996         }
6997
6998         cb->args[2] = reg_idx;
6999         err = skb->len;
7000 out_err:
7001         rtnl_unlock();
7002         return err;
7003 }
7004
7005 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
7006 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
7007         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
7008         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
7009         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
7010         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
7011         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
7012         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
7013         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
7014 };
7015
7016 static int parse_reg_rule(struct nlattr *tb[],
7017         struct ieee80211_reg_rule *reg_rule)
7018 {
7019         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
7020         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
7021
7022         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
7023                 return -EINVAL;
7024         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
7025                 return -EINVAL;
7026         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
7027                 return -EINVAL;
7028         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
7029                 return -EINVAL;
7030         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
7031                 return -EINVAL;
7032
7033         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
7034
7035         freq_range->start_freq_khz =
7036                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
7037         freq_range->end_freq_khz =
7038                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
7039         freq_range->max_bandwidth_khz =
7040                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
7041
7042         power_rule->max_eirp =
7043                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
7044
7045         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
7046                 power_rule->max_antenna_gain =
7047                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
7048
7049         if (tb[NL80211_ATTR_DFS_CAC_TIME])
7050                 reg_rule->dfs_cac_ms =
7051                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
7052
7053         return 0;
7054 }
7055
7056 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
7057 {
7058         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
7059         struct nlattr *nl_reg_rule;
7060         char *alpha2;
7061         int rem_reg_rules, r;
7062         u32 num_rules = 0, rule_idx = 0;
7063         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
7064         struct ieee80211_regdomain *rd;
7065
7066         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
7067                 return -EINVAL;
7068
7069         if (!info->attrs[NL80211_ATTR_REG_RULES])
7070                 return -EINVAL;
7071
7072         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
7073
7074         if (info->attrs[NL80211_ATTR_DFS_REGION])
7075                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
7076
7077         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
7078                             rem_reg_rules) {
7079                 num_rules++;
7080                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
7081                         return -EINVAL;
7082         }
7083
7084         if (!reg_is_valid_request(alpha2))
7085                 return -EINVAL;
7086
7087         rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL);
7088         if (!rd)
7089                 return -ENOMEM;
7090
7091         rd->n_reg_rules = num_rules;
7092         rd->alpha2[0] = alpha2[0];
7093         rd->alpha2[1] = alpha2[1];
7094
7095         /*
7096          * Disable DFS master mode if the DFS region was
7097          * not supported or known on this kernel.
7098          */
7099         if (reg_supported_dfs_region(dfs_region))
7100                 rd->dfs_region = dfs_region;
7101
7102         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
7103                             rem_reg_rules) {
7104                 r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX,
7105                                                 nl_reg_rule, reg_rule_policy,
7106                                                 info->extack);
7107                 if (r)
7108                         goto bad_reg;
7109                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
7110                 if (r)
7111                         goto bad_reg;
7112
7113                 rule_idx++;
7114
7115                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
7116                         r = -EINVAL;
7117                         goto bad_reg;
7118                 }
7119         }
7120
7121         /* set_regdom takes ownership of rd */
7122         return set_regdom(rd, REGD_SOURCE_CRDA);
7123  bad_reg:
7124         kfree(rd);
7125         return r;
7126 }
7127 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
7128
7129 static int validate_scan_freqs(struct nlattr *freqs)
7130 {
7131         struct nlattr *attr1, *attr2;
7132         int n_channels = 0, tmp1, tmp2;
7133
7134         nla_for_each_nested(attr1, freqs, tmp1)
7135                 if (nla_len(attr1) != sizeof(u32))
7136                         return 0;
7137
7138         nla_for_each_nested(attr1, freqs, tmp1) {
7139                 n_channels++;
7140                 /*
7141                  * Some hardware has a limited channel list for
7142                  * scanning, and it is pretty much nonsensical
7143                  * to scan for a channel twice, so disallow that
7144                  * and don't require drivers to check that the
7145                  * channel list they get isn't longer than what
7146                  * they can scan, as long as they can scan all
7147                  * the channels they registered at once.
7148                  */
7149                 nla_for_each_nested(attr2, freqs, tmp2)
7150                         if (attr1 != attr2 &&
7151                             nla_get_u32(attr1) == nla_get_u32(attr2))
7152                                 return 0;
7153         }
7154
7155         return n_channels;
7156 }
7157
7158 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
7159 {
7160         return b < NUM_NL80211_BANDS && wiphy->bands[b];
7161 }
7162
7163 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
7164                             struct cfg80211_bss_selection *bss_select)
7165 {
7166         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
7167         struct nlattr *nest;
7168         int err;
7169         bool found = false;
7170         int i;
7171
7172         /* only process one nested attribute */
7173         nest = nla_data(nla);
7174         if (!nla_ok(nest, nla_len(nest)))
7175                 return -EINVAL;
7176
7177         err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX,
7178                                           nest, nl80211_bss_select_policy,
7179                                           NULL);
7180         if (err)
7181                 return err;
7182
7183         /* only one attribute may be given */
7184         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
7185                 if (attr[i]) {
7186                         if (found)
7187                                 return -EINVAL;
7188                         found = true;
7189                 }
7190         }
7191
7192         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
7193
7194         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
7195                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
7196
7197         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
7198                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
7199                 bss_select->param.band_pref =
7200                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
7201                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
7202                         return -EINVAL;
7203         }
7204
7205         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
7206                 struct nl80211_bss_select_rssi_adjust *adj_param;
7207
7208                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
7209                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
7210                 bss_select->param.adjust.band = adj_param->band;
7211                 bss_select->param.adjust.delta = adj_param->delta;
7212                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
7213                         return -EINVAL;
7214         }
7215
7216         /* user-space did not provide behaviour attribute */
7217         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
7218                 return -EINVAL;
7219
7220         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
7221                 return -EINVAL;
7222
7223         return 0;
7224 }
7225
7226 int nl80211_parse_random_mac(struct nlattr **attrs,
7227                              u8 *mac_addr, u8 *mac_addr_mask)
7228 {
7229         int i;
7230
7231         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
7232                 eth_zero_addr(mac_addr);
7233                 eth_zero_addr(mac_addr_mask);
7234                 mac_addr[0] = 0x2;
7235                 mac_addr_mask[0] = 0x3;
7236
7237                 return 0;
7238         }
7239
7240         /* need both or none */
7241         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
7242                 return -EINVAL;
7243
7244         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
7245         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
7246
7247         /* don't allow or configure an mcast address */
7248         if (!is_multicast_ether_addr(mac_addr_mask) ||
7249             is_multicast_ether_addr(mac_addr))
7250                 return -EINVAL;
7251
7252         /*
7253          * allow users to pass a MAC address that has bits set outside
7254          * of the mask, but don't bother drivers with having to deal
7255          * with such bits
7256          */
7257         for (i = 0; i < ETH_ALEN; i++)
7258                 mac_addr[i] &= mac_addr_mask[i];
7259
7260         return 0;
7261 }
7262
7263 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev)
7264 {
7265         ASSERT_WDEV_LOCK(wdev);
7266
7267         if (!cfg80211_beaconing_iface_active(wdev))
7268                 return true;
7269
7270         if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR))
7271                 return true;
7272
7273         return regulatory_pre_cac_allowed(wdev->wiphy);
7274 }
7275
7276 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
7277                                     enum nl80211_ext_feature_index feat)
7278 {
7279         if (!(flags & flag))
7280                 return true;
7281         if (wiphy_ext_feature_isset(wiphy, feat))
7282                 return true;
7283         return false;
7284 }
7285
7286 static int
7287 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
7288                          void *request, struct nlattr **attrs,
7289                          bool is_sched_scan)
7290 {
7291         u8 *mac_addr, *mac_addr_mask;
7292         u32 *flags;
7293         enum nl80211_feature_flags randomness_flag;
7294
7295         if (!attrs[NL80211_ATTR_SCAN_FLAGS])
7296                 return 0;
7297
7298         if (is_sched_scan) {
7299                 struct cfg80211_sched_scan_request *req = request;
7300
7301                 randomness_flag = wdev ?
7302                                   NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
7303                                   NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
7304                 flags = &req->flags;
7305                 mac_addr = req->mac_addr;
7306                 mac_addr_mask = req->mac_addr_mask;
7307         } else {
7308                 struct cfg80211_scan_request *req = request;
7309
7310                 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
7311                 flags = &req->flags;
7312                 mac_addr = req->mac_addr;
7313                 mac_addr_mask = req->mac_addr_mask;
7314         }
7315
7316         *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
7317
7318         if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
7319              !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
7320             !nl80211_check_scan_feat(wiphy, *flags,
7321                                      NL80211_SCAN_FLAG_LOW_SPAN,
7322                                      NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
7323             !nl80211_check_scan_feat(wiphy, *flags,
7324                                      NL80211_SCAN_FLAG_LOW_POWER,
7325                                      NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
7326             !nl80211_check_scan_feat(wiphy, *flags,
7327                                      NL80211_SCAN_FLAG_HIGH_ACCURACY,
7328                                      NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
7329             !nl80211_check_scan_feat(wiphy, *flags,
7330                                      NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
7331                                      NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
7332             !nl80211_check_scan_feat(wiphy, *flags,
7333                                      NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
7334                                      NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
7335             !nl80211_check_scan_feat(wiphy, *flags,
7336                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
7337                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
7338             !nl80211_check_scan_feat(wiphy, *flags,
7339                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
7340                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
7341             !nl80211_check_scan_feat(wiphy, *flags,
7342                                      NL80211_SCAN_FLAG_RANDOM_SN,
7343                                      NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
7344             !nl80211_check_scan_feat(wiphy, *flags,
7345                                      NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
7346                                      NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
7347                 return -EOPNOTSUPP;
7348
7349         if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
7350                 int err;
7351
7352                 if (!(wiphy->features & randomness_flag) ||
7353                     (wdev && wdev->current_bss))
7354                         return -EOPNOTSUPP;
7355
7356                 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
7357                 if (err)
7358                         return err;
7359         }
7360
7361         return 0;
7362 }
7363
7364 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
7365 {
7366         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7367         struct wireless_dev *wdev = info->user_ptr[1];
7368         struct cfg80211_scan_request *request;
7369         struct nlattr *attr;
7370         struct wiphy *wiphy;
7371         int err, tmp, n_ssids = 0, n_channels, i;
7372         size_t ie_len;
7373
7374         wiphy = &rdev->wiphy;
7375
7376         if (wdev->iftype == NL80211_IFTYPE_NAN)
7377                 return -EOPNOTSUPP;
7378
7379         if (!rdev->ops->scan)
7380                 return -EOPNOTSUPP;
7381
7382         if (rdev->scan_req || rdev->scan_msg) {
7383                 err = -EBUSY;
7384                 goto unlock;
7385         }
7386
7387         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7388                 n_channels = validate_scan_freqs(
7389                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7390                 if (!n_channels) {
7391                         err = -EINVAL;
7392                         goto unlock;
7393                 }
7394         } else {
7395                 n_channels = ieee80211_get_num_supported_channels(wiphy);
7396         }
7397
7398         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
7399                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
7400                         n_ssids++;
7401
7402         if (n_ssids > wiphy->max_scan_ssids) {
7403                 err = -EINVAL;
7404                 goto unlock;
7405         }
7406
7407         if (info->attrs[NL80211_ATTR_IE])
7408                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7409         else
7410                 ie_len = 0;
7411
7412         if (ie_len > wiphy->max_scan_ie_len) {
7413                 err = -EINVAL;
7414                 goto unlock;
7415         }
7416
7417         request = kzalloc(sizeof(*request)
7418                         + sizeof(*request->ssids) * n_ssids
7419                         + sizeof(*request->channels) * n_channels
7420                         + ie_len, GFP_KERNEL);
7421         if (!request) {
7422                 err = -ENOMEM;
7423                 goto unlock;
7424         }
7425
7426         if (n_ssids)
7427                 request->ssids = (void *)&request->channels[n_channels];
7428         request->n_ssids = n_ssids;
7429         if (ie_len) {
7430                 if (n_ssids)
7431                         request->ie = (void *)(request->ssids + n_ssids);
7432                 else
7433                         request->ie = (void *)(request->channels + n_channels);
7434         }
7435
7436         i = 0;
7437         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7438                 /* user specified, bail out if channel not found */
7439                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
7440                         struct ieee80211_channel *chan;
7441
7442                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7443
7444                         if (!chan) {
7445                                 err = -EINVAL;
7446                                 goto out_free;
7447                         }
7448
7449                         /* ignore disabled channels */
7450                         if (chan->flags & IEEE80211_CHAN_DISABLED)
7451                                 continue;
7452
7453                         request->channels[i] = chan;
7454                         i++;
7455                 }
7456         } else {
7457                 enum nl80211_band band;
7458
7459                 /* all channels */
7460                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7461                         int j;
7462
7463                         if (!wiphy->bands[band])
7464                                 continue;
7465                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7466                                 struct ieee80211_channel *chan;
7467
7468                                 chan = &wiphy->bands[band]->channels[j];
7469
7470                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
7471                                         continue;
7472
7473                                 request->channels[i] = chan;
7474                                 i++;
7475                         }
7476                 }
7477         }
7478
7479         if (!i) {
7480                 err = -EINVAL;
7481                 goto out_free;
7482         }
7483
7484         request->n_channels = i;
7485
7486         wdev_lock(wdev);
7487         if (!cfg80211_off_channel_oper_allowed(wdev)) {
7488                 struct ieee80211_channel *chan;
7489
7490                 if (request->n_channels != 1) {
7491                         wdev_unlock(wdev);
7492                         err = -EBUSY;
7493                         goto out_free;
7494                 }
7495
7496                 chan = request->channels[0];
7497                 if (chan->center_freq != wdev->chandef.chan->center_freq) {
7498                         wdev_unlock(wdev);
7499                         err = -EBUSY;
7500                         goto out_free;
7501                 }
7502         }
7503         wdev_unlock(wdev);
7504
7505         i = 0;
7506         if (n_ssids) {
7507                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
7508                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7509                                 err = -EINVAL;
7510                                 goto out_free;
7511                         }
7512                         request->ssids[i].ssid_len = nla_len(attr);
7513                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
7514                         i++;
7515                 }
7516         }
7517
7518         if (info->attrs[NL80211_ATTR_IE]) {
7519                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7520                 memcpy((void *)request->ie,
7521                        nla_data(info->attrs[NL80211_ATTR_IE]),
7522                        request->ie_len);
7523         }
7524
7525         for (i = 0; i < NUM_NL80211_BANDS; i++)
7526                 if (wiphy->bands[i])
7527                         request->rates[i] =
7528                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
7529
7530         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
7531                 nla_for_each_nested(attr,
7532                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
7533                                     tmp) {
7534                         enum nl80211_band band = nla_type(attr);
7535
7536                         if (band < 0 || band >= NUM_NL80211_BANDS) {
7537                                 err = -EINVAL;
7538                                 goto out_free;
7539                         }
7540
7541                         if (!wiphy->bands[band])
7542                                 continue;
7543
7544                         err = ieee80211_get_ratemask(wiphy->bands[band],
7545                                                      nla_data(attr),
7546                                                      nla_len(attr),
7547                                                      &request->rates[band]);
7548                         if (err)
7549                                 goto out_free;
7550                 }
7551         }
7552
7553         if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
7554                 if (!wiphy_ext_feature_isset(wiphy,
7555                                         NL80211_EXT_FEATURE_SET_SCAN_DWELL)) {
7556                         err = -EOPNOTSUPP;
7557                         goto out_free;
7558                 }
7559
7560                 request->duration =
7561                         nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
7562                 request->duration_mandatory =
7563                         nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
7564         }
7565
7566         err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
7567                                        false);
7568         if (err)
7569                 goto out_free;
7570
7571         request->no_cck =
7572                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7573
7574         /* Initial implementation used NL80211_ATTR_MAC to set the specific
7575          * BSSID to scan for. This was problematic because that same attribute
7576          * was already used for another purpose (local random MAC address). The
7577          * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
7578          * compatibility with older userspace components, also use the
7579          * NL80211_ATTR_MAC value here if it can be determined to be used for
7580          * the specific BSSID use case instead of the random MAC address
7581          * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
7582          */
7583         if (info->attrs[NL80211_ATTR_BSSID])
7584                 memcpy(request->bssid,
7585                        nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
7586         else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
7587                  info->attrs[NL80211_ATTR_MAC])
7588                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
7589                        ETH_ALEN);
7590         else
7591                 eth_broadcast_addr(request->bssid);
7592
7593         request->wdev = wdev;
7594         request->wiphy = &rdev->wiphy;
7595         request->scan_start = jiffies;
7596
7597         rdev->scan_req = request;
7598         err = rdev_scan(rdev, request);
7599
7600         if (!err) {
7601                 nl80211_send_scan_start(rdev, wdev);
7602                 if (wdev->netdev)
7603                         dev_hold(wdev->netdev);
7604         } else {
7605  out_free:
7606                 rdev->scan_req = NULL;
7607                 kfree(request);
7608         }
7609
7610  unlock:
7611         return err;
7612 }
7613
7614 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
7615 {
7616         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7617         struct wireless_dev *wdev = info->user_ptr[1];
7618
7619         if (!rdev->ops->abort_scan)
7620                 return -EOPNOTSUPP;
7621
7622         if (rdev->scan_msg)
7623                 return 0;
7624
7625         if (!rdev->scan_req)
7626                 return -ENOENT;
7627
7628         rdev_abort_scan(rdev, wdev);
7629         return 0;
7630 }
7631
7632 static int
7633 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
7634                                struct cfg80211_sched_scan_request *request,
7635                                struct nlattr **attrs)
7636 {
7637         int tmp, err, i = 0;
7638         struct nlattr *attr;
7639
7640         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7641                 u32 interval;
7642
7643                 /*
7644                  * If scan plans are not specified,
7645                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
7646                  * case one scan plan will be set with the specified scan
7647                  * interval and infinite number of iterations.
7648                  */
7649                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
7650                 if (!interval)
7651                         return -EINVAL;
7652
7653                 request->scan_plans[0].interval =
7654                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
7655                 if (!request->scan_plans[0].interval)
7656                         return -EINVAL;
7657
7658                 if (request->scan_plans[0].interval >
7659                     wiphy->max_sched_scan_plan_interval)
7660                         request->scan_plans[0].interval =
7661                                 wiphy->max_sched_scan_plan_interval;
7662
7663                 return 0;
7664         }
7665
7666         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
7667                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
7668
7669                 if (WARN_ON(i >= n_plans))
7670                         return -EINVAL;
7671
7672                 err = nla_parse_nested_deprecated(plan,
7673                                                   NL80211_SCHED_SCAN_PLAN_MAX,
7674                                                   attr, nl80211_plan_policy,
7675                                                   NULL);
7676                 if (err)
7677                         return err;
7678
7679                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
7680                         return -EINVAL;
7681
7682                 request->scan_plans[i].interval =
7683                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
7684                 if (!request->scan_plans[i].interval ||
7685                     request->scan_plans[i].interval >
7686                     wiphy->max_sched_scan_plan_interval)
7687                         return -EINVAL;
7688
7689                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
7690                         request->scan_plans[i].iterations =
7691                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
7692                         if (!request->scan_plans[i].iterations ||
7693                             (request->scan_plans[i].iterations >
7694                              wiphy->max_sched_scan_plan_iterations))
7695                                 return -EINVAL;
7696                 } else if (i < n_plans - 1) {
7697                         /*
7698                          * All scan plans but the last one must specify
7699                          * a finite number of iterations
7700                          */
7701                         return -EINVAL;
7702                 }
7703
7704                 i++;
7705         }
7706
7707         /*
7708          * The last scan plan must not specify the number of
7709          * iterations, it is supposed to run infinitely
7710          */
7711         if (request->scan_plans[n_plans - 1].iterations)
7712                 return  -EINVAL;
7713
7714         return 0;
7715 }
7716
7717 static int
7718 nl80211_parse_sched_scan_per_band_rssi(struct wiphy *wiphy,
7719                                        struct cfg80211_match_set *match_sets,
7720                                        struct nlattr *tb_band_rssi,
7721                                        s32 rssi_thold)
7722 {
7723         struct nlattr *attr;
7724         int i, tmp, ret = 0;
7725
7726         if (!wiphy_ext_feature_isset(wiphy,
7727                     NL80211_EXT_FEATURE_SCHED_SCAN_BAND_SPECIFIC_RSSI_THOLD)) {
7728                 if (tb_band_rssi)
7729                         ret = -EOPNOTSUPP;
7730                 else
7731                         for (i = 0; i < NUM_NL80211_BANDS; i++)
7732                                 match_sets->per_band_rssi_thold[i] =
7733                                         NL80211_SCAN_RSSI_THOLD_OFF;
7734                 return ret;
7735         }
7736
7737         for (i = 0; i < NUM_NL80211_BANDS; i++)
7738                 match_sets->per_band_rssi_thold[i] = rssi_thold;
7739
7740         nla_for_each_nested(attr, tb_band_rssi, tmp) {
7741                 enum nl80211_band band = nla_type(attr);
7742
7743                 if (band < 0 || band >= NUM_NL80211_BANDS)
7744                         return -EINVAL;
7745
7746                 match_sets->per_band_rssi_thold[band] = nla_get_s32(attr);
7747         }
7748
7749         return 0;
7750 }
7751
7752 static struct cfg80211_sched_scan_request *
7753 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
7754                          struct nlattr **attrs, int max_match_sets)
7755 {
7756         struct cfg80211_sched_scan_request *request;
7757         struct nlattr *attr;
7758         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
7759         enum nl80211_band band;
7760         size_t ie_len;
7761         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
7762         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
7763
7764         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7765                 n_channels = validate_scan_freqs(
7766                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7767                 if (!n_channels)
7768                         return ERR_PTR(-EINVAL);
7769         } else {
7770                 n_channels = ieee80211_get_num_supported_channels(wiphy);
7771         }
7772
7773         if (attrs[NL80211_ATTR_SCAN_SSIDS])
7774                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7775                                     tmp)
7776                         n_ssids++;
7777
7778         if (n_ssids > wiphy->max_sched_scan_ssids)
7779                 return ERR_PTR(-EINVAL);
7780
7781         /*
7782          * First, count the number of 'real' matchsets. Due to an issue with
7783          * the old implementation, matchsets containing only the RSSI attribute
7784          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
7785          * RSSI for all matchsets, rather than their own matchset for reporting
7786          * all APs with a strong RSSI. This is needed to be compatible with
7787          * older userspace that treated a matchset with only the RSSI as the
7788          * global RSSI for all other matchsets - if there are other matchsets.
7789          */
7790         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7791                 nla_for_each_nested(attr,
7792                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7793                                     tmp) {
7794                         struct nlattr *rssi;
7795
7796                         err = nla_parse_nested_deprecated(tb,
7797                                                           NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7798                                                           attr,
7799                                                           nl80211_match_policy,
7800                                                           NULL);
7801                         if (err)
7802                                 return ERR_PTR(err);
7803
7804                         /* SSID and BSSID are mutually exclusive */
7805                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
7806                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
7807                                 return ERR_PTR(-EINVAL);
7808
7809                         /* add other standalone attributes here */
7810                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
7811                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
7812                                 n_match_sets++;
7813                                 continue;
7814                         }
7815                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7816                         if (rssi)
7817                                 default_match_rssi = nla_get_s32(rssi);
7818                 }
7819         }
7820
7821         /* However, if there's no other matchset, add the RSSI one */
7822         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
7823                 n_match_sets = 1;
7824
7825         if (n_match_sets > max_match_sets)
7826                 return ERR_PTR(-EINVAL);
7827
7828         if (attrs[NL80211_ATTR_IE])
7829                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
7830         else
7831                 ie_len = 0;
7832
7833         if (ie_len > wiphy->max_sched_scan_ie_len)
7834                 return ERR_PTR(-EINVAL);
7835
7836         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7837                 /*
7838                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
7839                  * each scan plan already specifies its own interval
7840                  */
7841                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7842                         return ERR_PTR(-EINVAL);
7843
7844                 nla_for_each_nested(attr,
7845                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
7846                         n_plans++;
7847         } else {
7848                 /*
7849                  * The scan interval attribute is kept for backward
7850                  * compatibility. If no scan plans are specified and sched scan
7851                  * interval is specified, one scan plan will be set with this
7852                  * scan interval and infinite number of iterations.
7853                  */
7854                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7855                         return ERR_PTR(-EINVAL);
7856
7857                 n_plans = 1;
7858         }
7859
7860         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
7861                 return ERR_PTR(-EINVAL);
7862
7863         if (!wiphy_ext_feature_isset(
7864                     wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
7865             (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
7866              attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
7867                 return ERR_PTR(-EINVAL);
7868
7869         request = kzalloc(sizeof(*request)
7870                         + sizeof(*request->ssids) * n_ssids
7871                         + sizeof(*request->match_sets) * n_match_sets
7872                         + sizeof(*request->scan_plans) * n_plans
7873                         + sizeof(*request->channels) * n_channels
7874                         + ie_len, GFP_KERNEL);
7875         if (!request)
7876                 return ERR_PTR(-ENOMEM);
7877
7878         if (n_ssids)
7879                 request->ssids = (void *)&request->channels[n_channels];
7880         request->n_ssids = n_ssids;
7881         if (ie_len) {
7882                 if (n_ssids)
7883                         request->ie = (void *)(request->ssids + n_ssids);
7884                 else
7885                         request->ie = (void *)(request->channels + n_channels);
7886         }
7887
7888         if (n_match_sets) {
7889                 if (request->ie)
7890                         request->match_sets = (void *)(request->ie + ie_len);
7891                 else if (n_ssids)
7892                         request->match_sets =
7893                                 (void *)(request->ssids + n_ssids);
7894                 else
7895                         request->match_sets =
7896                                 (void *)(request->channels + n_channels);
7897         }
7898         request->n_match_sets = n_match_sets;
7899
7900         if (n_match_sets)
7901                 request->scan_plans = (void *)(request->match_sets +
7902                                                n_match_sets);
7903         else if (request->ie)
7904                 request->scan_plans = (void *)(request->ie + ie_len);
7905         else if (n_ssids)
7906                 request->scan_plans = (void *)(request->ssids + n_ssids);
7907         else
7908                 request->scan_plans = (void *)(request->channels + n_channels);
7909
7910         request->n_scan_plans = n_plans;
7911
7912         i = 0;
7913         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7914                 /* user specified, bail out if channel not found */
7915                 nla_for_each_nested(attr,
7916                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
7917                                     tmp) {
7918                         struct ieee80211_channel *chan;
7919
7920                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7921
7922                         if (!chan) {
7923                                 err = -EINVAL;
7924                                 goto out_free;
7925                         }
7926
7927                         /* ignore disabled channels */
7928                         if (chan->flags & IEEE80211_CHAN_DISABLED)
7929                                 continue;
7930
7931                         request->channels[i] = chan;
7932                         i++;
7933                 }
7934         } else {
7935                 /* all channels */
7936                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7937                         int j;
7938
7939                         if (!wiphy->bands[band])
7940                                 continue;
7941                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7942                                 struct ieee80211_channel *chan;
7943
7944                                 chan = &wiphy->bands[band]->channels[j];
7945
7946                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
7947                                         continue;
7948
7949                                 request->channels[i] = chan;
7950                                 i++;
7951                         }
7952                 }
7953         }
7954
7955         if (!i) {
7956                 err = -EINVAL;
7957                 goto out_free;
7958         }
7959
7960         request->n_channels = i;
7961
7962         i = 0;
7963         if (n_ssids) {
7964                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7965                                     tmp) {
7966                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7967                                 err = -EINVAL;
7968                                 goto out_free;
7969                         }
7970                         request->ssids[i].ssid_len = nla_len(attr);
7971                         memcpy(request->ssids[i].ssid, nla_data(attr),
7972                                nla_len(attr));
7973                         i++;
7974                 }
7975         }
7976
7977         i = 0;
7978         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7979                 nla_for_each_nested(attr,
7980                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7981                                     tmp) {
7982                         struct nlattr *ssid, *bssid, *rssi;
7983
7984                         err = nla_parse_nested_deprecated(tb,
7985                                                           NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7986                                                           attr,
7987                                                           nl80211_match_policy,
7988                                                           NULL);
7989                         if (err)
7990                                 goto out_free;
7991                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
7992                         bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
7993
7994                         if (!ssid && !bssid) {
7995                                 i++;
7996                                 continue;
7997                         }
7998
7999                         if (WARN_ON(i >= n_match_sets)) {
8000                                 /* this indicates a programming error,
8001                                  * the loop above should have verified
8002                                  * things properly
8003                                  */
8004                                 err = -EINVAL;
8005                                 goto out_free;
8006                         }
8007
8008                         if (ssid) {
8009                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
8010                                         err = -EINVAL;
8011                                         goto out_free;
8012                                 }
8013                                 memcpy(request->match_sets[i].ssid.ssid,
8014                                        nla_data(ssid), nla_len(ssid));
8015                                 request->match_sets[i].ssid.ssid_len =
8016                                         nla_len(ssid);
8017                         }
8018                         if (bssid) {
8019                                 if (nla_len(bssid) != ETH_ALEN) {
8020                                         err = -EINVAL;
8021                                         goto out_free;
8022                                 }
8023                                 memcpy(request->match_sets[i].bssid,
8024                                        nla_data(bssid), ETH_ALEN);
8025                         }
8026
8027                         /* special attribute - old implementation w/a */
8028                         request->match_sets[i].rssi_thold = default_match_rssi;
8029                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
8030                         if (rssi)
8031                                 request->match_sets[i].rssi_thold =
8032                                         nla_get_s32(rssi);
8033
8034                         /* Parse per band RSSI attribute */
8035                         err = nl80211_parse_sched_scan_per_band_rssi(wiphy,
8036                                 &request->match_sets[i],
8037                                 tb[NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI],
8038                                 request->match_sets[i].rssi_thold);
8039                         if (err)
8040                                 goto out_free;
8041
8042                         i++;
8043                 }
8044
8045                 /* there was no other matchset, so the RSSI one is alone */
8046                 if (i == 0 && n_match_sets)
8047                         request->match_sets[0].rssi_thold = default_match_rssi;
8048
8049                 request->min_rssi_thold = INT_MAX;
8050                 for (i = 0; i < n_match_sets; i++)
8051                         request->min_rssi_thold =
8052                                 min(request->match_sets[i].rssi_thold,
8053                                     request->min_rssi_thold);
8054         } else {
8055                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
8056         }
8057
8058         if (ie_len) {
8059                 request->ie_len = ie_len;
8060                 memcpy((void *)request->ie,
8061                        nla_data(attrs[NL80211_ATTR_IE]),
8062                        request->ie_len);
8063         }
8064
8065         err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
8066         if (err)
8067                 goto out_free;
8068
8069         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
8070                 request->delay =
8071                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
8072
8073         if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
8074                 request->relative_rssi = nla_get_s8(
8075                         attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
8076                 request->relative_rssi_set = true;
8077         }
8078
8079         if (request->relative_rssi_set &&
8080             attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
8081                 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
8082
8083                 rssi_adjust = nla_data(
8084                         attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
8085                 request->rssi_adjust.band = rssi_adjust->band;
8086                 request->rssi_adjust.delta = rssi_adjust->delta;
8087                 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
8088                         err = -EINVAL;
8089                         goto out_free;
8090                 }
8091         }
8092
8093         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
8094         if (err)
8095                 goto out_free;
8096
8097         request->scan_start = jiffies;
8098
8099         return request;
8100
8101 out_free:
8102         kfree(request);
8103         return ERR_PTR(err);
8104 }
8105
8106 static int nl80211_start_sched_scan(struct sk_buff *skb,
8107                                     struct genl_info *info)
8108 {
8109         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8110         struct net_device *dev = info->user_ptr[1];
8111         struct wireless_dev *wdev = dev->ieee80211_ptr;
8112         struct cfg80211_sched_scan_request *sched_scan_req;
8113         bool want_multi;
8114         int err;
8115
8116         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
8117                 return -EOPNOTSUPP;
8118
8119         want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
8120         err = cfg80211_sched_scan_req_possible(rdev, want_multi);
8121         if (err)
8122                 return err;
8123
8124         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
8125                                                   info->attrs,
8126                                                   rdev->wiphy.max_match_sets);
8127
8128         err = PTR_ERR_OR_ZERO(sched_scan_req);
8129         if (err)
8130                 goto out_err;
8131
8132         /* leave request id zero for legacy request
8133          * or if driver does not support multi-scheduled scan
8134          */
8135         if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1) {
8136                 while (!sched_scan_req->reqid)
8137                         sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
8138         }
8139
8140         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
8141         if (err)
8142                 goto out_free;
8143
8144         sched_scan_req->dev = dev;
8145         sched_scan_req->wiphy = &rdev->wiphy;
8146
8147         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
8148                 sched_scan_req->owner_nlportid = info->snd_portid;
8149
8150         cfg80211_add_sched_scan_req(rdev, sched_scan_req);
8151
8152         nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
8153         return 0;
8154
8155 out_free:
8156         kfree(sched_scan_req);
8157 out_err:
8158         return err;
8159 }
8160
8161 static int nl80211_stop_sched_scan(struct sk_buff *skb,
8162                                    struct genl_info *info)
8163 {
8164         struct cfg80211_sched_scan_request *req;
8165         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8166         u64 cookie;
8167
8168         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
8169                 return -EOPNOTSUPP;
8170
8171         if (info->attrs[NL80211_ATTR_COOKIE]) {
8172                 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
8173                 return __cfg80211_stop_sched_scan(rdev, cookie, false);
8174         }
8175
8176         req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
8177                                      struct cfg80211_sched_scan_request,
8178                                      list);
8179         if (!req || req->reqid ||
8180             (req->owner_nlportid &&
8181              req->owner_nlportid != info->snd_portid))
8182                 return -ENOENT;
8183
8184         return cfg80211_stop_sched_scan_req(rdev, req, false);
8185 }
8186
8187 static int nl80211_start_radar_detection(struct sk_buff *skb,
8188                                          struct genl_info *info)
8189 {
8190         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8191         struct net_device *dev = info->user_ptr[1];
8192         struct wireless_dev *wdev = dev->ieee80211_ptr;
8193         struct wiphy *wiphy = wdev->wiphy;
8194         struct cfg80211_chan_def chandef;
8195         enum nl80211_dfs_regions dfs_region;
8196         unsigned int cac_time_ms;
8197         int err;
8198
8199         dfs_region = reg_get_dfs_region(wiphy);
8200         if (dfs_region == NL80211_DFS_UNSET)
8201                 return -EINVAL;
8202
8203         err = nl80211_parse_chandef(rdev, info, &chandef);
8204         if (err)
8205                 return err;
8206
8207         if (netif_carrier_ok(dev))
8208                 return -EBUSY;
8209
8210         if (wdev->cac_started)
8211                 return -EBUSY;
8212
8213         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
8214         if (err < 0)
8215                 return err;
8216
8217         if (err == 0)
8218                 return -EINVAL;
8219
8220         if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
8221                 return -EINVAL;
8222
8223         /* CAC start is offloaded to HW and can't be started manually */
8224         if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
8225                 return -EOPNOTSUPP;
8226
8227         if (!rdev->ops->start_radar_detection)
8228                 return -EOPNOTSUPP;
8229
8230         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
8231         if (WARN_ON(!cac_time_ms))
8232                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
8233
8234         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
8235         if (!err) {
8236                 wdev->chandef = chandef;
8237                 wdev->cac_started = true;
8238                 wdev->cac_start_time = jiffies;
8239                 wdev->cac_time_ms = cac_time_ms;
8240         }
8241         return err;
8242 }
8243
8244 static int nl80211_notify_radar_detection(struct sk_buff *skb,
8245                                           struct genl_info *info)
8246 {
8247         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8248         struct net_device *dev = info->user_ptr[1];
8249         struct wireless_dev *wdev = dev->ieee80211_ptr;
8250         struct wiphy *wiphy = wdev->wiphy;
8251         struct cfg80211_chan_def chandef;
8252         enum nl80211_dfs_regions dfs_region;
8253         int err;
8254
8255         dfs_region = reg_get_dfs_region(wiphy);
8256         if (dfs_region == NL80211_DFS_UNSET) {
8257                 GENL_SET_ERR_MSG(info,
8258                                  "DFS Region is not set. Unexpected Radar indication");
8259                 return -EINVAL;
8260         }
8261
8262         err = nl80211_parse_chandef(rdev, info, &chandef);
8263         if (err) {
8264                 GENL_SET_ERR_MSG(info, "Unable to extract chandef info");
8265                 return err;
8266         }
8267
8268         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
8269         if (err < 0) {
8270                 GENL_SET_ERR_MSG(info, "chandef is invalid");
8271                 return err;
8272         }
8273
8274         if (err == 0) {
8275                 GENL_SET_ERR_MSG(info,
8276                                  "Unexpected Radar indication for chandef/iftype");
8277                 return -EINVAL;
8278         }
8279
8280         /* Do not process this notification if radar is already detected
8281          * by kernel on this channel, and return success.
8282          */
8283         if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE)
8284                 return 0;
8285
8286         cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE);
8287
8288         cfg80211_sched_dfs_chan_update(rdev);
8289
8290         rdev->radar_chandef = chandef;
8291
8292         /* Propagate this notification to other radios as well */
8293         queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
8294
8295         return 0;
8296 }
8297
8298 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
8299 {
8300         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8301         struct net_device *dev = info->user_ptr[1];
8302         struct wireless_dev *wdev = dev->ieee80211_ptr;
8303         struct cfg80211_csa_settings params;
8304         /* csa_attrs is defined static to avoid waste of stack size - this
8305          * function is called under RTNL lock, so this should not be a problem.
8306          */
8307         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
8308         int err;
8309         bool need_new_beacon = false;
8310         bool need_handle_dfs_flag = true;
8311         int len, i;
8312         u32 cs_count;
8313
8314         if (!rdev->ops->channel_switch ||
8315             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
8316                 return -EOPNOTSUPP;
8317
8318         switch (dev->ieee80211_ptr->iftype) {
8319         case NL80211_IFTYPE_AP:
8320         case NL80211_IFTYPE_P2P_GO:
8321                 need_new_beacon = true;
8322                 /* For all modes except AP the handle_dfs flag needs to be
8323                  * supplied to tell the kernel that userspace will handle radar
8324                  * events when they happen. Otherwise a switch to a channel
8325                  * requiring DFS will be rejected.
8326                  */
8327                 need_handle_dfs_flag = false;
8328
8329                 /* useless if AP is not running */
8330                 if (!wdev->beacon_interval)
8331                         return -ENOTCONN;
8332                 break;
8333         case NL80211_IFTYPE_ADHOC:
8334                 if (!wdev->ssid_len)
8335                         return -ENOTCONN;
8336                 break;
8337         case NL80211_IFTYPE_MESH_POINT:
8338                 if (!wdev->mesh_id_len)
8339                         return -ENOTCONN;
8340                 break;
8341         default:
8342                 return -EOPNOTSUPP;
8343         }
8344
8345         memset(&params, 0, sizeof(params));
8346         params.beacon_csa.ftm_responder = -1;
8347
8348         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
8349             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
8350                 return -EINVAL;
8351
8352         /* only important for AP, IBSS and mesh create IEs internally */
8353         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
8354                 return -EINVAL;
8355
8356         /* Even though the attribute is u32, the specification says
8357          * u8, so let's make sure we don't overflow.
8358          */
8359         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
8360         if (cs_count > 255)
8361                 return -EINVAL;
8362
8363         params.count = cs_count;
8364
8365         if (!need_new_beacon)
8366                 goto skip_beacons;
8367
8368         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_after);
8369         if (err)
8370                 return err;
8371
8372         err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
8373                                           info->attrs[NL80211_ATTR_CSA_IES],
8374                                           nl80211_policy, info->extack);
8375         if (err)
8376                 return err;
8377
8378         err = nl80211_parse_beacon(rdev, csa_attrs, &params.beacon_csa);
8379         if (err)
8380                 return err;
8381
8382         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
8383                 return -EINVAL;
8384
8385         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
8386         if (!len || (len % sizeof(u16)))
8387                 return -EINVAL;
8388
8389         params.n_counter_offsets_beacon = len / sizeof(u16);
8390         if (rdev->wiphy.max_num_csa_counters &&
8391             (params.n_counter_offsets_beacon >
8392              rdev->wiphy.max_num_csa_counters))
8393                 return -EINVAL;
8394
8395         params.counter_offsets_beacon =
8396                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
8397
8398         /* sanity checks - counters should fit and be the same */
8399         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
8400                 u16 offset = params.counter_offsets_beacon[i];
8401
8402                 if (offset >= params.beacon_csa.tail_len)
8403                         return -EINVAL;
8404
8405                 if (params.beacon_csa.tail[offset] != params.count)
8406                         return -EINVAL;
8407         }
8408
8409         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
8410                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
8411                 if (!len || (len % sizeof(u16)))
8412                         return -EINVAL;
8413
8414                 params.n_counter_offsets_presp = len / sizeof(u16);
8415                 if (rdev->wiphy.max_num_csa_counters &&
8416                     (params.n_counter_offsets_presp >
8417                      rdev->wiphy.max_num_csa_counters))
8418                         return -EINVAL;
8419
8420                 params.counter_offsets_presp =
8421                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
8422
8423                 /* sanity checks - counters should fit and be the same */
8424                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
8425                         u16 offset = params.counter_offsets_presp[i];
8426
8427                         if (offset >= params.beacon_csa.probe_resp_len)
8428                                 return -EINVAL;
8429
8430                         if (params.beacon_csa.probe_resp[offset] !=
8431                             params.count)
8432                                 return -EINVAL;
8433                 }
8434         }
8435
8436 skip_beacons:
8437         err = nl80211_parse_chandef(rdev, info, &params.chandef);
8438         if (err)
8439                 return err;
8440
8441         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
8442                                            wdev->iftype))
8443                 return -EINVAL;
8444
8445         err = cfg80211_chandef_dfs_required(wdev->wiphy,
8446                                             &params.chandef,
8447                                             wdev->iftype);
8448         if (err < 0)
8449                 return err;
8450
8451         if (err > 0) {
8452                 params.radar_required = true;
8453                 if (need_handle_dfs_flag &&
8454                     !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
8455                         return -EINVAL;
8456                 }
8457         }
8458
8459         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
8460                 params.block_tx = true;
8461
8462         wdev_lock(wdev);
8463         err = rdev_channel_switch(rdev, dev, &params);
8464         wdev_unlock(wdev);
8465
8466         return err;
8467 }
8468
8469 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
8470                             u32 seq, int flags,
8471                             struct cfg80211_registered_device *rdev,
8472                             struct wireless_dev *wdev,
8473                             struct cfg80211_internal_bss *intbss)
8474 {
8475         struct cfg80211_bss *res = &intbss->pub;
8476         const struct cfg80211_bss_ies *ies;
8477         void *hdr;
8478         struct nlattr *bss;
8479
8480         ASSERT_WDEV_LOCK(wdev);
8481
8482         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
8483                              NL80211_CMD_NEW_SCAN_RESULTS);
8484         if (!hdr)
8485                 return -1;
8486
8487         genl_dump_check_consistent(cb, hdr);
8488
8489         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
8490                 goto nla_put_failure;
8491         if (wdev->netdev &&
8492             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
8493                 goto nla_put_failure;
8494         if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
8495                               NL80211_ATTR_PAD))
8496                 goto nla_put_failure;
8497
8498         bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS);
8499         if (!bss)
8500                 goto nla_put_failure;
8501         if ((!is_zero_ether_addr(res->bssid) &&
8502              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
8503                 goto nla_put_failure;
8504
8505         rcu_read_lock();
8506         /* indicate whether we have probe response data or not */
8507         if (rcu_access_pointer(res->proberesp_ies) &&
8508             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
8509                 goto fail_unlock_rcu;
8510
8511         /* this pointer prefers to be pointed to probe response data
8512          * but is always valid
8513          */
8514         ies = rcu_dereference(res->ies);
8515         if (ies) {
8516                 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
8517                                       NL80211_BSS_PAD))
8518                         goto fail_unlock_rcu;
8519                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
8520                                         ies->len, ies->data))
8521                         goto fail_unlock_rcu;
8522         }
8523
8524         /* and this pointer is always (unless driver didn't know) beacon data */
8525         ies = rcu_dereference(res->beacon_ies);
8526         if (ies && ies->from_beacon) {
8527                 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
8528                                       NL80211_BSS_PAD))
8529                         goto fail_unlock_rcu;
8530                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
8531                                         ies->len, ies->data))
8532                         goto fail_unlock_rcu;
8533         }
8534         rcu_read_unlock();
8535
8536         if (res->beacon_interval &&
8537             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
8538                 goto nla_put_failure;
8539         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
8540             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
8541             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
8542             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
8543                         jiffies_to_msecs(jiffies - intbss->ts)))
8544                 goto nla_put_failure;
8545
8546         if (intbss->parent_tsf &&
8547             (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
8548                                intbss->parent_tsf, NL80211_BSS_PAD) ||
8549              nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
8550                      intbss->parent_bssid)))
8551                 goto nla_put_failure;
8552
8553         if (intbss->ts_boottime &&
8554             nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
8555                               intbss->ts_boottime, NL80211_BSS_PAD))
8556                 goto nla_put_failure;
8557
8558         if (!nl80211_put_signal(msg, intbss->pub.chains,
8559                                 intbss->pub.chain_signal,
8560                                 NL80211_BSS_CHAIN_SIGNAL))
8561                 goto nla_put_failure;
8562
8563         switch (rdev->wiphy.signal_type) {
8564         case CFG80211_SIGNAL_TYPE_MBM:
8565                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
8566                         goto nla_put_failure;
8567                 break;
8568         case CFG80211_SIGNAL_TYPE_UNSPEC:
8569                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
8570                         goto nla_put_failure;
8571                 break;
8572         default:
8573                 break;
8574         }
8575
8576         switch (wdev->iftype) {
8577         case NL80211_IFTYPE_P2P_CLIENT:
8578         case NL80211_IFTYPE_STATION:
8579                 if (intbss == wdev->current_bss &&
8580                     nla_put_u32(msg, NL80211_BSS_STATUS,
8581                                 NL80211_BSS_STATUS_ASSOCIATED))
8582                         goto nla_put_failure;
8583                 break;
8584         case NL80211_IFTYPE_ADHOC:
8585                 if (intbss == wdev->current_bss &&
8586                     nla_put_u32(msg, NL80211_BSS_STATUS,
8587                                 NL80211_BSS_STATUS_IBSS_JOINED))
8588                         goto nla_put_failure;
8589                 break;
8590         default:
8591                 break;
8592         }
8593
8594         nla_nest_end(msg, bss);
8595
8596         genlmsg_end(msg, hdr);
8597         return 0;
8598
8599  fail_unlock_rcu:
8600         rcu_read_unlock();
8601  nla_put_failure:
8602         genlmsg_cancel(msg, hdr);
8603         return -EMSGSIZE;
8604 }
8605
8606 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
8607 {
8608         struct cfg80211_registered_device *rdev;
8609         struct cfg80211_internal_bss *scan;
8610         struct wireless_dev *wdev;
8611         int start = cb->args[2], idx = 0;
8612         int err;
8613
8614         rtnl_lock();
8615         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
8616         if (err) {
8617                 rtnl_unlock();
8618                 return err;
8619         }
8620
8621         wdev_lock(wdev);
8622         spin_lock_bh(&rdev->bss_lock);
8623
8624         /*
8625          * dump_scan will be called multiple times to break up the scan results
8626          * into multiple messages.  It is unlikely that any more bss-es will be
8627          * expired after the first call, so only call only call this on the
8628          * first dump_scan invocation.
8629          */
8630         if (start == 0)
8631                 cfg80211_bss_expire(rdev);
8632
8633         cb->seq = rdev->bss_generation;
8634
8635         list_for_each_entry(scan, &rdev->bss_list, list) {
8636                 if (++idx <= start)
8637                         continue;
8638                 if (nl80211_send_bss(skb, cb,
8639                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8640                                 rdev, wdev, scan) < 0) {
8641                         idx--;
8642                         break;
8643                 }
8644         }
8645
8646         spin_unlock_bh(&rdev->bss_lock);
8647         wdev_unlock(wdev);
8648
8649         cb->args[2] = idx;
8650         rtnl_unlock();
8651
8652         return skb->len;
8653 }
8654
8655 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
8656                                int flags, struct net_device *dev,
8657                                bool allow_radio_stats,
8658                                struct survey_info *survey)
8659 {
8660         void *hdr;
8661         struct nlattr *infoattr;
8662
8663         /* skip radio stats if userspace didn't request them */
8664         if (!survey->channel && !allow_radio_stats)
8665                 return 0;
8666
8667         hdr = nl80211hdr_put(msg, portid, seq, flags,
8668                              NL80211_CMD_NEW_SURVEY_RESULTS);
8669         if (!hdr)
8670                 return -ENOMEM;
8671
8672         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
8673                 goto nla_put_failure;
8674
8675         infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO);
8676         if (!infoattr)
8677                 goto nla_put_failure;
8678
8679         if (survey->channel &&
8680             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
8681                         survey->channel->center_freq))
8682                 goto nla_put_failure;
8683
8684         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
8685             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
8686                 goto nla_put_failure;
8687         if ((survey->filled & SURVEY_INFO_IN_USE) &&
8688             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
8689                 goto nla_put_failure;
8690         if ((survey->filled & SURVEY_INFO_TIME) &&
8691             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
8692                         survey->time, NL80211_SURVEY_INFO_PAD))
8693                 goto nla_put_failure;
8694         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
8695             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
8696                               survey->time_busy, NL80211_SURVEY_INFO_PAD))
8697                 goto nla_put_failure;
8698         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
8699             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
8700                               survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
8701                 goto nla_put_failure;
8702         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
8703             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
8704                               survey->time_rx, NL80211_SURVEY_INFO_PAD))
8705                 goto nla_put_failure;
8706         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
8707             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
8708                               survey->time_tx, NL80211_SURVEY_INFO_PAD))
8709                 goto nla_put_failure;
8710         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
8711             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
8712                               survey->time_scan, NL80211_SURVEY_INFO_PAD))
8713                 goto nla_put_failure;
8714
8715         nla_nest_end(msg, infoattr);
8716
8717         genlmsg_end(msg, hdr);
8718         return 0;
8719
8720  nla_put_failure:
8721         genlmsg_cancel(msg, hdr);
8722         return -EMSGSIZE;
8723 }
8724
8725 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
8726 {
8727         struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
8728         struct survey_info survey;
8729         struct cfg80211_registered_device *rdev;
8730         struct wireless_dev *wdev;
8731         int survey_idx = cb->args[2];
8732         int res;
8733         bool radio_stats;
8734
8735         rtnl_lock();
8736         res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
8737         if (res)
8738                 goto out_err;
8739
8740         /* prepare_wdev_dump parsed the attributes */
8741         radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
8742
8743         if (!wdev->netdev) {
8744                 res = -EINVAL;
8745                 goto out_err;
8746         }
8747
8748         if (!rdev->ops->dump_survey) {
8749                 res = -EOPNOTSUPP;
8750                 goto out_err;
8751         }
8752
8753         while (1) {
8754                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
8755                 if (res == -ENOENT)
8756                         break;
8757                 if (res)
8758                         goto out_err;
8759
8760                 /* don't send disabled channels, but do send non-channel data */
8761                 if (survey.channel &&
8762                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
8763                         survey_idx++;
8764                         continue;
8765                 }
8766
8767                 if (nl80211_send_survey(skb,
8768                                 NETLINK_CB(cb->skb).portid,
8769                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8770                                 wdev->netdev, radio_stats, &survey) < 0)
8771                         goto out;
8772                 survey_idx++;
8773         }
8774
8775  out:
8776         cb->args[2] = survey_idx;
8777         res = skb->len;
8778  out_err:
8779         rtnl_unlock();
8780         return res;
8781 }
8782
8783 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
8784 {
8785         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
8786                                   NL80211_WPA_VERSION_2 |
8787                                   NL80211_WPA_VERSION_3));
8788 }
8789
8790 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
8791 {
8792         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8793         struct net_device *dev = info->user_ptr[1];
8794         struct ieee80211_channel *chan;
8795         const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL;
8796         int err, ssid_len, ie_len = 0, auth_data_len = 0;
8797         enum nl80211_auth_type auth_type;
8798         struct key_parse key;
8799         bool local_state_change;
8800
8801         if (!info->attrs[NL80211_ATTR_MAC])
8802                 return -EINVAL;
8803
8804         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
8805                 return -EINVAL;
8806
8807         if (!info->attrs[NL80211_ATTR_SSID])
8808                 return -EINVAL;
8809
8810         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
8811                 return -EINVAL;
8812
8813         err = nl80211_parse_key(info, &key);
8814         if (err)
8815                 return err;
8816
8817         if (key.idx >= 0) {
8818                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
8819                         return -EINVAL;
8820                 if (!key.p.key || !key.p.key_len)
8821                         return -EINVAL;
8822                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
8823                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
8824                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
8825                      key.p.key_len != WLAN_KEY_LEN_WEP104))
8826                         return -EINVAL;
8827                 if (key.idx > 3)
8828                         return -EINVAL;
8829         } else {
8830                 key.p.key_len = 0;
8831                 key.p.key = NULL;
8832         }
8833
8834         if (key.idx >= 0) {
8835                 int i;
8836                 bool ok = false;
8837
8838                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
8839                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
8840                                 ok = true;
8841                                 break;
8842                         }
8843                 }
8844                 if (!ok)
8845                         return -EINVAL;
8846         }
8847
8848         if (!rdev->ops->auth)
8849                 return -EOPNOTSUPP;
8850
8851         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8852             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8853                 return -EOPNOTSUPP;
8854
8855         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8856         chan = nl80211_get_valid_chan(&rdev->wiphy,
8857                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8858         if (!chan)
8859                 return -EINVAL;
8860
8861         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8862         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8863
8864         if (info->attrs[NL80211_ATTR_IE]) {
8865                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8866                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8867         }
8868
8869         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8870         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
8871                 return -EINVAL;
8872
8873         if ((auth_type == NL80211_AUTHTYPE_SAE ||
8874              auth_type == NL80211_AUTHTYPE_FILS_SK ||
8875              auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
8876              auth_type == NL80211_AUTHTYPE_FILS_PK) &&
8877             !info->attrs[NL80211_ATTR_AUTH_DATA])
8878                 return -EINVAL;
8879
8880         if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
8881                 if (auth_type != NL80211_AUTHTYPE_SAE &&
8882                     auth_type != NL80211_AUTHTYPE_FILS_SK &&
8883                     auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
8884                     auth_type != NL80211_AUTHTYPE_FILS_PK)
8885                         return -EINVAL;
8886                 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
8887                 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
8888                 /* need to include at least Auth Transaction and Status Code */
8889                 if (auth_data_len < 4)
8890                         return -EINVAL;
8891         }
8892
8893         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8894
8895         /*
8896          * Since we no longer track auth state, ignore
8897          * requests to only change local state.
8898          */
8899         if (local_state_change)
8900                 return 0;
8901
8902         wdev_lock(dev->ieee80211_ptr);
8903         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
8904                                  ssid, ssid_len, ie, ie_len,
8905                                  key.p.key, key.p.key_len, key.idx,
8906                                  auth_data, auth_data_len);
8907         wdev_unlock(dev->ieee80211_ptr);
8908         return err;
8909 }
8910
8911 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
8912                                      struct genl_info *info)
8913 {
8914         if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8915                 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
8916                 return -EINVAL;
8917         }
8918
8919         if (!rdev->ops->tx_control_port ||
8920             !wiphy_ext_feature_isset(&rdev->wiphy,
8921                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
8922                 return -EOPNOTSUPP;
8923
8924         return 0;
8925 }
8926
8927 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
8928                                    struct genl_info *info,
8929                                    struct cfg80211_crypto_settings *settings,
8930                                    int cipher_limit)
8931 {
8932         memset(settings, 0, sizeof(*settings));
8933
8934         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
8935
8936         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
8937                 u16 proto;
8938
8939                 proto = nla_get_u16(
8940                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
8941                 settings->control_port_ethertype = cpu_to_be16(proto);
8942                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
8943                     proto != ETH_P_PAE)
8944                         return -EINVAL;
8945                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
8946                         settings->control_port_no_encrypt = true;
8947         } else
8948                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
8949
8950         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
8951                 int r = validate_pae_over_nl80211(rdev, info);
8952
8953                 if (r < 0)
8954                         return r;
8955
8956                 settings->control_port_over_nl80211 = true;
8957         }
8958
8959         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
8960                 void *data;
8961                 int len, i;
8962
8963                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8964                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8965                 settings->n_ciphers_pairwise = len / sizeof(u32);
8966
8967                 if (len % sizeof(u32))
8968                         return -EINVAL;
8969
8970                 if (settings->n_ciphers_pairwise > cipher_limit)
8971                         return -EINVAL;
8972
8973                 memcpy(settings->ciphers_pairwise, data, len);
8974
8975                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
8976                         if (!cfg80211_supported_cipher_suite(
8977                                         &rdev->wiphy,
8978                                         settings->ciphers_pairwise[i]))
8979                                 return -EINVAL;
8980         }
8981
8982         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
8983                 settings->cipher_group =
8984                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
8985                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
8986                                                      settings->cipher_group))
8987                         return -EINVAL;
8988         }
8989
8990         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
8991                 settings->wpa_versions =
8992                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
8993                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
8994                         return -EINVAL;
8995         }
8996
8997         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
8998                 void *data;
8999                 int len;
9000
9001                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
9002                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
9003                 settings->n_akm_suites = len / sizeof(u32);
9004
9005                 if (len % sizeof(u32))
9006                         return -EINVAL;
9007
9008                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
9009                         return -EINVAL;
9010
9011                 memcpy(settings->akm_suites, data, len);
9012         }
9013
9014         if (info->attrs[NL80211_ATTR_PMK]) {
9015                 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
9016                         return -EINVAL;
9017                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
9018                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK))
9019                         return -EINVAL;
9020                 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
9021         }
9022
9023         if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) {
9024                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
9025                                              NL80211_EXT_FEATURE_SAE_OFFLOAD))
9026                         return -EINVAL;
9027                 settings->sae_pwd =
9028                         nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
9029                 settings->sae_pwd_len =
9030                         nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
9031         }
9032
9033         return 0;
9034 }
9035
9036 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
9037 {
9038         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9039         struct net_device *dev = info->user_ptr[1];
9040         struct ieee80211_channel *chan;
9041         struct cfg80211_assoc_request req = {};
9042         const u8 *bssid, *ssid;
9043         int err, ssid_len = 0;
9044
9045         if (dev->ieee80211_ptr->conn_owner_nlportid &&
9046             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9047                 return -EPERM;
9048
9049         if (!info->attrs[NL80211_ATTR_MAC] ||
9050             !info->attrs[NL80211_ATTR_SSID] ||
9051             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
9052                 return -EINVAL;
9053
9054         if (!rdev->ops->assoc)
9055                 return -EOPNOTSUPP;
9056
9057         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9058             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9059                 return -EOPNOTSUPP;
9060
9061         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9062
9063         chan = nl80211_get_valid_chan(&rdev->wiphy,
9064                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
9065         if (!chan)
9066                 return -EINVAL;
9067
9068         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9069         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9070
9071         if (info->attrs[NL80211_ATTR_IE]) {
9072                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9073                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9074         }
9075
9076         if (info->attrs[NL80211_ATTR_USE_MFP]) {
9077                 enum nl80211_mfp mfp =
9078                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
9079                 if (mfp == NL80211_MFP_REQUIRED)
9080                         req.use_mfp = true;
9081                 else if (mfp != NL80211_MFP_NO)
9082                         return -EINVAL;
9083         }
9084
9085         if (info->attrs[NL80211_ATTR_PREV_BSSID])
9086                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
9087
9088         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
9089                 req.flags |= ASSOC_REQ_DISABLE_HT;
9090
9091         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9092                 memcpy(&req.ht_capa_mask,
9093                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
9094                        sizeof(req.ht_capa_mask));
9095
9096         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9097                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9098                         return -EINVAL;
9099                 memcpy(&req.ht_capa,
9100                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9101                        sizeof(req.ht_capa));
9102         }
9103
9104         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
9105                 req.flags |= ASSOC_REQ_DISABLE_VHT;
9106
9107         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
9108                 memcpy(&req.vht_capa_mask,
9109                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
9110                        sizeof(req.vht_capa_mask));
9111
9112         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
9113                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
9114                         return -EINVAL;
9115                 memcpy(&req.vht_capa,
9116                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
9117                        sizeof(req.vht_capa));
9118         }
9119
9120         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
9121                 if (!((rdev->wiphy.features &
9122                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
9123                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
9124                     !wiphy_ext_feature_isset(&rdev->wiphy,
9125                                              NL80211_EXT_FEATURE_RRM))
9126                         return -EINVAL;
9127                 req.flags |= ASSOC_REQ_USE_RRM;
9128         }
9129
9130         if (info->attrs[NL80211_ATTR_FILS_KEK]) {
9131                 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
9132                 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
9133                 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
9134                         return -EINVAL;
9135                 req.fils_nonces =
9136                         nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
9137         }
9138
9139         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
9140         if (!err) {
9141                 wdev_lock(dev->ieee80211_ptr);
9142
9143                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
9144                                           ssid, ssid_len, &req);
9145
9146                 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9147                         dev->ieee80211_ptr->conn_owner_nlportid =
9148                                 info->snd_portid;
9149                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
9150                                bssid, ETH_ALEN);
9151                 }
9152
9153                 wdev_unlock(dev->ieee80211_ptr);
9154         }
9155
9156         return err;
9157 }
9158
9159 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
9160 {
9161         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9162         struct net_device *dev = info->user_ptr[1];
9163         const u8 *ie = NULL, *bssid;
9164         int ie_len = 0, err;
9165         u16 reason_code;
9166         bool local_state_change;
9167
9168         if (dev->ieee80211_ptr->conn_owner_nlportid &&
9169             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9170                 return -EPERM;
9171
9172         if (!info->attrs[NL80211_ATTR_MAC])
9173                 return -EINVAL;
9174
9175         if (!info->attrs[NL80211_ATTR_REASON_CODE])
9176                 return -EINVAL;
9177
9178         if (!rdev->ops->deauth)
9179                 return -EOPNOTSUPP;
9180
9181         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9182             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9183                 return -EOPNOTSUPP;
9184
9185         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9186
9187         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9188         if (reason_code == 0) {
9189                 /* Reason Code 0 is reserved */
9190                 return -EINVAL;
9191         }
9192
9193         if (info->attrs[NL80211_ATTR_IE]) {
9194                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9195                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9196         }
9197
9198         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
9199
9200         wdev_lock(dev->ieee80211_ptr);
9201         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
9202                                    local_state_change);
9203         wdev_unlock(dev->ieee80211_ptr);
9204         return err;
9205 }
9206
9207 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
9208 {
9209         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9210         struct net_device *dev = info->user_ptr[1];
9211         const u8 *ie = NULL, *bssid;
9212         int ie_len = 0, err;
9213         u16 reason_code;
9214         bool local_state_change;
9215
9216         if (dev->ieee80211_ptr->conn_owner_nlportid &&
9217             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9218                 return -EPERM;
9219
9220         if (!info->attrs[NL80211_ATTR_MAC])
9221                 return -EINVAL;
9222
9223         if (!info->attrs[NL80211_ATTR_REASON_CODE])
9224                 return -EINVAL;
9225
9226         if (!rdev->ops->disassoc)
9227                 return -EOPNOTSUPP;
9228
9229         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9230             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9231                 return -EOPNOTSUPP;
9232
9233         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9234
9235         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9236         if (reason_code == 0) {
9237                 /* Reason Code 0 is reserved */
9238                 return -EINVAL;
9239         }
9240
9241         if (info->attrs[NL80211_ATTR_IE]) {
9242                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9243                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9244         }
9245
9246         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
9247
9248         wdev_lock(dev->ieee80211_ptr);
9249         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
9250                                      local_state_change);
9251         wdev_unlock(dev->ieee80211_ptr);
9252         return err;
9253 }
9254
9255 static bool
9256 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
9257                          int mcast_rate[NUM_NL80211_BANDS],
9258                          int rateval)
9259 {
9260         struct wiphy *wiphy = &rdev->wiphy;
9261         bool found = false;
9262         int band, i;
9263
9264         for (band = 0; band < NUM_NL80211_BANDS; band++) {
9265                 struct ieee80211_supported_band *sband;
9266
9267                 sband = wiphy->bands[band];
9268                 if (!sband)
9269                         continue;
9270
9271                 for (i = 0; i < sband->n_bitrates; i++) {
9272                         if (sband->bitrates[i].bitrate == rateval) {
9273                                 mcast_rate[band] = i + 1;
9274                                 found = true;
9275                                 break;
9276                         }
9277                 }
9278         }
9279
9280         return found;
9281 }
9282
9283 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
9284 {
9285         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9286         struct net_device *dev = info->user_ptr[1];
9287         struct cfg80211_ibss_params ibss;
9288         struct wiphy *wiphy;
9289         struct cfg80211_cached_keys *connkeys = NULL;
9290         int err;
9291
9292         memset(&ibss, 0, sizeof(ibss));
9293
9294         if (!info->attrs[NL80211_ATTR_SSID] ||
9295             !nla_len(info->attrs[NL80211_ATTR_SSID]))
9296                 return -EINVAL;
9297
9298         ibss.beacon_interval = 100;
9299
9300         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
9301                 ibss.beacon_interval =
9302                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
9303
9304         err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
9305                                            ibss.beacon_interval);
9306         if (err)
9307                 return err;
9308
9309         if (!rdev->ops->join_ibss)
9310                 return -EOPNOTSUPP;
9311
9312         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
9313                 return -EOPNOTSUPP;
9314
9315         wiphy = &rdev->wiphy;
9316
9317         if (info->attrs[NL80211_ATTR_MAC]) {
9318                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9319
9320                 if (!is_valid_ether_addr(ibss.bssid))
9321                         return -EINVAL;
9322         }
9323         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9324         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9325
9326         if (info->attrs[NL80211_ATTR_IE]) {
9327                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9328                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9329         }
9330
9331         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
9332         if (err)
9333                 return err;
9334
9335         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
9336                                      NL80211_IFTYPE_ADHOC))
9337                 return -EINVAL;
9338
9339         switch (ibss.chandef.width) {
9340         case NL80211_CHAN_WIDTH_5:
9341         case NL80211_CHAN_WIDTH_10:
9342         case NL80211_CHAN_WIDTH_20_NOHT:
9343                 break;
9344         case NL80211_CHAN_WIDTH_20:
9345         case NL80211_CHAN_WIDTH_40:
9346                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
9347                         return -EINVAL;
9348                 break;
9349         case NL80211_CHAN_WIDTH_80:
9350         case NL80211_CHAN_WIDTH_80P80:
9351         case NL80211_CHAN_WIDTH_160:
9352                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
9353                         return -EINVAL;
9354                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
9355                                              NL80211_EXT_FEATURE_VHT_IBSS))
9356                         return -EINVAL;
9357                 break;
9358         default:
9359                 return -EINVAL;
9360         }
9361
9362         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
9363         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
9364
9365         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
9366                 u8 *rates =
9367                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9368                 int n_rates =
9369                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9370                 struct ieee80211_supported_band *sband =
9371                         wiphy->bands[ibss.chandef.chan->band];
9372
9373                 err = ieee80211_get_ratemask(sband, rates, n_rates,
9374                                              &ibss.basic_rates);
9375                 if (err)
9376                         return err;
9377         }
9378
9379         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9380                 memcpy(&ibss.ht_capa_mask,
9381                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
9382                        sizeof(ibss.ht_capa_mask));
9383
9384         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9385                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9386                         return -EINVAL;
9387                 memcpy(&ibss.ht_capa,
9388                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9389                        sizeof(ibss.ht_capa));
9390         }
9391
9392         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
9393             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
9394                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
9395                 return -EINVAL;
9396
9397         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
9398                 bool no_ht = false;
9399
9400                 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
9401                 if (IS_ERR(connkeys))
9402                         return PTR_ERR(connkeys);
9403
9404                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
9405                     no_ht) {
9406                         kzfree(connkeys);
9407                         return -EINVAL;
9408                 }
9409         }
9410
9411         ibss.control_port =
9412                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
9413
9414         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
9415                 int r = validate_pae_over_nl80211(rdev, info);
9416
9417                 if (r < 0) {
9418                         kzfree(connkeys);
9419                         return r;
9420                 }
9421
9422                 ibss.control_port_over_nl80211 = true;
9423         }
9424
9425         ibss.userspace_handles_dfs =
9426                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
9427
9428         wdev_lock(dev->ieee80211_ptr);
9429         err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
9430         if (err)
9431                 kzfree(connkeys);
9432         else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
9433                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
9434         wdev_unlock(dev->ieee80211_ptr);
9435
9436         return err;
9437 }
9438
9439 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
9440 {
9441         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9442         struct net_device *dev = info->user_ptr[1];
9443
9444         if (!rdev->ops->leave_ibss)
9445                 return -EOPNOTSUPP;
9446
9447         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
9448                 return -EOPNOTSUPP;
9449
9450         return cfg80211_leave_ibss(rdev, dev, false);
9451 }
9452
9453 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
9454 {
9455         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9456         struct net_device *dev = info->user_ptr[1];
9457         int mcast_rate[NUM_NL80211_BANDS];
9458         u32 nla_rate;
9459         int err;
9460
9461         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
9462             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
9463             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
9464                 return -EOPNOTSUPP;
9465
9466         if (!rdev->ops->set_mcast_rate)
9467                 return -EOPNOTSUPP;
9468
9469         memset(mcast_rate, 0, sizeof(mcast_rate));
9470
9471         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
9472                 return -EINVAL;
9473
9474         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
9475         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
9476                 return -EINVAL;
9477
9478         err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
9479
9480         return err;
9481 }
9482
9483 static struct sk_buff *
9484 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
9485                             struct wireless_dev *wdev, int approxlen,
9486                             u32 portid, u32 seq, enum nl80211_commands cmd,
9487                             enum nl80211_attrs attr,
9488                             const struct nl80211_vendor_cmd_info *info,
9489                             gfp_t gfp)
9490 {
9491         struct sk_buff *skb;
9492         void *hdr;
9493         struct nlattr *data;
9494
9495         skb = nlmsg_new(approxlen + 100, gfp);
9496         if (!skb)
9497                 return NULL;
9498
9499         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
9500         if (!hdr) {
9501                 kfree_skb(skb);
9502                 return NULL;
9503         }
9504
9505         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
9506                 goto nla_put_failure;
9507
9508         if (info) {
9509                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
9510                                 info->vendor_id))
9511                         goto nla_put_failure;
9512                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
9513                                 info->subcmd))
9514                         goto nla_put_failure;
9515         }
9516
9517         if (wdev) {
9518                 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
9519                                       wdev_id(wdev), NL80211_ATTR_PAD))
9520                         goto nla_put_failure;
9521                 if (wdev->netdev &&
9522                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
9523                                 wdev->netdev->ifindex))
9524                         goto nla_put_failure;
9525         }
9526
9527         data = nla_nest_start_noflag(skb, attr);
9528         if (!data)
9529                 goto nla_put_failure;
9530
9531         ((void **)skb->cb)[0] = rdev;
9532         ((void **)skb->cb)[1] = hdr;
9533         ((void **)skb->cb)[2] = data;
9534
9535         return skb;
9536
9537  nla_put_failure:
9538         kfree_skb(skb);
9539         return NULL;
9540 }
9541
9542 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
9543                                            struct wireless_dev *wdev,
9544                                            enum nl80211_commands cmd,
9545                                            enum nl80211_attrs attr,
9546                                            unsigned int portid,
9547                                            int vendor_event_idx,
9548                                            int approxlen, gfp_t gfp)
9549 {
9550         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
9551         const struct nl80211_vendor_cmd_info *info;
9552
9553         switch (cmd) {
9554         case NL80211_CMD_TESTMODE:
9555                 if (WARN_ON(vendor_event_idx != -1))
9556                         return NULL;
9557                 info = NULL;
9558                 break;
9559         case NL80211_CMD_VENDOR:
9560                 if (WARN_ON(vendor_event_idx < 0 ||
9561                             vendor_event_idx >= wiphy->n_vendor_events))
9562                         return NULL;
9563                 info = &wiphy->vendor_events[vendor_event_idx];
9564                 break;
9565         default:
9566                 WARN_ON(1);
9567                 return NULL;
9568         }
9569
9570         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0,
9571                                            cmd, attr, info, gfp);
9572 }
9573 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
9574
9575 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
9576 {
9577         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
9578         void *hdr = ((void **)skb->cb)[1];
9579         struct nlmsghdr *nlhdr = nlmsg_hdr(skb);
9580         struct nlattr *data = ((void **)skb->cb)[2];
9581         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
9582
9583         /* clear CB data for netlink core to own from now on */
9584         memset(skb->cb, 0, sizeof(skb->cb));
9585
9586         nla_nest_end(skb, data);
9587         genlmsg_end(skb, hdr);
9588
9589         if (nlhdr->nlmsg_pid) {
9590                 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb,
9591                                 nlhdr->nlmsg_pid);
9592         } else {
9593                 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
9594                         mcgrp = NL80211_MCGRP_VENDOR;
9595
9596                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
9597                                         skb, 0, mcgrp, gfp);
9598         }
9599 }
9600 EXPORT_SYMBOL(__cfg80211_send_event_skb);
9601
9602 #ifdef CONFIG_NL80211_TESTMODE
9603 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
9604 {
9605         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9606         struct wireless_dev *wdev =
9607                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
9608         int err;
9609
9610         if (!rdev->ops->testmode_cmd)
9611                 return -EOPNOTSUPP;
9612
9613         if (IS_ERR(wdev)) {
9614                 err = PTR_ERR(wdev);
9615                 if (err != -EINVAL)
9616                         return err;
9617                 wdev = NULL;
9618         } else if (wdev->wiphy != &rdev->wiphy) {
9619                 return -EINVAL;
9620         }
9621
9622         if (!info->attrs[NL80211_ATTR_TESTDATA])
9623                 return -EINVAL;
9624
9625         rdev->cur_cmd_info = info;
9626         err = rdev_testmode_cmd(rdev, wdev,
9627                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
9628                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
9629         rdev->cur_cmd_info = NULL;
9630
9631         return err;
9632 }
9633
9634 static int nl80211_testmode_dump(struct sk_buff *skb,
9635                                  struct netlink_callback *cb)
9636 {
9637         struct cfg80211_registered_device *rdev;
9638         int err;
9639         long phy_idx;
9640         void *data = NULL;
9641         int data_len = 0;
9642
9643         rtnl_lock();
9644
9645         if (cb->args[0]) {
9646                 /*
9647                  * 0 is a valid index, but not valid for args[0],
9648                  * so we need to offset by 1.
9649                  */
9650                 phy_idx = cb->args[0] - 1;
9651
9652                 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
9653                 if (!rdev) {
9654                         err = -ENOENT;
9655                         goto out_err;
9656                 }
9657         } else {
9658                 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
9659
9660                 err = nlmsg_parse_deprecated(cb->nlh,
9661                                              GENL_HDRLEN + nl80211_fam.hdrsize,
9662                                              attrbuf, nl80211_fam.maxattr,
9663                                              nl80211_policy, NULL);
9664                 if (err)
9665                         goto out_err;
9666
9667                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
9668                 if (IS_ERR(rdev)) {
9669                         err = PTR_ERR(rdev);
9670                         goto out_err;
9671                 }
9672                 phy_idx = rdev->wiphy_idx;
9673
9674                 if (attrbuf[NL80211_ATTR_TESTDATA])
9675                         cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
9676         }
9677
9678         if (cb->args[1]) {
9679                 data = nla_data((void *)cb->args[1]);
9680                 data_len = nla_len((void *)cb->args[1]);
9681         }
9682
9683         if (!rdev->ops->testmode_dump) {
9684                 err = -EOPNOTSUPP;
9685                 goto out_err;
9686         }
9687
9688         while (1) {
9689                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
9690                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
9691                                            NL80211_CMD_TESTMODE);
9692                 struct nlattr *tmdata;
9693
9694                 if (!hdr)
9695                         break;
9696
9697                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
9698                         genlmsg_cancel(skb, hdr);
9699                         break;
9700                 }
9701
9702                 tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA);
9703                 if (!tmdata) {
9704                         genlmsg_cancel(skb, hdr);
9705                         break;
9706                 }
9707                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
9708                 nla_nest_end(skb, tmdata);
9709
9710                 if (err == -ENOBUFS || err == -ENOENT) {
9711                         genlmsg_cancel(skb, hdr);
9712                         break;
9713                 } else if (err) {
9714                         genlmsg_cancel(skb, hdr);
9715                         goto out_err;
9716                 }
9717
9718                 genlmsg_end(skb, hdr);
9719         }
9720
9721         err = skb->len;
9722         /* see above */
9723         cb->args[0] = phy_idx + 1;
9724  out_err:
9725         rtnl_unlock();
9726         return err;
9727 }
9728 #endif
9729
9730 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
9731 {
9732         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9733         struct net_device *dev = info->user_ptr[1];
9734         struct cfg80211_connect_params connect;
9735         struct wiphy *wiphy;
9736         struct cfg80211_cached_keys *connkeys = NULL;
9737         int err;
9738
9739         memset(&connect, 0, sizeof(connect));
9740
9741         if (!info->attrs[NL80211_ATTR_SSID] ||
9742             !nla_len(info->attrs[NL80211_ATTR_SSID]))
9743                 return -EINVAL;
9744
9745         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
9746                 connect.auth_type =
9747                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9748                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
9749                                              NL80211_CMD_CONNECT))
9750                         return -EINVAL;
9751         } else
9752                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
9753
9754         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
9755
9756         if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
9757             !wiphy_ext_feature_isset(&rdev->wiphy,
9758                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
9759                 return -EINVAL;
9760         connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
9761
9762         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
9763                                       NL80211_MAX_NR_CIPHER_SUITES);
9764         if (err)
9765                 return err;
9766
9767         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9768             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9769                 return -EOPNOTSUPP;
9770
9771         wiphy = &rdev->wiphy;
9772
9773         connect.bg_scan_period = -1;
9774         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
9775                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
9776                 connect.bg_scan_period =
9777                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
9778         }
9779
9780         if (info->attrs[NL80211_ATTR_MAC])
9781                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9782         else if (info->attrs[NL80211_ATTR_MAC_HINT])
9783                 connect.bssid_hint =
9784                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
9785         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9786         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9787
9788         if (info->attrs[NL80211_ATTR_IE]) {
9789                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9790                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9791         }
9792
9793         if (info->attrs[NL80211_ATTR_USE_MFP]) {
9794                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
9795                 if (connect.mfp == NL80211_MFP_OPTIONAL &&
9796                     !wiphy_ext_feature_isset(&rdev->wiphy,
9797                                              NL80211_EXT_FEATURE_MFP_OPTIONAL))
9798                         return -EOPNOTSUPP;
9799         } else {
9800                 connect.mfp = NL80211_MFP_NO;
9801         }
9802
9803         if (info->attrs[NL80211_ATTR_PREV_BSSID])
9804                 connect.prev_bssid =
9805                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
9806
9807         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9808                 connect.channel = nl80211_get_valid_chan(
9809                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
9810                 if (!connect.channel)
9811                         return -EINVAL;
9812         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
9813                 connect.channel_hint = nl80211_get_valid_chan(
9814                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
9815                 if (!connect.channel_hint)
9816                         return -EINVAL;
9817         }
9818
9819         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
9820                 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
9821                 if (IS_ERR(connkeys))
9822                         return PTR_ERR(connkeys);
9823         }
9824
9825         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
9826                 connect.flags |= ASSOC_REQ_DISABLE_HT;
9827
9828         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9829                 memcpy(&connect.ht_capa_mask,
9830                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
9831                        sizeof(connect.ht_capa_mask));
9832
9833         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9834                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
9835                         kzfree(connkeys);
9836                         return -EINVAL;
9837                 }
9838                 memcpy(&connect.ht_capa,
9839                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9840                        sizeof(connect.ht_capa));
9841         }
9842
9843         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
9844                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
9845
9846         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
9847                 memcpy(&connect.vht_capa_mask,
9848                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
9849                        sizeof(connect.vht_capa_mask));
9850
9851         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
9852                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
9853                         kzfree(connkeys);
9854                         return -EINVAL;
9855                 }
9856                 memcpy(&connect.vht_capa,
9857                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
9858                        sizeof(connect.vht_capa));
9859         }
9860
9861         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
9862                 if (!((rdev->wiphy.features &
9863                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
9864                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
9865                     !wiphy_ext_feature_isset(&rdev->wiphy,
9866                                              NL80211_EXT_FEATURE_RRM)) {
9867                         kzfree(connkeys);
9868                         return -EINVAL;
9869                 }
9870                 connect.flags |= ASSOC_REQ_USE_RRM;
9871         }
9872
9873         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
9874         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
9875                 kzfree(connkeys);
9876                 return -EOPNOTSUPP;
9877         }
9878
9879         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
9880                 /* bss selection makes no sense if bssid is set */
9881                 if (connect.bssid) {
9882                         kzfree(connkeys);
9883                         return -EINVAL;
9884                 }
9885
9886                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
9887                                        wiphy, &connect.bss_select);
9888                 if (err) {
9889                         kzfree(connkeys);
9890                         return err;
9891                 }
9892         }
9893
9894         if (wiphy_ext_feature_isset(&rdev->wiphy,
9895                                     NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
9896             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
9897             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
9898             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
9899             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9900                 connect.fils_erp_username =
9901                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9902                 connect.fils_erp_username_len =
9903                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9904                 connect.fils_erp_realm =
9905                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9906                 connect.fils_erp_realm_len =
9907                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9908                 connect.fils_erp_next_seq_num =
9909                         nla_get_u16(
9910                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
9911                 connect.fils_erp_rrk =
9912                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9913                 connect.fils_erp_rrk_len =
9914                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9915         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
9916                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
9917                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
9918                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9919                 kzfree(connkeys);
9920                 return -EINVAL;
9921         }
9922
9923         if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
9924                 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9925                         kzfree(connkeys);
9926                         GENL_SET_ERR_MSG(info,
9927                                          "external auth requires connection ownership");
9928                         return -EINVAL;
9929                 }
9930                 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
9931         }
9932
9933         wdev_lock(dev->ieee80211_ptr);
9934
9935         err = cfg80211_connect(rdev, dev, &connect, connkeys,
9936                                connect.prev_bssid);
9937         if (err)
9938                 kzfree(connkeys);
9939
9940         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9941                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
9942                 if (connect.bssid)
9943                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
9944                                connect.bssid, ETH_ALEN);
9945                 else
9946                         memset(dev->ieee80211_ptr->disconnect_bssid,
9947                                0, ETH_ALEN);
9948         }
9949
9950         wdev_unlock(dev->ieee80211_ptr);
9951
9952         return err;
9953 }
9954
9955 static int nl80211_update_connect_params(struct sk_buff *skb,
9956                                          struct genl_info *info)
9957 {
9958         struct cfg80211_connect_params connect = {};
9959         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9960         struct net_device *dev = info->user_ptr[1];
9961         struct wireless_dev *wdev = dev->ieee80211_ptr;
9962         bool fils_sk_offload;
9963         u32 auth_type;
9964         u32 changed = 0;
9965         int ret;
9966
9967         if (!rdev->ops->update_connect_params)
9968                 return -EOPNOTSUPP;
9969
9970         if (info->attrs[NL80211_ATTR_IE]) {
9971                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9972                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9973                 changed |= UPDATE_ASSOC_IES;
9974         }
9975
9976         fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
9977                                                   NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
9978
9979         /*
9980          * when driver supports fils-sk offload all attributes must be
9981          * provided. So the else covers "fils-sk-not-all" and
9982          * "no-fils-sk-any".
9983          */
9984         if (fils_sk_offload &&
9985             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
9986             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
9987             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
9988             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9989                 connect.fils_erp_username =
9990                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9991                 connect.fils_erp_username_len =
9992                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9993                 connect.fils_erp_realm =
9994                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9995                 connect.fils_erp_realm_len =
9996                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9997                 connect.fils_erp_next_seq_num =
9998                         nla_get_u16(
9999                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
10000                 connect.fils_erp_rrk =
10001                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
10002                 connect.fils_erp_rrk_len =
10003                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
10004                 changed |= UPDATE_FILS_ERP_INFO;
10005         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
10006                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
10007                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
10008                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
10009                 return -EINVAL;
10010         }
10011
10012         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
10013                 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
10014                 if (!nl80211_valid_auth_type(rdev, auth_type,
10015                                              NL80211_CMD_CONNECT))
10016                         return -EINVAL;
10017
10018                 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
10019                     fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
10020                         return -EINVAL;
10021
10022                 connect.auth_type = auth_type;
10023                 changed |= UPDATE_AUTH_TYPE;
10024         }
10025
10026         wdev_lock(dev->ieee80211_ptr);
10027         if (!wdev->current_bss)
10028                 ret = -ENOLINK;
10029         else
10030                 ret = rdev_update_connect_params(rdev, dev, &connect, changed);
10031         wdev_unlock(dev->ieee80211_ptr);
10032
10033         return ret;
10034 }
10035
10036 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
10037 {
10038         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10039         struct net_device *dev = info->user_ptr[1];
10040         u16 reason;
10041         int ret;
10042
10043         if (dev->ieee80211_ptr->conn_owner_nlportid &&
10044             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
10045                 return -EPERM;
10046
10047         if (!info->attrs[NL80211_ATTR_REASON_CODE])
10048                 reason = WLAN_REASON_DEAUTH_LEAVING;
10049         else
10050                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
10051
10052         if (reason == 0)
10053                 return -EINVAL;
10054
10055         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10056             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10057                 return -EOPNOTSUPP;
10058
10059         wdev_lock(dev->ieee80211_ptr);
10060         ret = cfg80211_disconnect(rdev, dev, reason, true);
10061         wdev_unlock(dev->ieee80211_ptr);
10062         return ret;
10063 }
10064
10065 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
10066 {
10067         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10068         struct net *net;
10069         int err;
10070
10071         if (info->attrs[NL80211_ATTR_PID]) {
10072                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
10073
10074                 net = get_net_ns_by_pid(pid);
10075         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
10076                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
10077
10078                 net = get_net_ns_by_fd(fd);
10079         } else {
10080                 return -EINVAL;
10081         }
10082
10083         if (IS_ERR(net))
10084                 return PTR_ERR(net);
10085
10086         err = 0;
10087
10088         /* check if anything to do */
10089         if (!net_eq(wiphy_net(&rdev->wiphy), net))
10090                 err = cfg80211_switch_netns(rdev, net);
10091
10092         put_net(net);
10093         return err;
10094 }
10095
10096 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
10097 {
10098         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10099         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
10100                         struct cfg80211_pmksa *pmksa) = NULL;
10101         struct net_device *dev = info->user_ptr[1];
10102         struct cfg80211_pmksa pmksa;
10103
10104         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
10105
10106         if (!info->attrs[NL80211_ATTR_PMKID])
10107                 return -EINVAL;
10108
10109         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
10110
10111         if (info->attrs[NL80211_ATTR_MAC]) {
10112                 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10113         } else if (info->attrs[NL80211_ATTR_SSID] &&
10114                    info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
10115                    (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
10116                     info->attrs[NL80211_ATTR_PMK])) {
10117                 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10118                 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10119                 pmksa.cache_id =
10120                         nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
10121         } else {
10122                 return -EINVAL;
10123         }
10124         if (info->attrs[NL80211_ATTR_PMK]) {
10125                 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
10126                 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
10127         }
10128
10129         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10130             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
10131             !(dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP &&
10132               wiphy_ext_feature_isset(&rdev->wiphy,
10133                                       NL80211_EXT_FEATURE_AP_PMKSA_CACHING)))
10134                 return -EOPNOTSUPP;
10135
10136         switch (info->genlhdr->cmd) {
10137         case NL80211_CMD_SET_PMKSA:
10138                 rdev_ops = rdev->ops->set_pmksa;
10139                 break;
10140         case NL80211_CMD_DEL_PMKSA:
10141                 rdev_ops = rdev->ops->del_pmksa;
10142                 break;
10143         default:
10144                 WARN_ON(1);
10145                 break;
10146         }
10147
10148         if (!rdev_ops)
10149                 return -EOPNOTSUPP;
10150
10151         return rdev_ops(&rdev->wiphy, dev, &pmksa);
10152 }
10153
10154 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
10155 {
10156         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10157         struct net_device *dev = info->user_ptr[1];
10158
10159         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10160             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10161                 return -EOPNOTSUPP;
10162
10163         if (!rdev->ops->flush_pmksa)
10164                 return -EOPNOTSUPP;
10165
10166         return rdev_flush_pmksa(rdev, dev);
10167 }
10168
10169 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
10170 {
10171         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10172         struct net_device *dev = info->user_ptr[1];
10173         u8 action_code, dialog_token;
10174         u32 peer_capability = 0;
10175         u16 status_code;
10176         u8 *peer;
10177         bool initiator;
10178
10179         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
10180             !rdev->ops->tdls_mgmt)
10181                 return -EOPNOTSUPP;
10182
10183         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
10184             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
10185             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
10186             !info->attrs[NL80211_ATTR_IE] ||
10187             !info->attrs[NL80211_ATTR_MAC])
10188                 return -EINVAL;
10189
10190         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10191         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
10192         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
10193         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
10194         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
10195         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
10196                 peer_capability =
10197                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
10198
10199         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
10200                               dialog_token, status_code, peer_capability,
10201                               initiator,
10202                               nla_data(info->attrs[NL80211_ATTR_IE]),
10203                               nla_len(info->attrs[NL80211_ATTR_IE]));
10204 }
10205
10206 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
10207 {
10208         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10209         struct net_device *dev = info->user_ptr[1];
10210         enum nl80211_tdls_operation operation;
10211         u8 *peer;
10212
10213         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
10214             !rdev->ops->tdls_oper)
10215                 return -EOPNOTSUPP;
10216
10217         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
10218             !info->attrs[NL80211_ATTR_MAC])
10219                 return -EINVAL;
10220
10221         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
10222         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10223
10224         return rdev_tdls_oper(rdev, dev, peer, operation);
10225 }
10226
10227 static int nl80211_remain_on_channel(struct sk_buff *skb,
10228                                      struct genl_info *info)
10229 {
10230         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10231         struct wireless_dev *wdev = info->user_ptr[1];
10232         struct cfg80211_chan_def chandef;
10233         const struct cfg80211_chan_def *compat_chandef;
10234         struct sk_buff *msg;
10235         void *hdr;
10236         u64 cookie;
10237         u32 duration;
10238         int err;
10239
10240         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
10241             !info->attrs[NL80211_ATTR_DURATION])
10242                 return -EINVAL;
10243
10244         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
10245
10246         if (!rdev->ops->remain_on_channel ||
10247             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
10248                 return -EOPNOTSUPP;
10249
10250         /*
10251          * We should be on that channel for at least a minimum amount of
10252          * time (10ms) but no longer than the driver supports.
10253          */
10254         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
10255             duration > rdev->wiphy.max_remain_on_channel_duration)
10256                 return -EINVAL;
10257
10258         err = nl80211_parse_chandef(rdev, info, &chandef);
10259         if (err)
10260                 return err;
10261
10262         wdev_lock(wdev);
10263         if (!cfg80211_off_channel_oper_allowed(wdev) &&
10264             !cfg80211_chandef_identical(&wdev->chandef, &chandef)) {
10265                 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef,
10266                                                              &chandef);
10267                 if (compat_chandef != &chandef) {
10268                         wdev_unlock(wdev);
10269                         return -EBUSY;
10270                 }
10271         }
10272         wdev_unlock(wdev);
10273
10274         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10275         if (!msg)
10276                 return -ENOMEM;
10277
10278         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10279                              NL80211_CMD_REMAIN_ON_CHANNEL);
10280         if (!hdr) {
10281                 err = -ENOBUFS;
10282                 goto free_msg;
10283         }
10284
10285         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
10286                                      duration, &cookie);
10287
10288         if (err)
10289                 goto free_msg;
10290
10291         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
10292                               NL80211_ATTR_PAD))
10293                 goto nla_put_failure;
10294
10295         genlmsg_end(msg, hdr);
10296
10297         return genlmsg_reply(msg, info);
10298
10299  nla_put_failure:
10300         err = -ENOBUFS;
10301  free_msg:
10302         nlmsg_free(msg);
10303         return err;
10304 }
10305
10306 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
10307                                             struct genl_info *info)
10308 {
10309         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10310         struct wireless_dev *wdev = info->user_ptr[1];
10311         u64 cookie;
10312
10313         if (!info->attrs[NL80211_ATTR_COOKIE])
10314                 return -EINVAL;
10315
10316         if (!rdev->ops->cancel_remain_on_channel)
10317                 return -EOPNOTSUPP;
10318
10319         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
10320
10321         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
10322 }
10323
10324 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
10325                                        struct genl_info *info)
10326 {
10327         struct cfg80211_bitrate_mask mask;
10328         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10329         struct net_device *dev = info->user_ptr[1];
10330         int err;
10331
10332         if (!rdev->ops->set_bitrate_mask)
10333                 return -EOPNOTSUPP;
10334
10335         err = nl80211_parse_tx_bitrate_mask(info, &mask);
10336         if (err)
10337                 return err;
10338
10339         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
10340 }
10341
10342 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
10343 {
10344         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10345         struct wireless_dev *wdev = info->user_ptr[1];
10346         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
10347
10348         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
10349                 return -EINVAL;
10350
10351         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
10352                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
10353
10354         switch (wdev->iftype) {
10355         case NL80211_IFTYPE_STATION:
10356         case NL80211_IFTYPE_ADHOC:
10357         case NL80211_IFTYPE_P2P_CLIENT:
10358         case NL80211_IFTYPE_AP:
10359         case NL80211_IFTYPE_AP_VLAN:
10360         case NL80211_IFTYPE_MESH_POINT:
10361         case NL80211_IFTYPE_P2P_GO:
10362         case NL80211_IFTYPE_P2P_DEVICE:
10363                 break;
10364         case NL80211_IFTYPE_NAN:
10365         default:
10366                 return -EOPNOTSUPP;
10367         }
10368
10369         /* not much point in registering if we can't reply */
10370         if (!rdev->ops->mgmt_tx)
10371                 return -EOPNOTSUPP;
10372
10373         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
10374                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
10375                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
10376 }
10377
10378 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
10379 {
10380         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10381         struct wireless_dev *wdev = info->user_ptr[1];
10382         struct cfg80211_chan_def chandef;
10383         int err;
10384         void *hdr = NULL;
10385         u64 cookie;
10386         struct sk_buff *msg = NULL;
10387         struct cfg80211_mgmt_tx_params params = {
10388                 .dont_wait_for_ack =
10389                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
10390         };
10391
10392         if (!info->attrs[NL80211_ATTR_FRAME])
10393                 return -EINVAL;
10394
10395         if (!rdev->ops->mgmt_tx)
10396                 return -EOPNOTSUPP;
10397
10398         switch (wdev->iftype) {
10399         case NL80211_IFTYPE_P2P_DEVICE:
10400                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
10401                         return -EINVAL;
10402         case NL80211_IFTYPE_STATION:
10403         case NL80211_IFTYPE_ADHOC:
10404         case NL80211_IFTYPE_P2P_CLIENT:
10405         case NL80211_IFTYPE_AP:
10406         case NL80211_IFTYPE_AP_VLAN:
10407         case NL80211_IFTYPE_MESH_POINT:
10408         case NL80211_IFTYPE_P2P_GO:
10409                 break;
10410         case NL80211_IFTYPE_NAN:
10411         default:
10412                 return -EOPNOTSUPP;
10413         }
10414
10415         if (info->attrs[NL80211_ATTR_DURATION]) {
10416                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
10417                         return -EINVAL;
10418                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
10419
10420                 /*
10421                  * We should wait on the channel for at least a minimum amount
10422                  * of time (10ms) but no longer than the driver supports.
10423                  */
10424                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
10425                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
10426                         return -EINVAL;
10427         }
10428
10429         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
10430
10431         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
10432                 return -EINVAL;
10433
10434         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
10435
10436         /* get the channel if any has been specified, otherwise pass NULL to
10437          * the driver. The latter will use the current one
10438          */
10439         chandef.chan = NULL;
10440         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
10441                 err = nl80211_parse_chandef(rdev, info, &chandef);
10442                 if (err)
10443                         return err;
10444         }
10445
10446         if (!chandef.chan && params.offchan)
10447                 return -EINVAL;
10448
10449         wdev_lock(wdev);
10450         if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) {
10451                 wdev_unlock(wdev);
10452                 return -EBUSY;
10453         }
10454         wdev_unlock(wdev);
10455
10456         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
10457         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
10458
10459         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
10460                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
10461                 int i;
10462
10463                 if (len % sizeof(u16))
10464                         return -EINVAL;
10465
10466                 params.n_csa_offsets = len / sizeof(u16);
10467                 params.csa_offsets =
10468                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
10469
10470                 /* check that all the offsets fit the frame */
10471                 for (i = 0; i < params.n_csa_offsets; i++) {
10472                         if (params.csa_offsets[i] >= params.len)
10473                                 return -EINVAL;
10474                 }
10475         }
10476
10477         if (!params.dont_wait_for_ack) {
10478                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10479                 if (!msg)
10480                         return -ENOMEM;
10481
10482                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10483                                      NL80211_CMD_FRAME);
10484                 if (!hdr) {
10485                         err = -ENOBUFS;
10486                         goto free_msg;
10487                 }
10488         }
10489
10490         params.chan = chandef.chan;
10491         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
10492         if (err)
10493                 goto free_msg;
10494
10495         if (msg) {
10496                 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
10497                                       NL80211_ATTR_PAD))
10498                         goto nla_put_failure;
10499
10500                 genlmsg_end(msg, hdr);
10501                 return genlmsg_reply(msg, info);
10502         }
10503
10504         return 0;
10505
10506  nla_put_failure:
10507         err = -ENOBUFS;
10508  free_msg:
10509         nlmsg_free(msg);
10510         return err;
10511 }
10512
10513 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
10514 {
10515         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10516         struct wireless_dev *wdev = info->user_ptr[1];
10517         u64 cookie;
10518
10519         if (!info->attrs[NL80211_ATTR_COOKIE])
10520                 return -EINVAL;
10521
10522         if (!rdev->ops->mgmt_tx_cancel_wait)
10523                 return -EOPNOTSUPP;
10524
10525         switch (wdev->iftype) {
10526         case NL80211_IFTYPE_STATION:
10527         case NL80211_IFTYPE_ADHOC:
10528         case NL80211_IFTYPE_P2P_CLIENT:
10529         case NL80211_IFTYPE_AP:
10530         case NL80211_IFTYPE_AP_VLAN:
10531         case NL80211_IFTYPE_P2P_GO:
10532         case NL80211_IFTYPE_P2P_DEVICE:
10533                 break;
10534         case NL80211_IFTYPE_NAN:
10535         default:
10536                 return -EOPNOTSUPP;
10537         }
10538
10539         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
10540
10541         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
10542 }
10543
10544 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
10545 {
10546         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10547         struct wireless_dev *wdev;
10548         struct net_device *dev = info->user_ptr[1];
10549         u8 ps_state;
10550         bool state;
10551         int err;
10552
10553         if (!info->attrs[NL80211_ATTR_PS_STATE])
10554                 return -EINVAL;
10555
10556         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
10557
10558         wdev = dev->ieee80211_ptr;
10559
10560         if (!rdev->ops->set_power_mgmt)
10561                 return -EOPNOTSUPP;
10562
10563         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
10564
10565         if (state == wdev->ps)
10566                 return 0;
10567
10568         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
10569         if (!err)
10570                 wdev->ps = state;
10571         return err;
10572 }
10573
10574 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
10575 {
10576         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10577         enum nl80211_ps_state ps_state;
10578         struct wireless_dev *wdev;
10579         struct net_device *dev = info->user_ptr[1];
10580         struct sk_buff *msg;
10581         void *hdr;
10582         int err;
10583
10584         wdev = dev->ieee80211_ptr;
10585
10586         if (!rdev->ops->set_power_mgmt)
10587                 return -EOPNOTSUPP;
10588
10589         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10590         if (!msg)
10591                 return -ENOMEM;
10592
10593         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10594                              NL80211_CMD_GET_POWER_SAVE);
10595         if (!hdr) {
10596                 err = -ENOBUFS;
10597                 goto free_msg;
10598         }
10599
10600         if (wdev->ps)
10601                 ps_state = NL80211_PS_ENABLED;
10602         else
10603                 ps_state = NL80211_PS_DISABLED;
10604
10605         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
10606                 goto nla_put_failure;
10607
10608         genlmsg_end(msg, hdr);
10609         return genlmsg_reply(msg, info);
10610
10611  nla_put_failure:
10612         err = -ENOBUFS;
10613  free_msg:
10614         nlmsg_free(msg);
10615         return err;
10616 }
10617
10618 static const struct nla_policy
10619 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
10620         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
10621         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
10622         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
10623         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
10624         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
10625         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
10626         [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
10627 };
10628
10629 static int nl80211_set_cqm_txe(struct genl_info *info,
10630                                u32 rate, u32 pkts, u32 intvl)
10631 {
10632         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10633         struct net_device *dev = info->user_ptr[1];
10634         struct wireless_dev *wdev = dev->ieee80211_ptr;
10635
10636         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
10637                 return -EINVAL;
10638
10639         if (!rdev->ops->set_cqm_txe_config)
10640                 return -EOPNOTSUPP;
10641
10642         if (wdev->iftype != NL80211_IFTYPE_STATION &&
10643             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
10644                 return -EOPNOTSUPP;
10645
10646         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
10647 }
10648
10649 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
10650                                     struct net_device *dev)
10651 {
10652         struct wireless_dev *wdev = dev->ieee80211_ptr;
10653         s32 last, low, high;
10654         u32 hyst;
10655         int i, n, low_index;
10656         int err;
10657
10658         /* RSSI reporting disabled? */
10659         if (!wdev->cqm_config)
10660                 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
10661
10662         /*
10663          * Obtain current RSSI value if possible, if not and no RSSI threshold
10664          * event has been received yet, we should receive an event after a
10665          * connection is established and enough beacons received to calculate
10666          * the average.
10667          */
10668         if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss &&
10669             rdev->ops->get_station) {
10670                 struct station_info sinfo = {};
10671                 u8 *mac_addr;
10672
10673                 mac_addr = wdev->current_bss->pub.bssid;
10674
10675                 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
10676                 if (err)
10677                         return err;
10678
10679                 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
10680                         wdev->cqm_config->last_rssi_event_value =
10681                                 (s8) sinfo.rx_beacon_signal_avg;
10682         }
10683
10684         last = wdev->cqm_config->last_rssi_event_value;
10685         hyst = wdev->cqm_config->rssi_hyst;
10686         n = wdev->cqm_config->n_rssi_thresholds;
10687
10688         for (i = 0; i < n; i++)
10689                 if (last < wdev->cqm_config->rssi_thresholds[i])
10690                         break;
10691
10692         low_index = i - 1;
10693         if (low_index >= 0) {
10694                 low_index = array_index_nospec(low_index, n);
10695                 low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;
10696         } else {
10697                 low = S32_MIN;
10698         }
10699         if (i < n) {
10700                 i = array_index_nospec(i, n);
10701                 high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;
10702         } else {
10703                 high = S32_MAX;
10704         }
10705
10706         return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
10707 }
10708
10709 static int nl80211_set_cqm_rssi(struct genl_info *info,
10710                                 const s32 *thresholds, int n_thresholds,
10711                                 u32 hysteresis)
10712 {
10713         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10714         struct net_device *dev = info->user_ptr[1];
10715         struct wireless_dev *wdev = dev->ieee80211_ptr;
10716         int i, err;
10717         s32 prev = S32_MIN;
10718
10719         /* Check all values negative and sorted */
10720         for (i = 0; i < n_thresholds; i++) {
10721                 if (thresholds[i] > 0 || thresholds[i] <= prev)
10722                         return -EINVAL;
10723
10724                 prev = thresholds[i];
10725         }
10726
10727         if (wdev->iftype != NL80211_IFTYPE_STATION &&
10728             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
10729                 return -EOPNOTSUPP;
10730
10731         wdev_lock(wdev);
10732         cfg80211_cqm_config_free(wdev);
10733         wdev_unlock(wdev);
10734
10735         if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
10736                 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
10737                         return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
10738
10739                 return rdev_set_cqm_rssi_config(rdev, dev,
10740                                                 thresholds[0], hysteresis);
10741         }
10742
10743         if (!wiphy_ext_feature_isset(&rdev->wiphy,
10744                                      NL80211_EXT_FEATURE_CQM_RSSI_LIST))
10745                 return -EOPNOTSUPP;
10746
10747         if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
10748                 n_thresholds = 0;
10749
10750         wdev_lock(wdev);
10751         if (n_thresholds) {
10752                 struct cfg80211_cqm_config *cqm_config;
10753
10754                 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) +
10755                                      n_thresholds * sizeof(s32), GFP_KERNEL);
10756                 if (!cqm_config) {
10757                         err = -ENOMEM;
10758                         goto unlock;
10759                 }
10760
10761                 cqm_config->rssi_hyst = hysteresis;
10762                 cqm_config->n_rssi_thresholds = n_thresholds;
10763                 memcpy(cqm_config->rssi_thresholds, thresholds,
10764                        n_thresholds * sizeof(s32));
10765
10766                 wdev->cqm_config = cqm_config;
10767         }
10768
10769         err = cfg80211_cqm_rssi_update(rdev, dev);
10770
10771 unlock:
10772         wdev_unlock(wdev);
10773
10774         return err;
10775 }
10776
10777 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
10778 {
10779         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
10780         struct nlattr *cqm;
10781         int err;
10782
10783         cqm = info->attrs[NL80211_ATTR_CQM];
10784         if (!cqm)
10785                 return -EINVAL;
10786
10787         err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm,
10788                                           nl80211_attr_cqm_policy,
10789                                           info->extack);
10790         if (err)
10791                 return err;
10792
10793         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
10794             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
10795                 const s32 *thresholds =
10796                         nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
10797                 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
10798                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
10799
10800                 if (len % 4)
10801                         return -EINVAL;
10802
10803                 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
10804                                             hysteresis);
10805         }
10806
10807         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
10808             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
10809             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
10810                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
10811                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
10812                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
10813
10814                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
10815         }
10816
10817         return -EINVAL;
10818 }
10819
10820 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
10821 {
10822         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10823         struct net_device *dev = info->user_ptr[1];
10824         struct ocb_setup setup = {};
10825         int err;
10826
10827         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
10828         if (err)
10829                 return err;
10830
10831         return cfg80211_join_ocb(rdev, dev, &setup);
10832 }
10833
10834 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
10835 {
10836         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10837         struct net_device *dev = info->user_ptr[1];
10838
10839         return cfg80211_leave_ocb(rdev, dev);
10840 }
10841
10842 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
10843 {
10844         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10845         struct net_device *dev = info->user_ptr[1];
10846         struct mesh_config cfg;
10847         struct mesh_setup setup;
10848         int err;
10849
10850         /* start with default */
10851         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
10852         memcpy(&setup, &default_mesh_setup, sizeof(setup));
10853
10854         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
10855                 /* and parse parameters if given */
10856                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
10857                 if (err)
10858                         return err;
10859         }
10860
10861         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
10862             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
10863                 return -EINVAL;
10864
10865         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
10866         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
10867
10868         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
10869             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
10870                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
10871                         return -EINVAL;
10872
10873         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
10874                 setup.beacon_interval =
10875                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
10876
10877                 err = cfg80211_validate_beacon_int(rdev,
10878                                                    NL80211_IFTYPE_MESH_POINT,
10879                                                    setup.beacon_interval);
10880                 if (err)
10881                         return err;
10882         }
10883
10884         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
10885                 setup.dtim_period =
10886                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
10887                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
10888                         return -EINVAL;
10889         }
10890
10891         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
10892                 /* parse additional setup parameters if given */
10893                 err = nl80211_parse_mesh_setup(info, &setup);
10894                 if (err)
10895                         return err;
10896         }
10897
10898         if (setup.user_mpm)
10899                 cfg.auto_open_plinks = false;
10900
10901         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
10902                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
10903                 if (err)
10904                         return err;
10905         } else {
10906                 /* __cfg80211_join_mesh() will sort it out */
10907                 setup.chandef.chan = NULL;
10908         }
10909
10910         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
10911                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10912                 int n_rates =
10913                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10914                 struct ieee80211_supported_band *sband;
10915
10916                 if (!setup.chandef.chan)
10917                         return -EINVAL;
10918
10919                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
10920
10921                 err = ieee80211_get_ratemask(sband, rates, n_rates,
10922                                              &setup.basic_rates);
10923                 if (err)
10924                         return err;
10925         }
10926
10927         if (info->attrs[NL80211_ATTR_TX_RATES]) {
10928                 err = nl80211_parse_tx_bitrate_mask(info, &setup.beacon_rate);
10929                 if (err)
10930                         return err;
10931
10932                 if (!setup.chandef.chan)
10933                         return -EINVAL;
10934
10935                 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
10936                                               &setup.beacon_rate);
10937                 if (err)
10938                         return err;
10939         }
10940
10941         setup.userspace_handles_dfs =
10942                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
10943
10944         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
10945                 int r = validate_pae_over_nl80211(rdev, info);
10946
10947                 if (r < 0)
10948                         return r;
10949
10950                 setup.control_port_over_nl80211 = true;
10951         }
10952
10953         wdev_lock(dev->ieee80211_ptr);
10954         err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
10955         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
10956                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
10957         wdev_unlock(dev->ieee80211_ptr);
10958
10959         return err;
10960 }
10961
10962 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
10963 {
10964         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10965         struct net_device *dev = info->user_ptr[1];
10966
10967         return cfg80211_leave_mesh(rdev, dev);
10968 }
10969
10970 #ifdef CONFIG_PM
10971 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
10972                                         struct cfg80211_registered_device *rdev)
10973 {
10974         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
10975         struct nlattr *nl_pats, *nl_pat;
10976         int i, pat_len;
10977
10978         if (!wowlan->n_patterns)
10979                 return 0;
10980
10981         nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
10982         if (!nl_pats)
10983                 return -ENOBUFS;
10984
10985         for (i = 0; i < wowlan->n_patterns; i++) {
10986                 nl_pat = nla_nest_start_noflag(msg, i + 1);
10987                 if (!nl_pat)
10988                         return -ENOBUFS;
10989                 pat_len = wowlan->patterns[i].pattern_len;
10990                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
10991                             wowlan->patterns[i].mask) ||
10992                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
10993                             wowlan->patterns[i].pattern) ||
10994                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
10995                                 wowlan->patterns[i].pkt_offset))
10996                         return -ENOBUFS;
10997                 nla_nest_end(msg, nl_pat);
10998         }
10999         nla_nest_end(msg, nl_pats);
11000
11001         return 0;
11002 }
11003
11004 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
11005                                    struct cfg80211_wowlan_tcp *tcp)
11006 {
11007         struct nlattr *nl_tcp;
11008
11009         if (!tcp)
11010                 return 0;
11011
11012         nl_tcp = nla_nest_start_noflag(msg,
11013                                        NL80211_WOWLAN_TRIG_TCP_CONNECTION);
11014         if (!nl_tcp)
11015                 return -ENOBUFS;
11016
11017         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
11018             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
11019             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
11020             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
11021             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
11022             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
11023                     tcp->payload_len, tcp->payload) ||
11024             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
11025                         tcp->data_interval) ||
11026             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
11027                     tcp->wake_len, tcp->wake_data) ||
11028             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
11029                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
11030                 return -ENOBUFS;
11031
11032         if (tcp->payload_seq.len &&
11033             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
11034                     sizeof(tcp->payload_seq), &tcp->payload_seq))
11035                 return -ENOBUFS;
11036
11037         if (tcp->payload_tok.len &&
11038             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
11039                     sizeof(tcp->payload_tok) + tcp->tokens_size,
11040                     &tcp->payload_tok))
11041                 return -ENOBUFS;
11042
11043         nla_nest_end(msg, nl_tcp);
11044
11045         return 0;
11046 }
11047
11048 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
11049                                   struct cfg80211_sched_scan_request *req)
11050 {
11051         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
11052         int i;
11053
11054         if (!req)
11055                 return 0;
11056
11057         nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
11058         if (!nd)
11059                 return -ENOBUFS;
11060
11061         if (req->n_scan_plans == 1 &&
11062             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
11063                         req->scan_plans[0].interval * 1000))
11064                 return -ENOBUFS;
11065
11066         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
11067                 return -ENOBUFS;
11068
11069         if (req->relative_rssi_set) {
11070                 struct nl80211_bss_select_rssi_adjust rssi_adjust;
11071
11072                 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
11073                                req->relative_rssi))
11074                         return -ENOBUFS;
11075
11076                 rssi_adjust.band = req->rssi_adjust.band;
11077                 rssi_adjust.delta = req->rssi_adjust.delta;
11078                 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
11079                             sizeof(rssi_adjust), &rssi_adjust))
11080                         return -ENOBUFS;
11081         }
11082
11083         freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
11084         if (!freqs)
11085                 return -ENOBUFS;
11086
11087         for (i = 0; i < req->n_channels; i++) {
11088                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
11089                         return -ENOBUFS;
11090         }
11091
11092         nla_nest_end(msg, freqs);
11093
11094         if (req->n_match_sets) {
11095                 matches = nla_nest_start_noflag(msg,
11096                                                 NL80211_ATTR_SCHED_SCAN_MATCH);
11097                 if (!matches)
11098                         return -ENOBUFS;
11099
11100                 for (i = 0; i < req->n_match_sets; i++) {
11101                         match = nla_nest_start_noflag(msg, i);
11102                         if (!match)
11103                                 return -ENOBUFS;
11104
11105                         if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
11106                                     req->match_sets[i].ssid.ssid_len,
11107                                     req->match_sets[i].ssid.ssid))
11108                                 return -ENOBUFS;
11109                         nla_nest_end(msg, match);
11110                 }
11111                 nla_nest_end(msg, matches);
11112         }
11113
11114         scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
11115         if (!scan_plans)
11116                 return -ENOBUFS;
11117
11118         for (i = 0; i < req->n_scan_plans; i++) {
11119                 scan_plan = nla_nest_start_noflag(msg, i + 1);
11120                 if (!scan_plan)
11121                         return -ENOBUFS;
11122
11123                 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
11124                                 req->scan_plans[i].interval) ||
11125                     (req->scan_plans[i].iterations &&
11126                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
11127                                  req->scan_plans[i].iterations)))
11128                         return -ENOBUFS;
11129                 nla_nest_end(msg, scan_plan);
11130         }
11131         nla_nest_end(msg, scan_plans);
11132
11133         nla_nest_end(msg, nd);
11134
11135         return 0;
11136 }
11137
11138 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
11139 {
11140         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11141         struct sk_buff *msg;
11142         void *hdr;
11143         u32 size = NLMSG_DEFAULT_SIZE;
11144
11145         if (!rdev->wiphy.wowlan)
11146                 return -EOPNOTSUPP;
11147
11148         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
11149                 /* adjust size to have room for all the data */
11150                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
11151                         rdev->wiphy.wowlan_config->tcp->payload_len +
11152                         rdev->wiphy.wowlan_config->tcp->wake_len +
11153                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
11154         }
11155
11156         msg = nlmsg_new(size, GFP_KERNEL);
11157         if (!msg)
11158                 return -ENOMEM;
11159
11160         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11161                              NL80211_CMD_GET_WOWLAN);
11162         if (!hdr)
11163                 goto nla_put_failure;
11164
11165         if (rdev->wiphy.wowlan_config) {
11166                 struct nlattr *nl_wowlan;
11167
11168                 nl_wowlan = nla_nest_start_noflag(msg,
11169                                                   NL80211_ATTR_WOWLAN_TRIGGERS);
11170                 if (!nl_wowlan)
11171                         goto nla_put_failure;
11172
11173                 if ((rdev->wiphy.wowlan_config->any &&
11174                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
11175                     (rdev->wiphy.wowlan_config->disconnect &&
11176                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
11177                     (rdev->wiphy.wowlan_config->magic_pkt &&
11178                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
11179                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
11180                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
11181                     (rdev->wiphy.wowlan_config->eap_identity_req &&
11182                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
11183                     (rdev->wiphy.wowlan_config->four_way_handshake &&
11184                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
11185                     (rdev->wiphy.wowlan_config->rfkill_release &&
11186                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
11187                         goto nla_put_failure;
11188
11189                 if (nl80211_send_wowlan_patterns(msg, rdev))
11190                         goto nla_put_failure;
11191
11192                 if (nl80211_send_wowlan_tcp(msg,
11193                                             rdev->wiphy.wowlan_config->tcp))
11194                         goto nla_put_failure;
11195
11196                 if (nl80211_send_wowlan_nd(
11197                             msg,
11198                             rdev->wiphy.wowlan_config->nd_config))
11199                         goto nla_put_failure;
11200
11201                 nla_nest_end(msg, nl_wowlan);
11202         }
11203
11204         genlmsg_end(msg, hdr);
11205         return genlmsg_reply(msg, info);
11206
11207 nla_put_failure:
11208         nlmsg_free(msg);
11209         return -ENOBUFS;
11210 }
11211
11212 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
11213                                     struct nlattr *attr,
11214                                     struct cfg80211_wowlan *trig)
11215 {
11216         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
11217         struct cfg80211_wowlan_tcp *cfg;
11218         struct nl80211_wowlan_tcp_data_token *tok = NULL;
11219         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
11220         u32 size;
11221         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
11222         int err, port;
11223
11224         if (!rdev->wiphy.wowlan->tcp)
11225                 return -EINVAL;
11226
11227         err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr,
11228                                           nl80211_wowlan_tcp_policy, NULL);
11229         if (err)
11230                 return err;
11231
11232         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
11233             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
11234             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
11235             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
11236             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
11237             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
11238             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
11239             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
11240                 return -EINVAL;
11241
11242         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
11243         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
11244                 return -EINVAL;
11245
11246         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
11247                         rdev->wiphy.wowlan->tcp->data_interval_max ||
11248             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
11249                 return -EINVAL;
11250
11251         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
11252         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
11253                 return -EINVAL;
11254
11255         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
11256         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
11257                 return -EINVAL;
11258
11259         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
11260                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
11261
11262                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
11263                 tokens_size = tokln - sizeof(*tok);
11264
11265                 if (!tok->len || tokens_size % tok->len)
11266                         return -EINVAL;
11267                 if (!rdev->wiphy.wowlan->tcp->tok)
11268                         return -EINVAL;
11269                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
11270                         return -EINVAL;
11271                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
11272                         return -EINVAL;
11273                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
11274                         return -EINVAL;
11275                 if (tok->offset + tok->len > data_size)
11276                         return -EINVAL;
11277         }
11278
11279         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
11280                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
11281                 if (!rdev->wiphy.wowlan->tcp->seq)
11282                         return -EINVAL;
11283                 if (seq->len == 0 || seq->len > 4)
11284                         return -EINVAL;
11285                 if (seq->len + seq->offset > data_size)
11286                         return -EINVAL;
11287         }
11288
11289         size = sizeof(*cfg);
11290         size += data_size;
11291         size += wake_size + wake_mask_size;
11292         size += tokens_size;
11293
11294         cfg = kzalloc(size, GFP_KERNEL);
11295         if (!cfg)
11296                 return -ENOMEM;
11297         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
11298         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
11299         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
11300                ETH_ALEN);
11301         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
11302                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
11303         else
11304                 port = 0;
11305 #ifdef CONFIG_INET
11306         /* allocate a socket and port for it and use it */
11307         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
11308                             IPPROTO_TCP, &cfg->sock, 1);
11309         if (err) {
11310                 kfree(cfg);
11311                 return err;
11312         }
11313         if (inet_csk_get_port(cfg->sock->sk, port)) {
11314                 sock_release(cfg->sock);
11315                 kfree(cfg);
11316                 return -EADDRINUSE;
11317         }
11318         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
11319 #else
11320         if (!port) {
11321                 kfree(cfg);
11322                 return -EINVAL;
11323         }
11324         cfg->src_port = port;
11325 #endif
11326
11327         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
11328         cfg->payload_len = data_size;
11329         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
11330         memcpy((void *)cfg->payload,
11331                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
11332                data_size);
11333         if (seq)
11334                 cfg->payload_seq = *seq;
11335         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
11336         cfg->wake_len = wake_size;
11337         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
11338         memcpy((void *)cfg->wake_data,
11339                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
11340                wake_size);
11341         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
11342                          data_size + wake_size;
11343         memcpy((void *)cfg->wake_mask,
11344                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
11345                wake_mask_size);
11346         if (tok) {
11347                 cfg->tokens_size = tokens_size;
11348                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
11349         }
11350
11351         trig->tcp = cfg;
11352
11353         return 0;
11354 }
11355
11356 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
11357                                    const struct wiphy_wowlan_support *wowlan,
11358                                    struct nlattr *attr,
11359                                    struct cfg80211_wowlan *trig)
11360 {
11361         struct nlattr **tb;
11362         int err;
11363
11364         tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
11365         if (!tb)
11366                 return -ENOMEM;
11367
11368         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
11369                 err = -EOPNOTSUPP;
11370                 goto out;
11371         }
11372
11373         err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr,
11374                                           nl80211_policy, NULL);
11375         if (err)
11376                 goto out;
11377
11378         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
11379                                                    wowlan->max_nd_match_sets);
11380         err = PTR_ERR_OR_ZERO(trig->nd_config);
11381         if (err)
11382                 trig->nd_config = NULL;
11383
11384 out:
11385         kfree(tb);
11386         return err;
11387 }
11388
11389 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
11390 {
11391         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11392         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
11393         struct cfg80211_wowlan new_triggers = {};
11394         struct cfg80211_wowlan *ntrig;
11395         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
11396         int err, i;
11397         bool prev_enabled = rdev->wiphy.wowlan_config;
11398         bool regular = false;
11399
11400         if (!wowlan)
11401                 return -EOPNOTSUPP;
11402
11403         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
11404                 cfg80211_rdev_free_wowlan(rdev);
11405                 rdev->wiphy.wowlan_config = NULL;
11406                 goto set_wakeup;
11407         }
11408
11409         err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG,
11410                                           info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
11411                                           nl80211_wowlan_policy, info->extack);
11412         if (err)
11413                 return err;
11414
11415         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
11416                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
11417                         return -EINVAL;
11418                 new_triggers.any = true;
11419         }
11420
11421         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
11422                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
11423                         return -EINVAL;
11424                 new_triggers.disconnect = true;
11425                 regular = true;
11426         }
11427
11428         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
11429                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
11430                         return -EINVAL;
11431                 new_triggers.magic_pkt = true;
11432                 regular = true;
11433         }
11434
11435         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
11436                 return -EINVAL;
11437
11438         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
11439                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
11440                         return -EINVAL;
11441                 new_triggers.gtk_rekey_failure = true;
11442                 regular = true;
11443         }
11444
11445         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
11446                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
11447                         return -EINVAL;
11448                 new_triggers.eap_identity_req = true;
11449                 regular = true;
11450         }
11451
11452         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
11453                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
11454                         return -EINVAL;
11455                 new_triggers.four_way_handshake = true;
11456                 regular = true;
11457         }
11458
11459         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
11460                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
11461                         return -EINVAL;
11462                 new_triggers.rfkill_release = true;
11463                 regular = true;
11464         }
11465
11466         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
11467                 struct nlattr *pat;
11468                 int n_patterns = 0;
11469                 int rem, pat_len, mask_len, pkt_offset;
11470                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
11471
11472                 regular = true;
11473
11474                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
11475                                     rem)
11476                         n_patterns++;
11477                 if (n_patterns > wowlan->n_patterns)
11478                         return -EINVAL;
11479
11480                 new_triggers.patterns = kcalloc(n_patterns,
11481                                                 sizeof(new_triggers.patterns[0]),
11482                                                 GFP_KERNEL);
11483                 if (!new_triggers.patterns)
11484                         return -ENOMEM;
11485
11486                 new_triggers.n_patterns = n_patterns;
11487                 i = 0;
11488
11489                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
11490                                     rem) {
11491                         u8 *mask_pat;
11492
11493                         err = nla_parse_nested_deprecated(pat_tb,
11494                                                           MAX_NL80211_PKTPAT,
11495                                                           pat,
11496                                                           nl80211_packet_pattern_policy,
11497                                                           info->extack);
11498                         if (err)
11499                                 goto error;
11500
11501                         err = -EINVAL;
11502                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
11503                             !pat_tb[NL80211_PKTPAT_PATTERN])
11504                                 goto error;
11505                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
11506                         mask_len = DIV_ROUND_UP(pat_len, 8);
11507                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
11508                                 goto error;
11509                         if (pat_len > wowlan->pattern_max_len ||
11510                             pat_len < wowlan->pattern_min_len)
11511                                 goto error;
11512
11513                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
11514                                 pkt_offset = 0;
11515                         else
11516                                 pkt_offset = nla_get_u32(
11517                                         pat_tb[NL80211_PKTPAT_OFFSET]);
11518                         if (pkt_offset > wowlan->max_pkt_offset)
11519                                 goto error;
11520                         new_triggers.patterns[i].pkt_offset = pkt_offset;
11521
11522                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
11523                         if (!mask_pat) {
11524                                 err = -ENOMEM;
11525                                 goto error;
11526                         }
11527                         new_triggers.patterns[i].mask = mask_pat;
11528                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
11529                                mask_len);
11530                         mask_pat += mask_len;
11531                         new_triggers.patterns[i].pattern = mask_pat;
11532                         new_triggers.patterns[i].pattern_len = pat_len;
11533                         memcpy(mask_pat,
11534                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
11535                                pat_len);
11536                         i++;
11537                 }
11538         }
11539
11540         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
11541                 regular = true;
11542                 err = nl80211_parse_wowlan_tcp(
11543                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
11544                         &new_triggers);
11545                 if (err)
11546                         goto error;
11547         }
11548
11549         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
11550                 regular = true;
11551                 err = nl80211_parse_wowlan_nd(
11552                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
11553                         &new_triggers);
11554                 if (err)
11555                         goto error;
11556         }
11557
11558         /* The 'any' trigger means the device continues operating more or less
11559          * as in its normal operation mode and wakes up the host on most of the
11560          * normal interrupts (like packet RX, ...)
11561          * It therefore makes little sense to combine with the more constrained
11562          * wakeup trigger modes.
11563          */
11564         if (new_triggers.any && regular) {
11565                 err = -EINVAL;
11566                 goto error;
11567         }
11568
11569         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
11570         if (!ntrig) {
11571                 err = -ENOMEM;
11572                 goto error;
11573         }
11574         cfg80211_rdev_free_wowlan(rdev);
11575         rdev->wiphy.wowlan_config = ntrig;
11576
11577  set_wakeup:
11578         if (rdev->ops->set_wakeup &&
11579             prev_enabled != !!rdev->wiphy.wowlan_config)
11580                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
11581
11582         return 0;
11583  error:
11584         for (i = 0; i < new_triggers.n_patterns; i++)
11585                 kfree(new_triggers.patterns[i].mask);
11586         kfree(new_triggers.patterns);
11587         if (new_triggers.tcp && new_triggers.tcp->sock)
11588                 sock_release(new_triggers.tcp->sock);
11589         kfree(new_triggers.tcp);
11590         kfree(new_triggers.nd_config);
11591         return err;
11592 }
11593 #endif
11594
11595 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
11596                                        struct cfg80211_registered_device *rdev)
11597 {
11598         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
11599         int i, j, pat_len;
11600         struct cfg80211_coalesce_rules *rule;
11601
11602         if (!rdev->coalesce->n_rules)
11603                 return 0;
11604
11605         nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE);
11606         if (!nl_rules)
11607                 return -ENOBUFS;
11608
11609         for (i = 0; i < rdev->coalesce->n_rules; i++) {
11610                 nl_rule = nla_nest_start_noflag(msg, i + 1);
11611                 if (!nl_rule)
11612                         return -ENOBUFS;
11613
11614                 rule = &rdev->coalesce->rules[i];
11615                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
11616                                 rule->delay))
11617                         return -ENOBUFS;
11618
11619                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
11620                                 rule->condition))
11621                         return -ENOBUFS;
11622
11623                 nl_pats = nla_nest_start_noflag(msg,
11624                                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
11625                 if (!nl_pats)
11626                         return -ENOBUFS;
11627
11628                 for (j = 0; j < rule->n_patterns; j++) {
11629                         nl_pat = nla_nest_start_noflag(msg, j + 1);
11630                         if (!nl_pat)
11631                                 return -ENOBUFS;
11632                         pat_len = rule->patterns[j].pattern_len;
11633                         if (nla_put(msg, NL80211_PKTPAT_MASK,
11634                                     DIV_ROUND_UP(pat_len, 8),
11635                                     rule->patterns[j].mask) ||
11636                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
11637                                     rule->patterns[j].pattern) ||
11638                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
11639                                         rule->patterns[j].pkt_offset))
11640                                 return -ENOBUFS;
11641                         nla_nest_end(msg, nl_pat);
11642                 }
11643                 nla_nest_end(msg, nl_pats);
11644                 nla_nest_end(msg, nl_rule);
11645         }
11646         nla_nest_end(msg, nl_rules);
11647
11648         return 0;
11649 }
11650
11651 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
11652 {
11653         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11654         struct sk_buff *msg;
11655         void *hdr;
11656
11657         if (!rdev->wiphy.coalesce)
11658                 return -EOPNOTSUPP;
11659
11660         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11661         if (!msg)
11662                 return -ENOMEM;
11663
11664         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11665                              NL80211_CMD_GET_COALESCE);
11666         if (!hdr)
11667                 goto nla_put_failure;
11668
11669         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
11670                 goto nla_put_failure;
11671
11672         genlmsg_end(msg, hdr);
11673         return genlmsg_reply(msg, info);
11674
11675 nla_put_failure:
11676         nlmsg_free(msg);
11677         return -ENOBUFS;
11678 }
11679
11680 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
11681 {
11682         struct cfg80211_coalesce *coalesce = rdev->coalesce;
11683         int i, j;
11684         struct cfg80211_coalesce_rules *rule;
11685
11686         if (!coalesce)
11687                 return;
11688
11689         for (i = 0; i < coalesce->n_rules; i++) {
11690                 rule = &coalesce->rules[i];
11691                 for (j = 0; j < rule->n_patterns; j++)
11692                         kfree(rule->patterns[j].mask);
11693                 kfree(rule->patterns);
11694         }
11695         kfree(coalesce->rules);
11696         kfree(coalesce);
11697         rdev->coalesce = NULL;
11698 }
11699
11700 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
11701                                        struct nlattr *rule,
11702                                        struct cfg80211_coalesce_rules *new_rule)
11703 {
11704         int err, i;
11705         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
11706         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
11707         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
11708         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
11709
11710         err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX,
11711                                           rule, nl80211_coalesce_policy, NULL);
11712         if (err)
11713                 return err;
11714
11715         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
11716                 new_rule->delay =
11717                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
11718         if (new_rule->delay > coalesce->max_delay)
11719                 return -EINVAL;
11720
11721         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
11722                 new_rule->condition =
11723                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
11724
11725         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
11726                 return -EINVAL;
11727
11728         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
11729                             rem)
11730                 n_patterns++;
11731         if (n_patterns > coalesce->n_patterns)
11732                 return -EINVAL;
11733
11734         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
11735                                      GFP_KERNEL);
11736         if (!new_rule->patterns)
11737                 return -ENOMEM;
11738
11739         new_rule->n_patterns = n_patterns;
11740         i = 0;
11741
11742         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
11743                             rem) {
11744                 u8 *mask_pat;
11745
11746                 err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT,
11747                                                   pat,
11748                                                   nl80211_packet_pattern_policy,
11749                                                   NULL);
11750                 if (err)
11751                         return err;
11752
11753                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
11754                     !pat_tb[NL80211_PKTPAT_PATTERN])
11755                         return -EINVAL;
11756                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
11757                 mask_len = DIV_ROUND_UP(pat_len, 8);
11758                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
11759                         return -EINVAL;
11760                 if (pat_len > coalesce->pattern_max_len ||
11761                     pat_len < coalesce->pattern_min_len)
11762                         return -EINVAL;
11763
11764                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
11765                         pkt_offset = 0;
11766                 else
11767                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
11768                 if (pkt_offset > coalesce->max_pkt_offset)
11769                         return -EINVAL;
11770                 new_rule->patterns[i].pkt_offset = pkt_offset;
11771
11772                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
11773                 if (!mask_pat)
11774                         return -ENOMEM;
11775
11776                 new_rule->patterns[i].mask = mask_pat;
11777                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
11778                        mask_len);
11779
11780                 mask_pat += mask_len;
11781                 new_rule->patterns[i].pattern = mask_pat;
11782                 new_rule->patterns[i].pattern_len = pat_len;
11783                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
11784                        pat_len);
11785                 i++;
11786         }
11787
11788         return 0;
11789 }
11790
11791 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
11792 {
11793         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11794         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
11795         struct cfg80211_coalesce new_coalesce = {};
11796         struct cfg80211_coalesce *n_coalesce;
11797         int err, rem_rule, n_rules = 0, i, j;
11798         struct nlattr *rule;
11799         struct cfg80211_coalesce_rules *tmp_rule;
11800
11801         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
11802                 return -EOPNOTSUPP;
11803
11804         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
11805                 cfg80211_rdev_free_coalesce(rdev);
11806                 rdev_set_coalesce(rdev, NULL);
11807                 return 0;
11808         }
11809
11810         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
11811                             rem_rule)
11812                 n_rules++;
11813         if (n_rules > coalesce->n_rules)
11814                 return -EINVAL;
11815
11816         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
11817                                      GFP_KERNEL);
11818         if (!new_coalesce.rules)
11819                 return -ENOMEM;
11820
11821         new_coalesce.n_rules = n_rules;
11822         i = 0;
11823
11824         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
11825                             rem_rule) {
11826                 err = nl80211_parse_coalesce_rule(rdev, rule,
11827                                                   &new_coalesce.rules[i]);
11828                 if (err)
11829                         goto error;
11830
11831                 i++;
11832         }
11833
11834         err = rdev_set_coalesce(rdev, &new_coalesce);
11835         if (err)
11836                 goto error;
11837
11838         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
11839         if (!n_coalesce) {
11840                 err = -ENOMEM;
11841                 goto error;
11842         }
11843         cfg80211_rdev_free_coalesce(rdev);
11844         rdev->coalesce = n_coalesce;
11845
11846         return 0;
11847 error:
11848         for (i = 0; i < new_coalesce.n_rules; i++) {
11849                 tmp_rule = &new_coalesce.rules[i];
11850                 for (j = 0; j < tmp_rule->n_patterns; j++)
11851                         kfree(tmp_rule->patterns[j].mask);
11852                 kfree(tmp_rule->patterns);
11853         }
11854         kfree(new_coalesce.rules);
11855
11856         return err;
11857 }
11858
11859 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
11860 {
11861         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11862         struct net_device *dev = info->user_ptr[1];
11863         struct wireless_dev *wdev = dev->ieee80211_ptr;
11864         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
11865         struct cfg80211_gtk_rekey_data rekey_data;
11866         int err;
11867
11868         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
11869                 return -EINVAL;
11870
11871         err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA,
11872                                           info->attrs[NL80211_ATTR_REKEY_DATA],
11873                                           nl80211_rekey_policy, info->extack);
11874         if (err)
11875                 return err;
11876
11877         if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
11878             !tb[NL80211_REKEY_DATA_KCK])
11879                 return -EINVAL;
11880         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
11881                 return -ERANGE;
11882         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
11883                 return -ERANGE;
11884         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
11885                 return -ERANGE;
11886
11887         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
11888         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
11889         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
11890
11891         wdev_lock(wdev);
11892         if (!wdev->current_bss) {
11893                 err = -ENOTCONN;
11894                 goto out;
11895         }
11896
11897         if (!rdev->ops->set_rekey_data) {
11898                 err = -EOPNOTSUPP;
11899                 goto out;
11900         }
11901
11902         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
11903  out:
11904         wdev_unlock(wdev);
11905         return err;
11906 }
11907
11908 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
11909                                              struct genl_info *info)
11910 {
11911         struct net_device *dev = info->user_ptr[1];
11912         struct wireless_dev *wdev = dev->ieee80211_ptr;
11913
11914         if (wdev->iftype != NL80211_IFTYPE_AP &&
11915             wdev->iftype != NL80211_IFTYPE_P2P_GO)
11916                 return -EINVAL;
11917
11918         if (wdev->ap_unexpected_nlportid)
11919                 return -EBUSY;
11920
11921         wdev->ap_unexpected_nlportid = info->snd_portid;
11922         return 0;
11923 }
11924
11925 static int nl80211_probe_client(struct sk_buff *skb,
11926                                 struct genl_info *info)
11927 {
11928         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11929         struct net_device *dev = info->user_ptr[1];
11930         struct wireless_dev *wdev = dev->ieee80211_ptr;
11931         struct sk_buff *msg;
11932         void *hdr;
11933         const u8 *addr;
11934         u64 cookie;
11935         int err;
11936
11937         if (wdev->iftype != NL80211_IFTYPE_AP &&
11938             wdev->iftype != NL80211_IFTYPE_P2P_GO)
11939                 return -EOPNOTSUPP;
11940
11941         if (!info->attrs[NL80211_ATTR_MAC])
11942                 return -EINVAL;
11943
11944         if (!rdev->ops->probe_client)
11945                 return -EOPNOTSUPP;
11946
11947         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11948         if (!msg)
11949                 return -ENOMEM;
11950
11951         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11952                              NL80211_CMD_PROBE_CLIENT);
11953         if (!hdr) {
11954                 err = -ENOBUFS;
11955                 goto free_msg;
11956         }
11957
11958         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
11959
11960         err = rdev_probe_client(rdev, dev, addr, &cookie);
11961         if (err)
11962                 goto free_msg;
11963
11964         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11965                               NL80211_ATTR_PAD))
11966                 goto nla_put_failure;
11967
11968         genlmsg_end(msg, hdr);
11969
11970         return genlmsg_reply(msg, info);
11971
11972  nla_put_failure:
11973         err = -ENOBUFS;
11974  free_msg:
11975         nlmsg_free(msg);
11976         return err;
11977 }
11978
11979 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
11980 {
11981         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11982         struct cfg80211_beacon_registration *reg, *nreg;
11983         int rv;
11984
11985         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
11986                 return -EOPNOTSUPP;
11987
11988         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
11989         if (!nreg)
11990                 return -ENOMEM;
11991
11992         /* First, check if already registered. */
11993         spin_lock_bh(&rdev->beacon_registrations_lock);
11994         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
11995                 if (reg->nlportid == info->snd_portid) {
11996                         rv = -EALREADY;
11997                         goto out_err;
11998                 }
11999         }
12000         /* Add it to the list */
12001         nreg->nlportid = info->snd_portid;
12002         list_add(&nreg->list, &rdev->beacon_registrations);
12003
12004         spin_unlock_bh(&rdev->beacon_registrations_lock);
12005
12006         return 0;
12007 out_err:
12008         spin_unlock_bh(&rdev->beacon_registrations_lock);
12009         kfree(nreg);
12010         return rv;
12011 }
12012
12013 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
12014 {
12015         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12016         struct wireless_dev *wdev = info->user_ptr[1];
12017         int err;
12018
12019         if (!rdev->ops->start_p2p_device)
12020                 return -EOPNOTSUPP;
12021
12022         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
12023                 return -EOPNOTSUPP;
12024
12025         if (wdev_running(wdev))
12026                 return 0;
12027
12028         if (rfkill_blocked(rdev->rfkill))
12029                 return -ERFKILL;
12030
12031         err = rdev_start_p2p_device(rdev, wdev);
12032         if (err)
12033                 return err;
12034
12035         wdev->is_running = true;
12036         rdev->opencount++;
12037
12038         return 0;
12039 }
12040
12041 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
12042 {
12043         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12044         struct wireless_dev *wdev = info->user_ptr[1];
12045
12046         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
12047                 return -EOPNOTSUPP;
12048
12049         if (!rdev->ops->stop_p2p_device)
12050                 return -EOPNOTSUPP;
12051
12052         cfg80211_stop_p2p_device(rdev, wdev);
12053
12054         return 0;
12055 }
12056
12057 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
12058 {
12059         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12060         struct wireless_dev *wdev = info->user_ptr[1];
12061         struct cfg80211_nan_conf conf = {};
12062         int err;
12063
12064         if (wdev->iftype != NL80211_IFTYPE_NAN)
12065                 return -EOPNOTSUPP;
12066
12067         if (wdev_running(wdev))
12068                 return -EEXIST;
12069
12070         if (rfkill_blocked(rdev->rfkill))
12071                 return -ERFKILL;
12072
12073         if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
12074                 return -EINVAL;
12075
12076         conf.master_pref =
12077                 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
12078
12079         if (info->attrs[NL80211_ATTR_BANDS]) {
12080                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
12081
12082                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
12083                         return -EOPNOTSUPP;
12084
12085                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
12086                         return -EINVAL;
12087
12088                 conf.bands = bands;
12089         }
12090
12091         err = rdev_start_nan(rdev, wdev, &conf);
12092         if (err)
12093                 return err;
12094
12095         wdev->is_running = true;
12096         rdev->opencount++;
12097
12098         return 0;
12099 }
12100
12101 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
12102 {
12103         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12104         struct wireless_dev *wdev = info->user_ptr[1];
12105
12106         if (wdev->iftype != NL80211_IFTYPE_NAN)
12107                 return -EOPNOTSUPP;
12108
12109         cfg80211_stop_nan(rdev, wdev);
12110
12111         return 0;
12112 }
12113
12114 static int validate_nan_filter(struct nlattr *filter_attr)
12115 {
12116         struct nlattr *attr;
12117         int len = 0, n_entries = 0, rem;
12118
12119         nla_for_each_nested(attr, filter_attr, rem) {
12120                 len += nla_len(attr);
12121                 n_entries++;
12122         }
12123
12124         if (len >= U8_MAX)
12125                 return -EINVAL;
12126
12127         return n_entries;
12128 }
12129
12130 static int handle_nan_filter(struct nlattr *attr_filter,
12131                              struct cfg80211_nan_func *func,
12132                              bool tx)
12133 {
12134         struct nlattr *attr;
12135         int n_entries, rem, i;
12136         struct cfg80211_nan_func_filter *filter;
12137
12138         n_entries = validate_nan_filter(attr_filter);
12139         if (n_entries < 0)
12140                 return n_entries;
12141
12142         BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
12143
12144         filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
12145         if (!filter)
12146                 return -ENOMEM;
12147
12148         i = 0;
12149         nla_for_each_nested(attr, attr_filter, rem) {
12150                 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
12151                 filter[i].len = nla_len(attr);
12152                 i++;
12153         }
12154         if (tx) {
12155                 func->num_tx_filters = n_entries;
12156                 func->tx_filters = filter;
12157         } else {
12158                 func->num_rx_filters = n_entries;
12159                 func->rx_filters = filter;
12160         }
12161
12162         return 0;
12163 }
12164
12165 static int nl80211_nan_add_func(struct sk_buff *skb,
12166                                 struct genl_info *info)
12167 {
12168         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12169         struct wireless_dev *wdev = info->user_ptr[1];
12170         struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
12171         struct cfg80211_nan_func *func;
12172         struct sk_buff *msg = NULL;
12173         void *hdr = NULL;
12174         int err = 0;
12175
12176         if (wdev->iftype != NL80211_IFTYPE_NAN)
12177                 return -EOPNOTSUPP;
12178
12179         if (!wdev_running(wdev))
12180                 return -ENOTCONN;
12181
12182         if (!info->attrs[NL80211_ATTR_NAN_FUNC])
12183                 return -EINVAL;
12184
12185         err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX,
12186                                           info->attrs[NL80211_ATTR_NAN_FUNC],
12187                                           nl80211_nan_func_policy,
12188                                           info->extack);
12189         if (err)
12190                 return err;
12191
12192         func = kzalloc(sizeof(*func), GFP_KERNEL);
12193         if (!func)
12194                 return -ENOMEM;
12195
12196         func->cookie = cfg80211_assign_cookie(rdev);
12197
12198         if (!tb[NL80211_NAN_FUNC_TYPE] ||
12199             nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]) > NL80211_NAN_FUNC_MAX_TYPE) {
12200                 err = -EINVAL;
12201                 goto out;
12202         }
12203
12204
12205         func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
12206
12207         if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
12208                 err = -EINVAL;
12209                 goto out;
12210         }
12211
12212         memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
12213                sizeof(func->service_id));
12214
12215         func->close_range =
12216                 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
12217
12218         if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
12219                 func->serv_spec_info_len =
12220                         nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
12221                 func->serv_spec_info =
12222                         kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
12223                                 func->serv_spec_info_len,
12224                                 GFP_KERNEL);
12225                 if (!func->serv_spec_info) {
12226                         err = -ENOMEM;
12227                         goto out;
12228                 }
12229         }
12230
12231         if (tb[NL80211_NAN_FUNC_TTL])
12232                 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
12233
12234         switch (func->type) {
12235         case NL80211_NAN_FUNC_PUBLISH:
12236                 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
12237                         err = -EINVAL;
12238                         goto out;
12239                 }
12240
12241                 func->publish_type =
12242                         nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
12243                 func->publish_bcast =
12244                         nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
12245
12246                 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
12247                         func->publish_bcast) {
12248                         err = -EINVAL;
12249                         goto out;
12250                 }
12251                 break;
12252         case NL80211_NAN_FUNC_SUBSCRIBE:
12253                 func->subscribe_active =
12254                         nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
12255                 break;
12256         case NL80211_NAN_FUNC_FOLLOW_UP:
12257                 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
12258                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
12259                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
12260                         err = -EINVAL;
12261                         goto out;
12262                 }
12263
12264                 func->followup_id =
12265                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
12266                 func->followup_reqid =
12267                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
12268                 memcpy(func->followup_dest.addr,
12269                        nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
12270                        sizeof(func->followup_dest.addr));
12271                 if (func->ttl) {
12272                         err = -EINVAL;
12273                         goto out;
12274                 }
12275                 break;
12276         default:
12277                 err = -EINVAL;
12278                 goto out;
12279         }
12280
12281         if (tb[NL80211_NAN_FUNC_SRF]) {
12282                 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
12283
12284                 err = nla_parse_nested_deprecated(srf_tb,
12285                                                   NL80211_NAN_SRF_ATTR_MAX,
12286                                                   tb[NL80211_NAN_FUNC_SRF],
12287                                                   nl80211_nan_srf_policy,
12288                                                   info->extack);
12289                 if (err)
12290                         goto out;
12291
12292                 func->srf_include =
12293                         nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
12294
12295                 if (srf_tb[NL80211_NAN_SRF_BF]) {
12296                         if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
12297                             !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
12298                                 err = -EINVAL;
12299                                 goto out;
12300                         }
12301
12302                         func->srf_bf_len =
12303                                 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
12304                         func->srf_bf =
12305                                 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
12306                                         func->srf_bf_len, GFP_KERNEL);
12307                         if (!func->srf_bf) {
12308                                 err = -ENOMEM;
12309                                 goto out;
12310                         }
12311
12312                         func->srf_bf_idx =
12313                                 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
12314                 } else {
12315                         struct nlattr *attr, *mac_attr =
12316                                 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
12317                         int n_entries, rem, i = 0;
12318
12319                         if (!mac_attr) {
12320                                 err = -EINVAL;
12321                                 goto out;
12322                         }
12323
12324                         n_entries = validate_acl_mac_addrs(mac_attr);
12325                         if (n_entries <= 0) {
12326                                 err = -EINVAL;
12327                                 goto out;
12328                         }
12329
12330                         func->srf_num_macs = n_entries;
12331                         func->srf_macs =
12332                                 kcalloc(n_entries, sizeof(*func->srf_macs),
12333                                         GFP_KERNEL);
12334                         if (!func->srf_macs) {
12335                                 err = -ENOMEM;
12336                                 goto out;
12337                         }
12338
12339                         nla_for_each_nested(attr, mac_attr, rem)
12340                                 memcpy(func->srf_macs[i++].addr, nla_data(attr),
12341                                        sizeof(*func->srf_macs));
12342                 }
12343         }
12344
12345         if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
12346                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
12347                                         func, true);
12348                 if (err)
12349                         goto out;
12350         }
12351
12352         if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
12353                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
12354                                         func, false);
12355                 if (err)
12356                         goto out;
12357         }
12358
12359         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12360         if (!msg) {
12361                 err = -ENOMEM;
12362                 goto out;
12363         }
12364
12365         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12366                              NL80211_CMD_ADD_NAN_FUNCTION);
12367         /* This can't really happen - we just allocated 4KB */
12368         if (WARN_ON(!hdr)) {
12369                 err = -ENOMEM;
12370                 goto out;
12371         }
12372
12373         err = rdev_add_nan_func(rdev, wdev, func);
12374 out:
12375         if (err < 0) {
12376                 cfg80211_free_nan_func(func);
12377                 nlmsg_free(msg);
12378                 return err;
12379         }
12380
12381         /* propagate the instance id and cookie to userspace  */
12382         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
12383                               NL80211_ATTR_PAD))
12384                 goto nla_put_failure;
12385
12386         func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
12387         if (!func_attr)
12388                 goto nla_put_failure;
12389
12390         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
12391                        func->instance_id))
12392                 goto nla_put_failure;
12393
12394         nla_nest_end(msg, func_attr);
12395
12396         genlmsg_end(msg, hdr);
12397         return genlmsg_reply(msg, info);
12398
12399 nla_put_failure:
12400         nlmsg_free(msg);
12401         return -ENOBUFS;
12402 }
12403
12404 static int nl80211_nan_del_func(struct sk_buff *skb,
12405                                struct genl_info *info)
12406 {
12407         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12408         struct wireless_dev *wdev = info->user_ptr[1];
12409         u64 cookie;
12410
12411         if (wdev->iftype != NL80211_IFTYPE_NAN)
12412                 return -EOPNOTSUPP;
12413
12414         if (!wdev_running(wdev))
12415                 return -ENOTCONN;
12416
12417         if (!info->attrs[NL80211_ATTR_COOKIE])
12418                 return -EINVAL;
12419
12420         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12421
12422         rdev_del_nan_func(rdev, wdev, cookie);
12423
12424         return 0;
12425 }
12426
12427 static int nl80211_nan_change_config(struct sk_buff *skb,
12428                                      struct genl_info *info)
12429 {
12430         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12431         struct wireless_dev *wdev = info->user_ptr[1];
12432         struct cfg80211_nan_conf conf = {};
12433         u32 changed = 0;
12434
12435         if (wdev->iftype != NL80211_IFTYPE_NAN)
12436                 return -EOPNOTSUPP;
12437
12438         if (!wdev_running(wdev))
12439                 return -ENOTCONN;
12440
12441         if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
12442                 conf.master_pref =
12443                         nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
12444                 if (conf.master_pref <= 1 || conf.master_pref == 255)
12445                         return -EINVAL;
12446
12447                 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
12448         }
12449
12450         if (info->attrs[NL80211_ATTR_BANDS]) {
12451                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
12452
12453                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
12454                         return -EOPNOTSUPP;
12455
12456                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
12457                         return -EINVAL;
12458
12459                 conf.bands = bands;
12460                 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
12461         }
12462
12463         if (!changed)
12464                 return -EINVAL;
12465
12466         return rdev_nan_change_conf(rdev, wdev, &conf, changed);
12467 }
12468
12469 void cfg80211_nan_match(struct wireless_dev *wdev,
12470                         struct cfg80211_nan_match_params *match, gfp_t gfp)
12471 {
12472         struct wiphy *wiphy = wdev->wiphy;
12473         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12474         struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
12475         struct sk_buff *msg;
12476         void *hdr;
12477
12478         if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
12479                 return;
12480
12481         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12482         if (!msg)
12483                 return;
12484
12485         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
12486         if (!hdr) {
12487                 nlmsg_free(msg);
12488                 return;
12489         }
12490
12491         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12492             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12493                                          wdev->netdev->ifindex)) ||
12494             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12495                               NL80211_ATTR_PAD))
12496                 goto nla_put_failure;
12497
12498         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
12499                               NL80211_ATTR_PAD) ||
12500             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
12501                 goto nla_put_failure;
12502
12503         match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH);
12504         if (!match_attr)
12505                 goto nla_put_failure;
12506
12507         local_func_attr = nla_nest_start_noflag(msg,
12508                                                 NL80211_NAN_MATCH_FUNC_LOCAL);
12509         if (!local_func_attr)
12510                 goto nla_put_failure;
12511
12512         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
12513                 goto nla_put_failure;
12514
12515         nla_nest_end(msg, local_func_attr);
12516
12517         peer_func_attr = nla_nest_start_noflag(msg,
12518                                                NL80211_NAN_MATCH_FUNC_PEER);
12519         if (!peer_func_attr)
12520                 goto nla_put_failure;
12521
12522         if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
12523             nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
12524                 goto nla_put_failure;
12525
12526         if (match->info && match->info_len &&
12527             nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
12528                     match->info))
12529                 goto nla_put_failure;
12530
12531         nla_nest_end(msg, peer_func_attr);
12532         nla_nest_end(msg, match_attr);
12533         genlmsg_end(msg, hdr);
12534
12535         if (!wdev->owner_nlportid)
12536                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12537                                         msg, 0, NL80211_MCGRP_NAN, gfp);
12538         else
12539                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
12540                                 wdev->owner_nlportid);
12541
12542         return;
12543
12544 nla_put_failure:
12545         nlmsg_free(msg);
12546 }
12547 EXPORT_SYMBOL(cfg80211_nan_match);
12548
12549 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
12550                                   u8 inst_id,
12551                                   enum nl80211_nan_func_term_reason reason,
12552                                   u64 cookie, gfp_t gfp)
12553 {
12554         struct wiphy *wiphy = wdev->wiphy;
12555         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12556         struct sk_buff *msg;
12557         struct nlattr *func_attr;
12558         void *hdr;
12559
12560         if (WARN_ON(!inst_id))
12561                 return;
12562
12563         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12564         if (!msg)
12565                 return;
12566
12567         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
12568         if (!hdr) {
12569                 nlmsg_free(msg);
12570                 return;
12571         }
12572
12573         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12574             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12575                                          wdev->netdev->ifindex)) ||
12576             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12577                               NL80211_ATTR_PAD))
12578                 goto nla_put_failure;
12579
12580         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12581                               NL80211_ATTR_PAD))
12582                 goto nla_put_failure;
12583
12584         func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
12585         if (!func_attr)
12586                 goto nla_put_failure;
12587
12588         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
12589             nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
12590                 goto nla_put_failure;
12591
12592         nla_nest_end(msg, func_attr);
12593         genlmsg_end(msg, hdr);
12594
12595         if (!wdev->owner_nlportid)
12596                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12597                                         msg, 0, NL80211_MCGRP_NAN, gfp);
12598         else
12599                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
12600                                 wdev->owner_nlportid);
12601
12602         return;
12603
12604 nla_put_failure:
12605         nlmsg_free(msg);
12606 }
12607 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
12608
12609 static int nl80211_get_protocol_features(struct sk_buff *skb,
12610                                          struct genl_info *info)
12611 {
12612         void *hdr;
12613         struct sk_buff *msg;
12614
12615         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12616         if (!msg)
12617                 return -ENOMEM;
12618
12619         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12620                              NL80211_CMD_GET_PROTOCOL_FEATURES);
12621         if (!hdr)
12622                 goto nla_put_failure;
12623
12624         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
12625                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
12626                 goto nla_put_failure;
12627
12628         genlmsg_end(msg, hdr);
12629         return genlmsg_reply(msg, info);
12630
12631  nla_put_failure:
12632         kfree_skb(msg);
12633         return -ENOBUFS;
12634 }
12635
12636 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
12637 {
12638         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12639         struct cfg80211_update_ft_ies_params ft_params;
12640         struct net_device *dev = info->user_ptr[1];
12641
12642         if (!rdev->ops->update_ft_ies)
12643                 return -EOPNOTSUPP;
12644
12645         if (!info->attrs[NL80211_ATTR_MDID] ||
12646             !info->attrs[NL80211_ATTR_IE])
12647                 return -EINVAL;
12648
12649         memset(&ft_params, 0, sizeof(ft_params));
12650         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
12651         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12652         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12653
12654         return rdev_update_ft_ies(rdev, dev, &ft_params);
12655 }
12656
12657 static int nl80211_crit_protocol_start(struct sk_buff *skb,
12658                                        struct genl_info *info)
12659 {
12660         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12661         struct wireless_dev *wdev = info->user_ptr[1];
12662         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
12663         u16 duration;
12664         int ret;
12665
12666         if (!rdev->ops->crit_proto_start)
12667                 return -EOPNOTSUPP;
12668
12669         if (WARN_ON(!rdev->ops->crit_proto_stop))
12670                 return -EINVAL;
12671
12672         if (rdev->crit_proto_nlportid)
12673                 return -EBUSY;
12674
12675         /* determine protocol if provided */
12676         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
12677                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
12678
12679         if (proto >= NUM_NL80211_CRIT_PROTO)
12680                 return -EINVAL;
12681
12682         /* timeout must be provided */
12683         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
12684                 return -EINVAL;
12685
12686         duration =
12687                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
12688
12689         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
12690                 return -ERANGE;
12691
12692         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
12693         if (!ret)
12694                 rdev->crit_proto_nlportid = info->snd_portid;
12695
12696         return ret;
12697 }
12698
12699 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
12700                                       struct genl_info *info)
12701 {
12702         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12703         struct wireless_dev *wdev = info->user_ptr[1];
12704
12705         if (!rdev->ops->crit_proto_stop)
12706                 return -EOPNOTSUPP;
12707
12708         if (rdev->crit_proto_nlportid) {
12709                 rdev->crit_proto_nlportid = 0;
12710                 rdev_crit_proto_stop(rdev, wdev);
12711         }
12712         return 0;
12713 }
12714
12715 static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd,
12716                                        struct nlattr *attr,
12717                                        struct netlink_ext_ack *extack)
12718 {
12719         if (vcmd->policy == VENDOR_CMD_RAW_DATA) {
12720                 if (attr->nla_type & NLA_F_NESTED) {
12721                         NL_SET_ERR_MSG_ATTR(extack, attr,
12722                                             "unexpected nested data");
12723                         return -EINVAL;
12724                 }
12725
12726                 return 0;
12727         }
12728
12729         if (!(attr->nla_type & NLA_F_NESTED)) {
12730                 NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data");
12731                 return -EINVAL;
12732         }
12733
12734         return nl80211_validate_nested(attr, vcmd->maxattr, vcmd->policy,
12735                                        extack);
12736 }
12737
12738 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
12739 {
12740         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12741         struct wireless_dev *wdev =
12742                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
12743         int i, err;
12744         u32 vid, subcmd;
12745
12746         if (!rdev->wiphy.vendor_commands)
12747                 return -EOPNOTSUPP;
12748
12749         if (IS_ERR(wdev)) {
12750                 err = PTR_ERR(wdev);
12751                 if (err != -EINVAL)
12752                         return err;
12753                 wdev = NULL;
12754         } else if (wdev->wiphy != &rdev->wiphy) {
12755                 return -EINVAL;
12756         }
12757
12758         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
12759             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
12760                 return -EINVAL;
12761
12762         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
12763         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
12764         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
12765                 const struct wiphy_vendor_command *vcmd;
12766                 void *data = NULL;
12767                 int len = 0;
12768
12769                 vcmd = &rdev->wiphy.vendor_commands[i];
12770
12771                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
12772                         continue;
12773
12774                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
12775                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
12776                         if (!wdev)
12777                                 return -EINVAL;
12778                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
12779                             !wdev->netdev)
12780                                 return -EINVAL;
12781
12782                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
12783                                 if (!wdev_running(wdev))
12784                                         return -ENETDOWN;
12785                         }
12786
12787                         if (!vcmd->doit)
12788                                 return -EOPNOTSUPP;
12789                 } else {
12790                         wdev = NULL;
12791                 }
12792
12793                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
12794                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
12795                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
12796
12797                         err = nl80211_vendor_check_policy(vcmd,
12798                                         info->attrs[NL80211_ATTR_VENDOR_DATA],
12799                                         info->extack);
12800                         if (err)
12801                                 return err;
12802                 }
12803
12804                 rdev->cur_cmd_info = info;
12805                 err = vcmd->doit(&rdev->wiphy, wdev, data, len);
12806                 rdev->cur_cmd_info = NULL;
12807                 return err;
12808         }
12809
12810         return -EOPNOTSUPP;
12811 }
12812
12813 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
12814                                        struct netlink_callback *cb,
12815                                        struct cfg80211_registered_device **rdev,
12816                                        struct wireless_dev **wdev)
12817 {
12818         struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
12819         u32 vid, subcmd;
12820         unsigned int i;
12821         int vcmd_idx = -1;
12822         int err;
12823         void *data = NULL;
12824         unsigned int data_len = 0;
12825
12826         if (cb->args[0]) {
12827                 /* subtract the 1 again here */
12828                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
12829                 struct wireless_dev *tmp;
12830
12831                 if (!wiphy)
12832                         return -ENODEV;
12833                 *rdev = wiphy_to_rdev(wiphy);
12834                 *wdev = NULL;
12835
12836                 if (cb->args[1]) {
12837                         list_for_each_entry(tmp, &wiphy->wdev_list, list) {
12838                                 if (tmp->identifier == cb->args[1] - 1) {
12839                                         *wdev = tmp;
12840                                         break;
12841                                 }
12842                         }
12843                 }
12844
12845                 /* keep rtnl locked in successful case */
12846                 return 0;
12847         }
12848
12849         err = nlmsg_parse_deprecated(cb->nlh,
12850                                      GENL_HDRLEN + nl80211_fam.hdrsize,
12851                                      attrbuf, nl80211_fam.maxattr,
12852                                      nl80211_policy, NULL);
12853         if (err)
12854                 return err;
12855
12856         if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
12857             !attrbuf[NL80211_ATTR_VENDOR_SUBCMD])
12858                 return -EINVAL;
12859
12860         *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf);
12861         if (IS_ERR(*wdev))
12862                 *wdev = NULL;
12863
12864         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
12865         if (IS_ERR(*rdev))
12866                 return PTR_ERR(*rdev);
12867
12868         vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
12869         subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
12870
12871         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
12872                 const struct wiphy_vendor_command *vcmd;
12873
12874                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
12875
12876                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
12877                         continue;
12878
12879                 if (!vcmd->dumpit)
12880                         return -EOPNOTSUPP;
12881
12882                 vcmd_idx = i;
12883                 break;
12884         }
12885
12886         if (vcmd_idx < 0)
12887                 return -EOPNOTSUPP;
12888
12889         if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
12890                 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
12891                 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
12892
12893                 err = nl80211_vendor_check_policy(
12894                                 &(*rdev)->wiphy.vendor_commands[vcmd_idx],
12895                                 attrbuf[NL80211_ATTR_VENDOR_DATA],
12896                                 cb->extack);
12897                 if (err)
12898                         return err;
12899         }
12900
12901         /* 0 is the first index - add 1 to parse only once */
12902         cb->args[0] = (*rdev)->wiphy_idx + 1;
12903         /* add 1 to know if it was NULL */
12904         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
12905         cb->args[2] = vcmd_idx;
12906         cb->args[3] = (unsigned long)data;
12907         cb->args[4] = data_len;
12908
12909         /* keep rtnl locked in successful case */
12910         return 0;
12911 }
12912
12913 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
12914                                    struct netlink_callback *cb)
12915 {
12916         struct cfg80211_registered_device *rdev;
12917         struct wireless_dev *wdev;
12918         unsigned int vcmd_idx;
12919         const struct wiphy_vendor_command *vcmd;
12920         void *data;
12921         int data_len;
12922         int err;
12923         struct nlattr *vendor_data;
12924
12925         rtnl_lock();
12926         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
12927         if (err)
12928                 goto out;
12929
12930         vcmd_idx = cb->args[2];
12931         data = (void *)cb->args[3];
12932         data_len = cb->args[4];
12933         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
12934
12935         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
12936                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
12937                 if (!wdev) {
12938                         err = -EINVAL;
12939                         goto out;
12940                 }
12941                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
12942                     !wdev->netdev) {
12943                         err = -EINVAL;
12944                         goto out;
12945                 }
12946
12947                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
12948                         if (!wdev_running(wdev)) {
12949                                 err = -ENETDOWN;
12950                                 goto out;
12951                         }
12952                 }
12953         }
12954
12955         while (1) {
12956                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
12957                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
12958                                            NL80211_CMD_VENDOR);
12959                 if (!hdr)
12960                         break;
12961
12962                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12963                     (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
12964                                                wdev_id(wdev),
12965                                                NL80211_ATTR_PAD))) {
12966                         genlmsg_cancel(skb, hdr);
12967                         break;
12968                 }
12969
12970                 vendor_data = nla_nest_start_noflag(skb,
12971                                                     NL80211_ATTR_VENDOR_DATA);
12972                 if (!vendor_data) {
12973                         genlmsg_cancel(skb, hdr);
12974                         break;
12975                 }
12976
12977                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
12978                                    (unsigned long *)&cb->args[5]);
12979                 nla_nest_end(skb, vendor_data);
12980
12981                 if (err == -ENOBUFS || err == -ENOENT) {
12982                         genlmsg_cancel(skb, hdr);
12983                         break;
12984                 } else if (err) {
12985                         genlmsg_cancel(skb, hdr);
12986                         goto out;
12987                 }
12988
12989                 genlmsg_end(skb, hdr);
12990         }
12991
12992         err = skb->len;
12993  out:
12994         rtnl_unlock();
12995         return err;
12996 }
12997
12998 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
12999                                            enum nl80211_commands cmd,
13000                                            enum nl80211_attrs attr,
13001                                            int approxlen)
13002 {
13003         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13004
13005         if (WARN_ON(!rdev->cur_cmd_info))
13006                 return NULL;
13007
13008         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
13009                                            rdev->cur_cmd_info->snd_portid,
13010                                            rdev->cur_cmd_info->snd_seq,
13011                                            cmd, attr, NULL, GFP_KERNEL);
13012 }
13013 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
13014
13015 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
13016 {
13017         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
13018         void *hdr = ((void **)skb->cb)[1];
13019         struct nlattr *data = ((void **)skb->cb)[2];
13020
13021         /* clear CB data for netlink core to own from now on */
13022         memset(skb->cb, 0, sizeof(skb->cb));
13023
13024         if (WARN_ON(!rdev->cur_cmd_info)) {
13025                 kfree_skb(skb);
13026                 return -EINVAL;
13027         }
13028
13029         nla_nest_end(skb, data);
13030         genlmsg_end(skb, hdr);
13031         return genlmsg_reply(skb, rdev->cur_cmd_info);
13032 }
13033 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
13034
13035 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy)
13036 {
13037         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13038
13039         if (WARN_ON(!rdev->cur_cmd_info))
13040                 return 0;
13041
13042         return rdev->cur_cmd_info->snd_portid;
13043 }
13044 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender);
13045
13046 static int nl80211_set_qos_map(struct sk_buff *skb,
13047                                struct genl_info *info)
13048 {
13049         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13050         struct cfg80211_qos_map *qos_map = NULL;
13051         struct net_device *dev = info->user_ptr[1];
13052         u8 *pos, len, num_des, des_len, des;
13053         int ret;
13054
13055         if (!rdev->ops->set_qos_map)
13056                 return -EOPNOTSUPP;
13057
13058         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
13059                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
13060                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
13061
13062                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
13063                     len > IEEE80211_QOS_MAP_LEN_MAX)
13064                         return -EINVAL;
13065
13066                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
13067                 if (!qos_map)
13068                         return -ENOMEM;
13069
13070                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
13071                 if (num_des) {
13072                         des_len = num_des *
13073                                 sizeof(struct cfg80211_dscp_exception);
13074                         memcpy(qos_map->dscp_exception, pos, des_len);
13075                         qos_map->num_des = num_des;
13076                         for (des = 0; des < num_des; des++) {
13077                                 if (qos_map->dscp_exception[des].up > 7) {
13078                                         kfree(qos_map);
13079                                         return -EINVAL;
13080                                 }
13081                         }
13082                         pos += des_len;
13083                 }
13084                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
13085         }
13086
13087         wdev_lock(dev->ieee80211_ptr);
13088         ret = nl80211_key_allowed(dev->ieee80211_ptr);
13089         if (!ret)
13090                 ret = rdev_set_qos_map(rdev, dev, qos_map);
13091         wdev_unlock(dev->ieee80211_ptr);
13092
13093         kfree(qos_map);
13094         return ret;
13095 }
13096
13097 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
13098 {
13099         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13100         struct net_device *dev = info->user_ptr[1];
13101         struct wireless_dev *wdev = dev->ieee80211_ptr;
13102         const u8 *peer;
13103         u8 tsid, up;
13104         u16 admitted_time = 0;
13105         int err;
13106
13107         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
13108                 return -EOPNOTSUPP;
13109
13110         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
13111             !info->attrs[NL80211_ATTR_USER_PRIO])
13112                 return -EINVAL;
13113
13114         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
13115         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
13116
13117         /* WMM uses TIDs 0-7 even for TSPEC */
13118         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
13119                 /* TODO: handle 802.11 TSPEC/admission control
13120                  * need more attributes for that (e.g. BA session requirement);
13121                  * change the WMM adminssion test above to allow both then
13122                  */
13123                 return -EINVAL;
13124         }
13125
13126         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
13127
13128         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
13129                 admitted_time =
13130                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
13131                 if (!admitted_time)
13132                         return -EINVAL;
13133         }
13134
13135         wdev_lock(wdev);
13136         switch (wdev->iftype) {
13137         case NL80211_IFTYPE_STATION:
13138         case NL80211_IFTYPE_P2P_CLIENT:
13139                 if (wdev->current_bss)
13140                         break;
13141                 err = -ENOTCONN;
13142                 goto out;
13143         default:
13144                 err = -EOPNOTSUPP;
13145                 goto out;
13146         }
13147
13148         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
13149
13150  out:
13151         wdev_unlock(wdev);
13152         return err;
13153 }
13154
13155 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
13156 {
13157         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13158         struct net_device *dev = info->user_ptr[1];
13159         struct wireless_dev *wdev = dev->ieee80211_ptr;
13160         const u8 *peer;
13161         u8 tsid;
13162         int err;
13163
13164         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
13165                 return -EINVAL;
13166
13167         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
13168         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
13169
13170         wdev_lock(wdev);
13171         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
13172         wdev_unlock(wdev);
13173
13174         return err;
13175 }
13176
13177 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
13178                                        struct genl_info *info)
13179 {
13180         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13181         struct net_device *dev = info->user_ptr[1];
13182         struct wireless_dev *wdev = dev->ieee80211_ptr;
13183         struct cfg80211_chan_def chandef = {};
13184         const u8 *addr;
13185         u8 oper_class;
13186         int err;
13187
13188         if (!rdev->ops->tdls_channel_switch ||
13189             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
13190                 return -EOPNOTSUPP;
13191
13192         switch (dev->ieee80211_ptr->iftype) {
13193         case NL80211_IFTYPE_STATION:
13194         case NL80211_IFTYPE_P2P_CLIENT:
13195                 break;
13196         default:
13197                 return -EOPNOTSUPP;
13198         }
13199
13200         if (!info->attrs[NL80211_ATTR_MAC] ||
13201             !info->attrs[NL80211_ATTR_OPER_CLASS])
13202                 return -EINVAL;
13203
13204         err = nl80211_parse_chandef(rdev, info, &chandef);
13205         if (err)
13206                 return err;
13207
13208         /*
13209          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
13210          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
13211          * specification is not defined for them.
13212          */
13213         if (chandef.chan->band == NL80211_BAND_2GHZ &&
13214             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
13215             chandef.width != NL80211_CHAN_WIDTH_20)
13216                 return -EINVAL;
13217
13218         /* we will be active on the TDLS link */
13219         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
13220                                            wdev->iftype))
13221                 return -EINVAL;
13222
13223         /* don't allow switching to DFS channels */
13224         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
13225                 return -EINVAL;
13226
13227         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
13228         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
13229
13230         wdev_lock(wdev);
13231         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
13232         wdev_unlock(wdev);
13233
13234         return err;
13235 }
13236
13237 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
13238                                               struct genl_info *info)
13239 {
13240         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13241         struct net_device *dev = info->user_ptr[1];
13242         struct wireless_dev *wdev = dev->ieee80211_ptr;
13243         const u8 *addr;
13244
13245         if (!rdev->ops->tdls_channel_switch ||
13246             !rdev->ops->tdls_cancel_channel_switch ||
13247             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
13248                 return -EOPNOTSUPP;
13249
13250         switch (dev->ieee80211_ptr->iftype) {
13251         case NL80211_IFTYPE_STATION:
13252         case NL80211_IFTYPE_P2P_CLIENT:
13253                 break;
13254         default:
13255                 return -EOPNOTSUPP;
13256         }
13257
13258         if (!info->attrs[NL80211_ATTR_MAC])
13259                 return -EINVAL;
13260
13261         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
13262
13263         wdev_lock(wdev);
13264         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
13265         wdev_unlock(wdev);
13266
13267         return 0;
13268 }
13269
13270 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
13271                                             struct genl_info *info)
13272 {
13273         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13274         struct net_device *dev = info->user_ptr[1];
13275         struct wireless_dev *wdev = dev->ieee80211_ptr;
13276         const struct nlattr *nla;
13277         bool enabled;
13278
13279         if (!rdev->ops->set_multicast_to_unicast)
13280                 return -EOPNOTSUPP;
13281
13282         if (wdev->iftype != NL80211_IFTYPE_AP &&
13283             wdev->iftype != NL80211_IFTYPE_P2P_GO)
13284                 return -EOPNOTSUPP;
13285
13286         nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
13287         enabled = nla_get_flag(nla);
13288
13289         return rdev_set_multicast_to_unicast(rdev, dev, enabled);
13290 }
13291
13292 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
13293 {
13294         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13295         struct net_device *dev = info->user_ptr[1];
13296         struct wireless_dev *wdev = dev->ieee80211_ptr;
13297         struct cfg80211_pmk_conf pmk_conf = {};
13298         int ret;
13299
13300         if (wdev->iftype != NL80211_IFTYPE_STATION &&
13301             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
13302                 return -EOPNOTSUPP;
13303
13304         if (!wiphy_ext_feature_isset(&rdev->wiphy,
13305                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
13306                 return -EOPNOTSUPP;
13307
13308         if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
13309                 return -EINVAL;
13310
13311         wdev_lock(wdev);
13312         if (!wdev->current_bss) {
13313                 ret = -ENOTCONN;
13314                 goto out;
13315         }
13316
13317         pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
13318         if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) {
13319                 ret = -EINVAL;
13320                 goto out;
13321         }
13322
13323         pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
13324         pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
13325         if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
13326             pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
13327                 ret = -EINVAL;
13328                 goto out;
13329         }
13330
13331         if (info->attrs[NL80211_ATTR_PMKR0_NAME]) {
13332                 int r0_name_len = nla_len(info->attrs[NL80211_ATTR_PMKR0_NAME]);
13333
13334                 if (r0_name_len != WLAN_PMK_NAME_LEN) {
13335                         ret = -EINVAL;
13336                         goto out;
13337                 }
13338
13339                 pmk_conf.pmk_r0_name =
13340                         nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
13341         }
13342
13343         ret = rdev_set_pmk(rdev, dev, &pmk_conf);
13344 out:
13345         wdev_unlock(wdev);
13346         return ret;
13347 }
13348
13349 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
13350 {
13351         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13352         struct net_device *dev = info->user_ptr[1];
13353         struct wireless_dev *wdev = dev->ieee80211_ptr;
13354         const u8 *aa;
13355         int ret;
13356
13357         if (wdev->iftype != NL80211_IFTYPE_STATION &&
13358             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
13359                 return -EOPNOTSUPP;
13360
13361         if (!wiphy_ext_feature_isset(&rdev->wiphy,
13362                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
13363                 return -EOPNOTSUPP;
13364
13365         if (!info->attrs[NL80211_ATTR_MAC])
13366                 return -EINVAL;
13367
13368         wdev_lock(wdev);
13369         aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
13370         ret = rdev_del_pmk(rdev, dev, aa);
13371         wdev_unlock(wdev);
13372
13373         return ret;
13374 }
13375
13376 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
13377 {
13378         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13379         struct net_device *dev = info->user_ptr[1];
13380         struct cfg80211_external_auth_params params;
13381
13382         if (!rdev->ops->external_auth)
13383                 return -EOPNOTSUPP;
13384
13385         if (!info->attrs[NL80211_ATTR_SSID] &&
13386             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
13387             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
13388                 return -EINVAL;
13389
13390         if (!info->attrs[NL80211_ATTR_BSSID])
13391                 return -EINVAL;
13392
13393         if (!info->attrs[NL80211_ATTR_STATUS_CODE])
13394                 return -EINVAL;
13395
13396         memset(&params, 0, sizeof(params));
13397
13398         if (info->attrs[NL80211_ATTR_SSID]) {
13399                 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
13400                 if (params.ssid.ssid_len == 0 ||
13401                     params.ssid.ssid_len > IEEE80211_MAX_SSID_LEN)
13402                         return -EINVAL;
13403                 memcpy(params.ssid.ssid,
13404                        nla_data(info->attrs[NL80211_ATTR_SSID]),
13405                        params.ssid.ssid_len);
13406         }
13407
13408         memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
13409                ETH_ALEN);
13410
13411         params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
13412
13413         if (info->attrs[NL80211_ATTR_PMKID])
13414                 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
13415
13416         return rdev_external_auth(rdev, dev, &params);
13417 }
13418
13419 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
13420 {
13421         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13422         struct net_device *dev = info->user_ptr[1];
13423         struct wireless_dev *wdev = dev->ieee80211_ptr;
13424         const u8 *buf;
13425         size_t len;
13426         u8 *dest;
13427         u16 proto;
13428         bool noencrypt;
13429         int err;
13430
13431         if (!wiphy_ext_feature_isset(&rdev->wiphy,
13432                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
13433                 return -EOPNOTSUPP;
13434
13435         if (!rdev->ops->tx_control_port)
13436                 return -EOPNOTSUPP;
13437
13438         if (!info->attrs[NL80211_ATTR_FRAME] ||
13439             !info->attrs[NL80211_ATTR_MAC] ||
13440             !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
13441                 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
13442                 return -EINVAL;
13443         }
13444
13445         wdev_lock(wdev);
13446
13447         switch (wdev->iftype) {
13448         case NL80211_IFTYPE_AP:
13449         case NL80211_IFTYPE_P2P_GO:
13450         case NL80211_IFTYPE_MESH_POINT:
13451                 break;
13452         case NL80211_IFTYPE_ADHOC:
13453         case NL80211_IFTYPE_STATION:
13454         case NL80211_IFTYPE_P2P_CLIENT:
13455                 if (wdev->current_bss)
13456                         break;
13457                 err = -ENOTCONN;
13458                 goto out;
13459         default:
13460                 err = -EOPNOTSUPP;
13461                 goto out;
13462         }
13463
13464         wdev_unlock(wdev);
13465
13466         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
13467         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
13468         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
13469         proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
13470         noencrypt =
13471                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
13472
13473         return rdev_tx_control_port(rdev, dev, buf, len,
13474                                     dest, cpu_to_be16(proto), noencrypt);
13475
13476  out:
13477         wdev_unlock(wdev);
13478         return err;
13479 }
13480
13481 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
13482                                            struct genl_info *info)
13483 {
13484         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13485         struct net_device *dev = info->user_ptr[1];
13486         struct wireless_dev *wdev = dev->ieee80211_ptr;
13487         struct cfg80211_ftm_responder_stats ftm_stats = {};
13488         struct sk_buff *msg;
13489         void *hdr;
13490         struct nlattr *ftm_stats_attr;
13491         int err;
13492
13493         if (wdev->iftype != NL80211_IFTYPE_AP || !wdev->beacon_interval)
13494                 return -EOPNOTSUPP;
13495
13496         err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
13497         if (err)
13498                 return err;
13499
13500         if (!ftm_stats.filled)
13501                 return -ENODATA;
13502
13503         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13504         if (!msg)
13505                 return -ENOMEM;
13506
13507         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13508                              NL80211_CMD_GET_FTM_RESPONDER_STATS);
13509         if (!hdr)
13510                 return -ENOBUFS;
13511
13512         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
13513                 goto nla_put_failure;
13514
13515         ftm_stats_attr = nla_nest_start_noflag(msg,
13516                                                NL80211_ATTR_FTM_RESPONDER_STATS);
13517         if (!ftm_stats_attr)
13518                 goto nla_put_failure;
13519
13520 #define SET_FTM(field, name, type)                                       \
13521         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
13522             nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name,            \
13523                              ftm_stats.field))                           \
13524                 goto nla_put_failure; } while (0)
13525 #define SET_FTM_U64(field, name)                                         \
13526         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
13527             nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name,           \
13528                               ftm_stats.field, NL80211_FTM_STATS_PAD))   \
13529                 goto nla_put_failure; } while (0)
13530
13531         SET_FTM(success_num, SUCCESS_NUM, u32);
13532         SET_FTM(partial_num, PARTIAL_NUM, u32);
13533         SET_FTM(failed_num, FAILED_NUM, u32);
13534         SET_FTM(asap_num, ASAP_NUM, u32);
13535         SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
13536         SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
13537         SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
13538         SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
13539         SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
13540 #undef SET_FTM
13541
13542         nla_nest_end(msg, ftm_stats_attr);
13543
13544         genlmsg_end(msg, hdr);
13545         return genlmsg_reply(msg, info);
13546
13547 nla_put_failure:
13548         nlmsg_free(msg);
13549         return -ENOBUFS;
13550 }
13551
13552 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info)
13553 {
13554         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13555         struct cfg80211_update_owe_info owe_info;
13556         struct net_device *dev = info->user_ptr[1];
13557
13558         if (!rdev->ops->update_owe_info)
13559                 return -EOPNOTSUPP;
13560
13561         if (!info->attrs[NL80211_ATTR_STATUS_CODE] ||
13562             !info->attrs[NL80211_ATTR_MAC])
13563                 return -EINVAL;
13564
13565         memset(&owe_info, 0, sizeof(owe_info));
13566         owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
13567         nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN);
13568
13569         if (info->attrs[NL80211_ATTR_IE]) {
13570                 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
13571                 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
13572         }
13573
13574         return rdev_update_owe_info(rdev, dev, &owe_info);
13575 }
13576
13577 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info)
13578 {
13579         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13580         struct net_device *dev = info->user_ptr[1];
13581         struct wireless_dev *wdev = dev->ieee80211_ptr;
13582         struct station_info sinfo = {};
13583         const u8 *buf;
13584         size_t len;
13585         u8 *dest;
13586         int err;
13587
13588         if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station)
13589                 return -EOPNOTSUPP;
13590
13591         if (!info->attrs[NL80211_ATTR_MAC] ||
13592             !info->attrs[NL80211_ATTR_FRAME]) {
13593                 GENL_SET_ERR_MSG(info, "Frame or MAC missing");
13594                 return -EINVAL;
13595         }
13596
13597         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
13598                 return -EOPNOTSUPP;
13599
13600         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
13601         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
13602         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
13603
13604         if (len < sizeof(struct ethhdr))
13605                 return -EINVAL;
13606
13607         if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) ||
13608             !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr))
13609                 return -EINVAL;
13610
13611         err = rdev_get_station(rdev, dev, dest, &sinfo);
13612         if (err)
13613                 return err;
13614
13615         return rdev_probe_mesh_link(rdev, dev, dest, buf, len);
13616 }
13617
13618 #define NL80211_FLAG_NEED_WIPHY         0x01
13619 #define NL80211_FLAG_NEED_NETDEV        0x02
13620 #define NL80211_FLAG_NEED_RTNL          0x04
13621 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
13622 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
13623                                          NL80211_FLAG_CHECK_NETDEV_UP)
13624 #define NL80211_FLAG_NEED_WDEV          0x10
13625 /* If a netdev is associated, it must be UP, P2P must be started */
13626 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
13627                                          NL80211_FLAG_CHECK_NETDEV_UP)
13628 #define NL80211_FLAG_CLEAR_SKB          0x20
13629
13630 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
13631                             struct genl_info *info)
13632 {
13633         struct cfg80211_registered_device *rdev;
13634         struct wireless_dev *wdev;
13635         struct net_device *dev;
13636         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
13637
13638         if (rtnl)
13639                 rtnl_lock();
13640
13641         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
13642                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
13643                 if (IS_ERR(rdev)) {
13644                         if (rtnl)
13645                                 rtnl_unlock();
13646                         return PTR_ERR(rdev);
13647                 }
13648                 info->user_ptr[0] = rdev;
13649         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
13650                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
13651                 ASSERT_RTNL();
13652
13653                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
13654                                                   info->attrs);
13655                 if (IS_ERR(wdev)) {
13656                         if (rtnl)
13657                                 rtnl_unlock();
13658                         return PTR_ERR(wdev);
13659                 }
13660
13661                 dev = wdev->netdev;
13662                 rdev = wiphy_to_rdev(wdev->wiphy);
13663
13664                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
13665                         if (!dev) {
13666                                 if (rtnl)
13667                                         rtnl_unlock();
13668                                 return -EINVAL;
13669                         }
13670
13671                         info->user_ptr[1] = dev;
13672                 } else {
13673                         info->user_ptr[1] = wdev;
13674                 }
13675
13676                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
13677                     !wdev_running(wdev)) {
13678                         if (rtnl)
13679                                 rtnl_unlock();
13680                         return -ENETDOWN;
13681                 }
13682
13683                 if (dev)
13684                         dev_hold(dev);
13685
13686                 info->user_ptr[0] = rdev;
13687         }
13688
13689         return 0;
13690 }
13691
13692 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
13693                               struct genl_info *info)
13694 {
13695         if (info->user_ptr[1]) {
13696                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
13697                         struct wireless_dev *wdev = info->user_ptr[1];
13698
13699                         if (wdev->netdev)
13700                                 dev_put(wdev->netdev);
13701                 } else {
13702                         dev_put(info->user_ptr[1]);
13703                 }
13704         }
13705
13706         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
13707                 rtnl_unlock();
13708
13709         /* If needed, clear the netlink message payload from the SKB
13710          * as it might contain key data that shouldn't stick around on
13711          * the heap after the SKB is freed. The netlink message header
13712          * is still needed for further processing, so leave it intact.
13713          */
13714         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
13715                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
13716
13717                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
13718         }
13719 }
13720
13721 static const struct genl_ops nl80211_ops[] = {
13722         {
13723                 .cmd = NL80211_CMD_GET_WIPHY,
13724                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13725                 .doit = nl80211_get_wiphy,
13726                 .dumpit = nl80211_dump_wiphy,
13727                 .done = nl80211_dump_wiphy_done,
13728                 /* can be retrieved by unprivileged users */
13729                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13730                                   NL80211_FLAG_NEED_RTNL,
13731         },
13732         {
13733                 .cmd = NL80211_CMD_SET_WIPHY,
13734                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13735                 .doit = nl80211_set_wiphy,
13736                 .flags = GENL_UNS_ADMIN_PERM,
13737                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13738         },
13739         {
13740                 .cmd = NL80211_CMD_GET_INTERFACE,
13741                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13742                 .doit = nl80211_get_interface,
13743                 .dumpit = nl80211_dump_interface,
13744                 /* can be retrieved by unprivileged users */
13745                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13746                                   NL80211_FLAG_NEED_RTNL,
13747         },
13748         {
13749                 .cmd = NL80211_CMD_SET_INTERFACE,
13750                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13751                 .doit = nl80211_set_interface,
13752                 .flags = GENL_UNS_ADMIN_PERM,
13753                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13754                                   NL80211_FLAG_NEED_RTNL,
13755         },
13756         {
13757                 .cmd = NL80211_CMD_NEW_INTERFACE,
13758                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13759                 .doit = nl80211_new_interface,
13760                 .flags = GENL_UNS_ADMIN_PERM,
13761                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13762                                   NL80211_FLAG_NEED_RTNL,
13763         },
13764         {
13765                 .cmd = NL80211_CMD_DEL_INTERFACE,
13766                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13767                 .doit = nl80211_del_interface,
13768                 .flags = GENL_UNS_ADMIN_PERM,
13769                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13770                                   NL80211_FLAG_NEED_RTNL,
13771         },
13772         {
13773                 .cmd = NL80211_CMD_GET_KEY,
13774                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13775                 .doit = nl80211_get_key,
13776                 .flags = GENL_UNS_ADMIN_PERM,
13777                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13778                                   NL80211_FLAG_NEED_RTNL,
13779         },
13780         {
13781                 .cmd = NL80211_CMD_SET_KEY,
13782                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13783                 .doit = nl80211_set_key,
13784                 .flags = GENL_UNS_ADMIN_PERM,
13785                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13786                                   NL80211_FLAG_NEED_RTNL |
13787                                   NL80211_FLAG_CLEAR_SKB,
13788         },
13789         {
13790                 .cmd = NL80211_CMD_NEW_KEY,
13791                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13792                 .doit = nl80211_new_key,
13793                 .flags = GENL_UNS_ADMIN_PERM,
13794                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13795                                   NL80211_FLAG_NEED_RTNL |
13796                                   NL80211_FLAG_CLEAR_SKB,
13797         },
13798         {
13799                 .cmd = NL80211_CMD_DEL_KEY,
13800                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13801                 .doit = nl80211_del_key,
13802                 .flags = GENL_UNS_ADMIN_PERM,
13803                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13804                                   NL80211_FLAG_NEED_RTNL,
13805         },
13806         {
13807                 .cmd = NL80211_CMD_SET_BEACON,
13808                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13809                 .flags = GENL_UNS_ADMIN_PERM,
13810                 .doit = nl80211_set_beacon,
13811                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13812                                   NL80211_FLAG_NEED_RTNL,
13813         },
13814         {
13815                 .cmd = NL80211_CMD_START_AP,
13816                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13817                 .flags = GENL_UNS_ADMIN_PERM,
13818                 .doit = nl80211_start_ap,
13819                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13820                                   NL80211_FLAG_NEED_RTNL,
13821         },
13822         {
13823                 .cmd = NL80211_CMD_STOP_AP,
13824                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13825                 .flags = GENL_UNS_ADMIN_PERM,
13826                 .doit = nl80211_stop_ap,
13827                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13828                                   NL80211_FLAG_NEED_RTNL,
13829         },
13830         {
13831                 .cmd = NL80211_CMD_GET_STATION,
13832                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13833                 .doit = nl80211_get_station,
13834                 .dumpit = nl80211_dump_station,
13835                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13836                                   NL80211_FLAG_NEED_RTNL,
13837         },
13838         {
13839                 .cmd = NL80211_CMD_SET_STATION,
13840                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13841                 .doit = nl80211_set_station,
13842                 .flags = GENL_UNS_ADMIN_PERM,
13843                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13844                                   NL80211_FLAG_NEED_RTNL,
13845         },
13846         {
13847                 .cmd = NL80211_CMD_NEW_STATION,
13848                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13849                 .doit = nl80211_new_station,
13850                 .flags = GENL_UNS_ADMIN_PERM,
13851                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13852                                   NL80211_FLAG_NEED_RTNL,
13853         },
13854         {
13855                 .cmd = NL80211_CMD_DEL_STATION,
13856                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13857                 .doit = nl80211_del_station,
13858                 .flags = GENL_UNS_ADMIN_PERM,
13859                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13860                                   NL80211_FLAG_NEED_RTNL,
13861         },
13862         {
13863                 .cmd = NL80211_CMD_GET_MPATH,
13864                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13865                 .doit = nl80211_get_mpath,
13866                 .dumpit = nl80211_dump_mpath,
13867                 .flags = GENL_UNS_ADMIN_PERM,
13868                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13869                                   NL80211_FLAG_NEED_RTNL,
13870         },
13871         {
13872                 .cmd = NL80211_CMD_GET_MPP,
13873                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13874                 .doit = nl80211_get_mpp,
13875                 .dumpit = nl80211_dump_mpp,
13876                 .flags = GENL_UNS_ADMIN_PERM,
13877                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13878                                   NL80211_FLAG_NEED_RTNL,
13879         },
13880         {
13881                 .cmd = NL80211_CMD_SET_MPATH,
13882                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13883                 .doit = nl80211_set_mpath,
13884                 .flags = GENL_UNS_ADMIN_PERM,
13885                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13886                                   NL80211_FLAG_NEED_RTNL,
13887         },
13888         {
13889                 .cmd = NL80211_CMD_NEW_MPATH,
13890                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13891                 .doit = nl80211_new_mpath,
13892                 .flags = GENL_UNS_ADMIN_PERM,
13893                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13894                                   NL80211_FLAG_NEED_RTNL,
13895         },
13896         {
13897                 .cmd = NL80211_CMD_DEL_MPATH,
13898                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13899                 .doit = nl80211_del_mpath,
13900                 .flags = GENL_UNS_ADMIN_PERM,
13901                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13902                                   NL80211_FLAG_NEED_RTNL,
13903         },
13904         {
13905                 .cmd = NL80211_CMD_SET_BSS,
13906                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13907                 .doit = nl80211_set_bss,
13908                 .flags = GENL_UNS_ADMIN_PERM,
13909                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13910                                   NL80211_FLAG_NEED_RTNL,
13911         },
13912         {
13913                 .cmd = NL80211_CMD_GET_REG,
13914                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13915                 .doit = nl80211_get_reg_do,
13916                 .dumpit = nl80211_get_reg_dump,
13917                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13918                 /* can be retrieved by unprivileged users */
13919         },
13920 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
13921         {
13922                 .cmd = NL80211_CMD_SET_REG,
13923                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13924                 .doit = nl80211_set_reg,
13925                 .flags = GENL_ADMIN_PERM,
13926                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13927         },
13928 #endif
13929         {
13930                 .cmd = NL80211_CMD_REQ_SET_REG,
13931                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13932                 .doit = nl80211_req_set_reg,
13933                 .flags = GENL_ADMIN_PERM,
13934         },
13935         {
13936                 .cmd = NL80211_CMD_RELOAD_REGDB,
13937                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13938                 .doit = nl80211_reload_regdb,
13939                 .flags = GENL_ADMIN_PERM,
13940         },
13941         {
13942                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
13943                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13944                 .doit = nl80211_get_mesh_config,
13945                 /* can be retrieved by unprivileged users */
13946                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13947                                   NL80211_FLAG_NEED_RTNL,
13948         },
13949         {
13950                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
13951                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13952                 .doit = nl80211_update_mesh_config,
13953                 .flags = GENL_UNS_ADMIN_PERM,
13954                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13955                                   NL80211_FLAG_NEED_RTNL,
13956         },
13957         {
13958                 .cmd = NL80211_CMD_TRIGGER_SCAN,
13959                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13960                 .doit = nl80211_trigger_scan,
13961                 .flags = GENL_UNS_ADMIN_PERM,
13962                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13963                                   NL80211_FLAG_NEED_RTNL,
13964         },
13965         {
13966                 .cmd = NL80211_CMD_ABORT_SCAN,
13967                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13968                 .doit = nl80211_abort_scan,
13969                 .flags = GENL_UNS_ADMIN_PERM,
13970                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13971                                   NL80211_FLAG_NEED_RTNL,
13972         },
13973         {
13974                 .cmd = NL80211_CMD_GET_SCAN,
13975                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13976                 .dumpit = nl80211_dump_scan,
13977         },
13978         {
13979                 .cmd = NL80211_CMD_START_SCHED_SCAN,
13980                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13981                 .doit = nl80211_start_sched_scan,
13982                 .flags = GENL_UNS_ADMIN_PERM,
13983                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13984                                   NL80211_FLAG_NEED_RTNL,
13985         },
13986         {
13987                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
13988                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13989                 .doit = nl80211_stop_sched_scan,
13990                 .flags = GENL_UNS_ADMIN_PERM,
13991                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13992                                   NL80211_FLAG_NEED_RTNL,
13993         },
13994         {
13995                 .cmd = NL80211_CMD_AUTHENTICATE,
13996                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13997                 .doit = nl80211_authenticate,
13998                 .flags = GENL_UNS_ADMIN_PERM,
13999                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14000                                   NL80211_FLAG_NEED_RTNL |
14001                                   NL80211_FLAG_CLEAR_SKB,
14002         },
14003         {
14004                 .cmd = NL80211_CMD_ASSOCIATE,
14005                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14006                 .doit = nl80211_associate,
14007                 .flags = GENL_UNS_ADMIN_PERM,
14008                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14009                                   NL80211_FLAG_NEED_RTNL |
14010                                   NL80211_FLAG_CLEAR_SKB,
14011         },
14012         {
14013                 .cmd = NL80211_CMD_DEAUTHENTICATE,
14014                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14015                 .doit = nl80211_deauthenticate,
14016                 .flags = GENL_UNS_ADMIN_PERM,
14017                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14018                                   NL80211_FLAG_NEED_RTNL,
14019         },
14020         {
14021                 .cmd = NL80211_CMD_DISASSOCIATE,
14022                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14023                 .doit = nl80211_disassociate,
14024                 .flags = GENL_UNS_ADMIN_PERM,
14025                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14026                                   NL80211_FLAG_NEED_RTNL,
14027         },
14028         {
14029                 .cmd = NL80211_CMD_JOIN_IBSS,
14030                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14031                 .doit = nl80211_join_ibss,
14032                 .flags = GENL_UNS_ADMIN_PERM,
14033                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14034                                   NL80211_FLAG_NEED_RTNL,
14035         },
14036         {
14037                 .cmd = NL80211_CMD_LEAVE_IBSS,
14038                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14039                 .doit = nl80211_leave_ibss,
14040                 .flags = GENL_UNS_ADMIN_PERM,
14041                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14042                                   NL80211_FLAG_NEED_RTNL,
14043         },
14044 #ifdef CONFIG_NL80211_TESTMODE
14045         {
14046                 .cmd = NL80211_CMD_TESTMODE,
14047                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14048                 .doit = nl80211_testmode_do,
14049                 .dumpit = nl80211_testmode_dump,
14050                 .flags = GENL_UNS_ADMIN_PERM,
14051                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14052                                   NL80211_FLAG_NEED_RTNL,
14053         },
14054 #endif
14055         {
14056                 .cmd = NL80211_CMD_CONNECT,
14057                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14058                 .doit = nl80211_connect,
14059                 .flags = GENL_UNS_ADMIN_PERM,
14060                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14061                                   NL80211_FLAG_NEED_RTNL |
14062                                   NL80211_FLAG_CLEAR_SKB,
14063         },
14064         {
14065                 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
14066                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14067                 .doit = nl80211_update_connect_params,
14068                 .flags = GENL_ADMIN_PERM,
14069                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14070                                   NL80211_FLAG_NEED_RTNL |
14071                                   NL80211_FLAG_CLEAR_SKB,
14072         },
14073         {
14074                 .cmd = NL80211_CMD_DISCONNECT,
14075                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14076                 .doit = nl80211_disconnect,
14077                 .flags = GENL_UNS_ADMIN_PERM,
14078                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14079                                   NL80211_FLAG_NEED_RTNL,
14080         },
14081         {
14082                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
14083                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14084                 .doit = nl80211_wiphy_netns,
14085                 .flags = GENL_UNS_ADMIN_PERM,
14086                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14087                                   NL80211_FLAG_NEED_RTNL,
14088         },
14089         {
14090                 .cmd = NL80211_CMD_GET_SURVEY,
14091                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14092                 .dumpit = nl80211_dump_survey,
14093         },
14094         {
14095                 .cmd = NL80211_CMD_SET_PMKSA,
14096                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14097                 .doit = nl80211_setdel_pmksa,
14098                 .flags = GENL_UNS_ADMIN_PERM,
14099                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14100                                   NL80211_FLAG_NEED_RTNL |
14101                                   NL80211_FLAG_CLEAR_SKB,
14102         },
14103         {
14104                 .cmd = NL80211_CMD_DEL_PMKSA,
14105                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14106                 .doit = nl80211_setdel_pmksa,
14107                 .flags = GENL_UNS_ADMIN_PERM,
14108                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14109                                   NL80211_FLAG_NEED_RTNL,
14110         },
14111         {
14112                 .cmd = NL80211_CMD_FLUSH_PMKSA,
14113                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14114                 .doit = nl80211_flush_pmksa,
14115                 .flags = GENL_UNS_ADMIN_PERM,
14116                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14117                                   NL80211_FLAG_NEED_RTNL,
14118         },
14119         {
14120                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
14121                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14122                 .doit = nl80211_remain_on_channel,
14123                 .flags = GENL_UNS_ADMIN_PERM,
14124                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14125                                   NL80211_FLAG_NEED_RTNL,
14126         },
14127         {
14128                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
14129                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14130                 .doit = nl80211_cancel_remain_on_channel,
14131                 .flags = GENL_UNS_ADMIN_PERM,
14132                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14133                                   NL80211_FLAG_NEED_RTNL,
14134         },
14135         {
14136                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
14137                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14138                 .doit = nl80211_set_tx_bitrate_mask,
14139                 .flags = GENL_UNS_ADMIN_PERM,
14140                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14141                                   NL80211_FLAG_NEED_RTNL,
14142         },
14143         {
14144                 .cmd = NL80211_CMD_REGISTER_FRAME,
14145                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14146                 .doit = nl80211_register_mgmt,
14147                 .flags = GENL_UNS_ADMIN_PERM,
14148                 .internal_flags = NL80211_FLAG_NEED_WDEV |
14149                                   NL80211_FLAG_NEED_RTNL,
14150         },
14151         {
14152                 .cmd = NL80211_CMD_FRAME,
14153                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14154                 .doit = nl80211_tx_mgmt,
14155                 .flags = GENL_UNS_ADMIN_PERM,
14156                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14157                                   NL80211_FLAG_NEED_RTNL,
14158         },
14159         {
14160                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
14161                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14162                 .doit = nl80211_tx_mgmt_cancel_wait,
14163                 .flags = GENL_UNS_ADMIN_PERM,
14164                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14165                                   NL80211_FLAG_NEED_RTNL,
14166         },
14167         {
14168                 .cmd = NL80211_CMD_SET_POWER_SAVE,
14169                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14170                 .doit = nl80211_set_power_save,
14171                 .flags = GENL_UNS_ADMIN_PERM,
14172                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14173                                   NL80211_FLAG_NEED_RTNL,
14174         },
14175         {
14176                 .cmd = NL80211_CMD_GET_POWER_SAVE,
14177                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14178                 .doit = nl80211_get_power_save,
14179                 /* can be retrieved by unprivileged users */
14180                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14181                                   NL80211_FLAG_NEED_RTNL,
14182         },
14183         {
14184                 .cmd = NL80211_CMD_SET_CQM,
14185                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14186                 .doit = nl80211_set_cqm,
14187                 .flags = GENL_UNS_ADMIN_PERM,
14188                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14189                                   NL80211_FLAG_NEED_RTNL,
14190         },
14191         {
14192                 .cmd = NL80211_CMD_SET_CHANNEL,
14193                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14194                 .doit = nl80211_set_channel,
14195                 .flags = GENL_UNS_ADMIN_PERM,
14196                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14197                                   NL80211_FLAG_NEED_RTNL,
14198         },
14199         {
14200                 .cmd = NL80211_CMD_SET_WDS_PEER,
14201                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14202                 .doit = nl80211_set_wds_peer,
14203                 .flags = GENL_UNS_ADMIN_PERM,
14204                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14205                                   NL80211_FLAG_NEED_RTNL,
14206         },
14207         {
14208                 .cmd = NL80211_CMD_JOIN_MESH,
14209                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14210                 .doit = nl80211_join_mesh,
14211                 .flags = GENL_UNS_ADMIN_PERM,
14212                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14213                                   NL80211_FLAG_NEED_RTNL,
14214         },
14215         {
14216                 .cmd = NL80211_CMD_LEAVE_MESH,
14217                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14218                 .doit = nl80211_leave_mesh,
14219                 .flags = GENL_UNS_ADMIN_PERM,
14220                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14221                                   NL80211_FLAG_NEED_RTNL,
14222         },
14223         {
14224                 .cmd = NL80211_CMD_JOIN_OCB,
14225                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14226                 .doit = nl80211_join_ocb,
14227                 .flags = GENL_UNS_ADMIN_PERM,
14228                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14229                                   NL80211_FLAG_NEED_RTNL,
14230         },
14231         {
14232                 .cmd = NL80211_CMD_LEAVE_OCB,
14233                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14234                 .doit = nl80211_leave_ocb,
14235                 .flags = GENL_UNS_ADMIN_PERM,
14236                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14237                                   NL80211_FLAG_NEED_RTNL,
14238         },
14239 #ifdef CONFIG_PM
14240         {
14241                 .cmd = NL80211_CMD_GET_WOWLAN,
14242                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14243                 .doit = nl80211_get_wowlan,
14244                 /* can be retrieved by unprivileged users */
14245                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14246                                   NL80211_FLAG_NEED_RTNL,
14247         },
14248         {
14249                 .cmd = NL80211_CMD_SET_WOWLAN,
14250                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14251                 .doit = nl80211_set_wowlan,
14252                 .flags = GENL_UNS_ADMIN_PERM,
14253                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14254                                   NL80211_FLAG_NEED_RTNL,
14255         },
14256 #endif
14257         {
14258                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
14259                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14260                 .doit = nl80211_set_rekey_data,
14261                 .flags = GENL_UNS_ADMIN_PERM,
14262                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14263                                   NL80211_FLAG_NEED_RTNL |
14264                                   NL80211_FLAG_CLEAR_SKB,
14265         },
14266         {
14267                 .cmd = NL80211_CMD_TDLS_MGMT,
14268                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14269                 .doit = nl80211_tdls_mgmt,
14270                 .flags = GENL_UNS_ADMIN_PERM,
14271                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14272                                   NL80211_FLAG_NEED_RTNL,
14273         },
14274         {
14275                 .cmd = NL80211_CMD_TDLS_OPER,
14276                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14277                 .doit = nl80211_tdls_oper,
14278                 .flags = GENL_UNS_ADMIN_PERM,
14279                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14280                                   NL80211_FLAG_NEED_RTNL,
14281         },
14282         {
14283                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
14284                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14285                 .doit = nl80211_register_unexpected_frame,
14286                 .flags = GENL_UNS_ADMIN_PERM,
14287                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14288                                   NL80211_FLAG_NEED_RTNL,
14289         },
14290         {
14291                 .cmd = NL80211_CMD_PROBE_CLIENT,
14292                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14293                 .doit = nl80211_probe_client,
14294                 .flags = GENL_UNS_ADMIN_PERM,
14295                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14296                                   NL80211_FLAG_NEED_RTNL,
14297         },
14298         {
14299                 .cmd = NL80211_CMD_REGISTER_BEACONS,
14300                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14301                 .doit = nl80211_register_beacons,
14302                 .flags = GENL_UNS_ADMIN_PERM,
14303                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14304                                   NL80211_FLAG_NEED_RTNL,
14305         },
14306         {
14307                 .cmd = NL80211_CMD_SET_NOACK_MAP,
14308                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14309                 .doit = nl80211_set_noack_map,
14310                 .flags = GENL_UNS_ADMIN_PERM,
14311                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14312                                   NL80211_FLAG_NEED_RTNL,
14313         },
14314         {
14315                 .cmd = NL80211_CMD_START_P2P_DEVICE,
14316                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14317                 .doit = nl80211_start_p2p_device,
14318                 .flags = GENL_UNS_ADMIN_PERM,
14319                 .internal_flags = NL80211_FLAG_NEED_WDEV |
14320                                   NL80211_FLAG_NEED_RTNL,
14321         },
14322         {
14323                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
14324                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14325                 .doit = nl80211_stop_p2p_device,
14326                 .flags = GENL_UNS_ADMIN_PERM,
14327                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14328                                   NL80211_FLAG_NEED_RTNL,
14329         },
14330         {
14331                 .cmd = NL80211_CMD_START_NAN,
14332                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14333                 .doit = nl80211_start_nan,
14334                 .flags = GENL_ADMIN_PERM,
14335                 .internal_flags = NL80211_FLAG_NEED_WDEV |
14336                                   NL80211_FLAG_NEED_RTNL,
14337         },
14338         {
14339                 .cmd = NL80211_CMD_STOP_NAN,
14340                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14341                 .doit = nl80211_stop_nan,
14342                 .flags = GENL_ADMIN_PERM,
14343                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14344                                   NL80211_FLAG_NEED_RTNL,
14345         },
14346         {
14347                 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
14348                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14349                 .doit = nl80211_nan_add_func,
14350                 .flags = GENL_ADMIN_PERM,
14351                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14352                                   NL80211_FLAG_NEED_RTNL,
14353         },
14354         {
14355                 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
14356                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14357                 .doit = nl80211_nan_del_func,
14358                 .flags = GENL_ADMIN_PERM,
14359                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14360                                   NL80211_FLAG_NEED_RTNL,
14361         },
14362         {
14363                 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
14364                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14365                 .doit = nl80211_nan_change_config,
14366                 .flags = GENL_ADMIN_PERM,
14367                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14368                                   NL80211_FLAG_NEED_RTNL,
14369         },
14370         {
14371                 .cmd = NL80211_CMD_SET_MCAST_RATE,
14372                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14373                 .doit = nl80211_set_mcast_rate,
14374                 .flags = GENL_UNS_ADMIN_PERM,
14375                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14376                                   NL80211_FLAG_NEED_RTNL,
14377         },
14378         {
14379                 .cmd = NL80211_CMD_SET_MAC_ACL,
14380                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14381                 .doit = nl80211_set_mac_acl,
14382                 .flags = GENL_UNS_ADMIN_PERM,
14383                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14384                                   NL80211_FLAG_NEED_RTNL,
14385         },
14386         {
14387                 .cmd = NL80211_CMD_RADAR_DETECT,
14388                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14389                 .doit = nl80211_start_radar_detection,
14390                 .flags = GENL_UNS_ADMIN_PERM,
14391                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14392                                   NL80211_FLAG_NEED_RTNL,
14393         },
14394         {
14395                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
14396                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14397                 .doit = nl80211_get_protocol_features,
14398         },
14399         {
14400                 .cmd = NL80211_CMD_UPDATE_FT_IES,
14401                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14402                 .doit = nl80211_update_ft_ies,
14403                 .flags = GENL_UNS_ADMIN_PERM,
14404                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14405                                   NL80211_FLAG_NEED_RTNL,
14406         },
14407         {
14408                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
14409                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14410                 .doit = nl80211_crit_protocol_start,
14411                 .flags = GENL_UNS_ADMIN_PERM,
14412                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14413                                   NL80211_FLAG_NEED_RTNL,
14414         },
14415         {
14416                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
14417                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14418                 .doit = nl80211_crit_protocol_stop,
14419                 .flags = GENL_UNS_ADMIN_PERM,
14420                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14421                                   NL80211_FLAG_NEED_RTNL,
14422         },
14423         {
14424                 .cmd = NL80211_CMD_GET_COALESCE,
14425                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14426                 .doit = nl80211_get_coalesce,
14427                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14428                                   NL80211_FLAG_NEED_RTNL,
14429         },
14430         {
14431                 .cmd = NL80211_CMD_SET_COALESCE,
14432                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14433                 .doit = nl80211_set_coalesce,
14434                 .flags = GENL_UNS_ADMIN_PERM,
14435                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14436                                   NL80211_FLAG_NEED_RTNL,
14437         },
14438         {
14439                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
14440                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14441                 .doit = nl80211_channel_switch,
14442                 .flags = GENL_UNS_ADMIN_PERM,
14443                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14444                                   NL80211_FLAG_NEED_RTNL,
14445         },
14446         {
14447                 .cmd = NL80211_CMD_VENDOR,
14448                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14449                 .doit = nl80211_vendor_cmd,
14450                 .dumpit = nl80211_vendor_cmd_dump,
14451                 .flags = GENL_UNS_ADMIN_PERM,
14452                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14453                                   NL80211_FLAG_NEED_RTNL |
14454                                   NL80211_FLAG_CLEAR_SKB,
14455         },
14456         {
14457                 .cmd = NL80211_CMD_SET_QOS_MAP,
14458                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14459                 .doit = nl80211_set_qos_map,
14460                 .flags = GENL_UNS_ADMIN_PERM,
14461                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14462                                   NL80211_FLAG_NEED_RTNL,
14463         },
14464         {
14465                 .cmd = NL80211_CMD_ADD_TX_TS,
14466                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14467                 .doit = nl80211_add_tx_ts,
14468                 .flags = GENL_UNS_ADMIN_PERM,
14469                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14470                                   NL80211_FLAG_NEED_RTNL,
14471         },
14472         {
14473                 .cmd = NL80211_CMD_DEL_TX_TS,
14474                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14475                 .doit = nl80211_del_tx_ts,
14476                 .flags = GENL_UNS_ADMIN_PERM,
14477                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14478                                   NL80211_FLAG_NEED_RTNL,
14479         },
14480         {
14481                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
14482                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14483                 .doit = nl80211_tdls_channel_switch,
14484                 .flags = GENL_UNS_ADMIN_PERM,
14485                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14486                                   NL80211_FLAG_NEED_RTNL,
14487         },
14488         {
14489                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
14490                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14491                 .doit = nl80211_tdls_cancel_channel_switch,
14492                 .flags = GENL_UNS_ADMIN_PERM,
14493                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14494                                   NL80211_FLAG_NEED_RTNL,
14495         },
14496         {
14497                 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
14498                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14499                 .doit = nl80211_set_multicast_to_unicast,
14500                 .flags = GENL_UNS_ADMIN_PERM,
14501                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14502                                   NL80211_FLAG_NEED_RTNL,
14503         },
14504         {
14505                 .cmd = NL80211_CMD_SET_PMK,
14506                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14507                 .doit = nl80211_set_pmk,
14508                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14509                                   NL80211_FLAG_NEED_RTNL |
14510                                   NL80211_FLAG_CLEAR_SKB,
14511         },
14512         {
14513                 .cmd = NL80211_CMD_DEL_PMK,
14514                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14515                 .doit = nl80211_del_pmk,
14516                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14517                                   NL80211_FLAG_NEED_RTNL,
14518         },
14519         {
14520                 .cmd = NL80211_CMD_EXTERNAL_AUTH,
14521                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14522                 .doit = nl80211_external_auth,
14523                 .flags = GENL_ADMIN_PERM,
14524                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14525                                   NL80211_FLAG_NEED_RTNL,
14526         },
14527         {
14528                 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
14529                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14530                 .doit = nl80211_tx_control_port,
14531                 .flags = GENL_UNS_ADMIN_PERM,
14532                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14533                                   NL80211_FLAG_NEED_RTNL,
14534         },
14535         {
14536                 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
14537                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14538                 .doit = nl80211_get_ftm_responder_stats,
14539                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14540                                   NL80211_FLAG_NEED_RTNL,
14541         },
14542         {
14543                 .cmd = NL80211_CMD_PEER_MEASUREMENT_START,
14544                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14545                 .doit = nl80211_pmsr_start,
14546                 .flags = GENL_UNS_ADMIN_PERM,
14547                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14548                                   NL80211_FLAG_NEED_RTNL,
14549         },
14550         {
14551                 .cmd = NL80211_CMD_NOTIFY_RADAR,
14552                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14553                 .doit = nl80211_notify_radar_detection,
14554                 .flags = GENL_UNS_ADMIN_PERM,
14555                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14556                                   NL80211_FLAG_NEED_RTNL,
14557         },
14558         {
14559                 .cmd = NL80211_CMD_UPDATE_OWE_INFO,
14560                 .doit = nl80211_update_owe_info,
14561                 .flags = GENL_ADMIN_PERM,
14562                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14563                                   NL80211_FLAG_NEED_RTNL,
14564         },
14565         {
14566                 .cmd = NL80211_CMD_PROBE_MESH_LINK,
14567                 .doit = nl80211_probe_mesh_link,
14568                 .flags = GENL_UNS_ADMIN_PERM,
14569                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14570                                   NL80211_FLAG_NEED_RTNL,
14571         },
14572 };
14573
14574 static struct genl_family nl80211_fam __ro_after_init = {
14575         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
14576         .hdrsize = 0,                   /* no private header */
14577         .version = 1,                   /* no particular meaning now */
14578         .maxattr = NL80211_ATTR_MAX,
14579         .policy = nl80211_policy,
14580         .netnsok = true,
14581         .pre_doit = nl80211_pre_doit,
14582         .post_doit = nl80211_post_doit,
14583         .module = THIS_MODULE,
14584         .ops = nl80211_ops,
14585         .n_ops = ARRAY_SIZE(nl80211_ops),
14586         .mcgrps = nl80211_mcgrps,
14587         .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
14588 };
14589
14590 /* notification functions */
14591
14592 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
14593                           enum nl80211_commands cmd)
14594 {
14595         struct sk_buff *msg;
14596         struct nl80211_dump_wiphy_state state = {};
14597
14598         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
14599                 cmd != NL80211_CMD_DEL_WIPHY);
14600
14601         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14602         if (!msg)
14603                 return;
14604
14605         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
14606                 nlmsg_free(msg);
14607                 return;
14608         }
14609
14610         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14611                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
14612 }
14613
14614 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
14615                                 struct wireless_dev *wdev,
14616                                 enum nl80211_commands cmd)
14617 {
14618         struct sk_buff *msg;
14619
14620         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14621         if (!msg)
14622                 return;
14623
14624         if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) {
14625                 nlmsg_free(msg);
14626                 return;
14627         }
14628
14629         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14630                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
14631 }
14632
14633 static int nl80211_add_scan_req(struct sk_buff *msg,
14634                                 struct cfg80211_registered_device *rdev)
14635 {
14636         struct cfg80211_scan_request *req = rdev->scan_req;
14637         struct nlattr *nest;
14638         int i;
14639
14640         if (WARN_ON(!req))
14641                 return 0;
14642
14643         nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS);
14644         if (!nest)
14645                 goto nla_put_failure;
14646         for (i = 0; i < req->n_ssids; i++) {
14647                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
14648                         goto nla_put_failure;
14649         }
14650         nla_nest_end(msg, nest);
14651
14652         nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
14653         if (!nest)
14654                 goto nla_put_failure;
14655         for (i = 0; i < req->n_channels; i++) {
14656                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
14657                         goto nla_put_failure;
14658         }
14659         nla_nest_end(msg, nest);
14660
14661         if (req->ie &&
14662             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
14663                 goto nla_put_failure;
14664
14665         if (req->flags &&
14666             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
14667                 goto nla_put_failure;
14668
14669         if (req->info.scan_start_tsf &&
14670             (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
14671                                req->info.scan_start_tsf, NL80211_BSS_PAD) ||
14672              nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
14673                      req->info.tsf_bssid)))
14674                 goto nla_put_failure;
14675
14676         return 0;
14677  nla_put_failure:
14678         return -ENOBUFS;
14679 }
14680
14681 static int nl80211_prep_scan_msg(struct sk_buff *msg,
14682                                  struct cfg80211_registered_device *rdev,
14683                                  struct wireless_dev *wdev,
14684                                  u32 portid, u32 seq, int flags,
14685                                  u32 cmd)
14686 {
14687         void *hdr;
14688
14689         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
14690         if (!hdr)
14691                 return -1;
14692
14693         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14694             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14695                                          wdev->netdev->ifindex)) ||
14696             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14697                               NL80211_ATTR_PAD))
14698                 goto nla_put_failure;
14699
14700         /* ignore errors and send incomplete event anyway */
14701         nl80211_add_scan_req(msg, rdev);
14702
14703         genlmsg_end(msg, hdr);
14704         return 0;
14705
14706  nla_put_failure:
14707         genlmsg_cancel(msg, hdr);
14708         return -EMSGSIZE;
14709 }
14710
14711 static int
14712 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
14713                             struct cfg80211_sched_scan_request *req, u32 cmd)
14714 {
14715         void *hdr;
14716
14717         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14718         if (!hdr)
14719                 return -1;
14720
14721         if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
14722                         wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
14723             nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
14724             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
14725                               NL80211_ATTR_PAD))
14726                 goto nla_put_failure;
14727
14728         genlmsg_end(msg, hdr);
14729         return 0;
14730
14731  nla_put_failure:
14732         genlmsg_cancel(msg, hdr);
14733         return -EMSGSIZE;
14734 }
14735
14736 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
14737                              struct wireless_dev *wdev)
14738 {
14739         struct sk_buff *msg;
14740
14741         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14742         if (!msg)
14743                 return;
14744
14745         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
14746                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
14747                 nlmsg_free(msg);
14748                 return;
14749         }
14750
14751         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14752                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14753 }
14754
14755 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
14756                                        struct wireless_dev *wdev, bool aborted)
14757 {
14758         struct sk_buff *msg;
14759
14760         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14761         if (!msg)
14762                 return NULL;
14763
14764         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
14765                                   aborted ? NL80211_CMD_SCAN_ABORTED :
14766                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
14767                 nlmsg_free(msg);
14768                 return NULL;
14769         }
14770
14771         return msg;
14772 }
14773
14774 /* send message created by nl80211_build_scan_msg() */
14775 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
14776                            struct sk_buff *msg)
14777 {
14778         if (!msg)
14779                 return;
14780
14781         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14782                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14783 }
14784
14785 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
14786 {
14787         struct sk_buff *msg;
14788
14789         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14790         if (!msg)
14791                 return;
14792
14793         if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
14794                 nlmsg_free(msg);
14795                 return;
14796         }
14797
14798         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
14799                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14800 }
14801
14802 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
14803                                           struct regulatory_request *request)
14804 {
14805         /* Userspace can always count this one always being set */
14806         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
14807                 goto nla_put_failure;
14808
14809         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
14810                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14811                                NL80211_REGDOM_TYPE_WORLD))
14812                         goto nla_put_failure;
14813         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
14814                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14815                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
14816                         goto nla_put_failure;
14817         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
14818                    request->intersect) {
14819                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14820                                NL80211_REGDOM_TYPE_INTERSECTION))
14821                         goto nla_put_failure;
14822         } else {
14823                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14824                                NL80211_REGDOM_TYPE_COUNTRY) ||
14825                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
14826                                    request->alpha2))
14827                         goto nla_put_failure;
14828         }
14829
14830         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
14831                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
14832
14833                 if (wiphy &&
14834                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
14835                         goto nla_put_failure;
14836
14837                 if (wiphy &&
14838                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
14839                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
14840                         goto nla_put_failure;
14841         }
14842
14843         return true;
14844
14845 nla_put_failure:
14846         return false;
14847 }
14848
14849 /*
14850  * This can happen on global regulatory changes or device specific settings
14851  * based on custom regulatory domains.
14852  */
14853 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
14854                                      struct regulatory_request *request)
14855 {
14856         struct sk_buff *msg;
14857         void *hdr;
14858
14859         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14860         if (!msg)
14861                 return;
14862
14863         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
14864         if (!hdr) {
14865                 nlmsg_free(msg);
14866                 return;
14867         }
14868
14869         if (nl80211_reg_change_event_fill(msg, request) == false)
14870                 goto nla_put_failure;
14871
14872         genlmsg_end(msg, hdr);
14873
14874         rcu_read_lock();
14875         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
14876                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
14877         rcu_read_unlock();
14878
14879         return;
14880
14881 nla_put_failure:
14882         nlmsg_free(msg);
14883 }
14884
14885 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
14886                                     struct net_device *netdev,
14887                                     const u8 *buf, size_t len,
14888                                     enum nl80211_commands cmd, gfp_t gfp,
14889                                     int uapsd_queues, const u8 *req_ies,
14890                                     size_t req_ies_len)
14891 {
14892         struct sk_buff *msg;
14893         void *hdr;
14894
14895         msg = nlmsg_new(100 + len + req_ies_len, gfp);
14896         if (!msg)
14897                 return;
14898
14899         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14900         if (!hdr) {
14901                 nlmsg_free(msg);
14902                 return;
14903         }
14904
14905         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14906             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14907             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
14908             (req_ies &&
14909              nla_put(msg, NL80211_ATTR_REQ_IE, req_ies_len, req_ies)))
14910                 goto nla_put_failure;
14911
14912         if (uapsd_queues >= 0) {
14913                 struct nlattr *nla_wmm =
14914                         nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME);
14915                 if (!nla_wmm)
14916                         goto nla_put_failure;
14917
14918                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
14919                                uapsd_queues))
14920                         goto nla_put_failure;
14921
14922                 nla_nest_end(msg, nla_wmm);
14923         }
14924
14925         genlmsg_end(msg, hdr);
14926
14927         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14928                                 NL80211_MCGRP_MLME, gfp);
14929         return;
14930
14931  nla_put_failure:
14932         nlmsg_free(msg);
14933 }
14934
14935 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
14936                           struct net_device *netdev, const u8 *buf,
14937                           size_t len, gfp_t gfp)
14938 {
14939         nl80211_send_mlme_event(rdev, netdev, buf, len,
14940                                 NL80211_CMD_AUTHENTICATE, gfp, -1, NULL, 0);
14941 }
14942
14943 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
14944                            struct net_device *netdev, const u8 *buf,
14945                            size_t len, gfp_t gfp, int uapsd_queues,
14946                            const u8 *req_ies, size_t req_ies_len)
14947 {
14948         nl80211_send_mlme_event(rdev, netdev, buf, len,
14949                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues,
14950                                 req_ies, req_ies_len);
14951 }
14952
14953 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
14954                          struct net_device *netdev, const u8 *buf,
14955                          size_t len, gfp_t gfp)
14956 {
14957         nl80211_send_mlme_event(rdev, netdev, buf, len,
14958                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1, NULL, 0);
14959 }
14960
14961 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
14962                            struct net_device *netdev, const u8 *buf,
14963                            size_t len, gfp_t gfp)
14964 {
14965         nl80211_send_mlme_event(rdev, netdev, buf, len,
14966                                 NL80211_CMD_DISASSOCIATE, gfp, -1, NULL, 0);
14967 }
14968
14969 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
14970                                   size_t len)
14971 {
14972         struct wireless_dev *wdev = dev->ieee80211_ptr;
14973         struct wiphy *wiphy = wdev->wiphy;
14974         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14975         const struct ieee80211_mgmt *mgmt = (void *)buf;
14976         u32 cmd;
14977
14978         if (WARN_ON(len < 2))
14979                 return;
14980
14981         if (ieee80211_is_deauth(mgmt->frame_control))
14982                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
14983         else
14984                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
14985
14986         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
14987         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1,
14988                                 NULL, 0);
14989 }
14990 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
14991
14992 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
14993                                       struct net_device *netdev, int cmd,
14994                                       const u8 *addr, gfp_t gfp)
14995 {
14996         struct sk_buff *msg;
14997         void *hdr;
14998
14999         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15000         if (!msg)
15001                 return;
15002
15003         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
15004         if (!hdr) {
15005                 nlmsg_free(msg);
15006                 return;
15007         }
15008
15009         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15010             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15011             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
15012             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
15013                 goto nla_put_failure;
15014
15015         genlmsg_end(msg, hdr);
15016
15017         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15018                                 NL80211_MCGRP_MLME, gfp);
15019         return;
15020
15021  nla_put_failure:
15022         nlmsg_free(msg);
15023 }
15024
15025 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
15026                                struct net_device *netdev, const u8 *addr,
15027                                gfp_t gfp)
15028 {
15029         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
15030                                   addr, gfp);
15031 }
15032
15033 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
15034                                 struct net_device *netdev, const u8 *addr,
15035                                 gfp_t gfp)
15036 {
15037         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
15038                                   addr, gfp);
15039 }
15040
15041 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
15042                                  struct net_device *netdev,
15043                                  struct cfg80211_connect_resp_params *cr,
15044                                  gfp_t gfp)
15045 {
15046         struct sk_buff *msg;
15047         void *hdr;
15048
15049         msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
15050                         cr->fils.kek_len + cr->fils.pmk_len +
15051                         (cr->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
15052         if (!msg)
15053                 return;
15054
15055         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
15056         if (!hdr) {
15057                 nlmsg_free(msg);
15058                 return;
15059         }
15060
15061         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15062             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15063             (cr->bssid &&
15064              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) ||
15065             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
15066                         cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
15067                         cr->status) ||
15068             (cr->status < 0 &&
15069              (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
15070               nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
15071                           cr->timeout_reason))) ||
15072             (cr->req_ie &&
15073              nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
15074             (cr->resp_ie &&
15075              nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
15076                      cr->resp_ie)) ||
15077             (cr->fils.update_erp_next_seq_num &&
15078              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
15079                          cr->fils.erp_next_seq_num)) ||
15080             (cr->status == WLAN_STATUS_SUCCESS &&
15081              ((cr->fils.kek &&
15082                nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
15083                        cr->fils.kek)) ||
15084               (cr->fils.pmk &&
15085                nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
15086               (cr->fils.pmkid &&
15087                nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
15088                 goto nla_put_failure;
15089
15090         genlmsg_end(msg, hdr);
15091
15092         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15093                                 NL80211_MCGRP_MLME, gfp);
15094         return;
15095
15096  nla_put_failure:
15097         nlmsg_free(msg);
15098 }
15099
15100 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
15101                          struct net_device *netdev,
15102                          struct cfg80211_roam_info *info, gfp_t gfp)
15103 {
15104         struct sk_buff *msg;
15105         void *hdr;
15106         const u8 *bssid = info->bss ? info->bss->bssid : info->bssid;
15107
15108         msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
15109                         info->fils.kek_len + info->fils.pmk_len +
15110                         (info->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
15111         if (!msg)
15112                 return;
15113
15114         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
15115         if (!hdr) {
15116                 nlmsg_free(msg);
15117                 return;
15118         }
15119
15120         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15121             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15122             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
15123             (info->req_ie &&
15124              nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
15125                      info->req_ie)) ||
15126             (info->resp_ie &&
15127              nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
15128                      info->resp_ie)) ||
15129             (info->fils.update_erp_next_seq_num &&
15130              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
15131                          info->fils.erp_next_seq_num)) ||
15132             (info->fils.kek &&
15133              nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
15134                      info->fils.kek)) ||
15135             (info->fils.pmk &&
15136              nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
15137             (info->fils.pmkid &&
15138              nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
15139                 goto nla_put_failure;
15140
15141         genlmsg_end(msg, hdr);
15142
15143         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15144                                 NL80211_MCGRP_MLME, gfp);
15145         return;
15146
15147  nla_put_failure:
15148         nlmsg_free(msg);
15149 }
15150
15151 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
15152                                   struct net_device *netdev, const u8 *bssid)
15153 {
15154         struct sk_buff *msg;
15155         void *hdr;
15156
15157         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15158         if (!msg)
15159                 return;
15160
15161         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
15162         if (!hdr) {
15163                 nlmsg_free(msg);
15164                 return;
15165         }
15166
15167         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15168             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15169             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
15170                 goto nla_put_failure;
15171
15172         genlmsg_end(msg, hdr);
15173
15174         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15175                                 NL80211_MCGRP_MLME, GFP_KERNEL);
15176         return;
15177
15178  nla_put_failure:
15179         nlmsg_free(msg);
15180 }
15181
15182 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
15183                                struct net_device *netdev, u16 reason,
15184                                const u8 *ie, size_t ie_len, bool from_ap)
15185 {
15186         struct sk_buff *msg;
15187         void *hdr;
15188
15189         msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
15190         if (!msg)
15191                 return;
15192
15193         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
15194         if (!hdr) {
15195                 nlmsg_free(msg);
15196                 return;
15197         }
15198
15199         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15200             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15201             (reason &&
15202              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
15203             (from_ap &&
15204              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
15205             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
15206                 goto nla_put_failure;
15207
15208         genlmsg_end(msg, hdr);
15209
15210         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15211                                 NL80211_MCGRP_MLME, GFP_KERNEL);
15212         return;
15213
15214  nla_put_failure:
15215         nlmsg_free(msg);
15216 }
15217
15218 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
15219                              struct net_device *netdev, const u8 *bssid,
15220                              gfp_t gfp)
15221 {
15222         struct sk_buff *msg;
15223         void *hdr;
15224
15225         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15226         if (!msg)
15227                 return;
15228
15229         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
15230         if (!hdr) {
15231                 nlmsg_free(msg);
15232                 return;
15233         }
15234
15235         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15236             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15237             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
15238                 goto nla_put_failure;
15239
15240         genlmsg_end(msg, hdr);
15241
15242         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15243                                 NL80211_MCGRP_MLME, gfp);
15244         return;
15245
15246  nla_put_failure:
15247         nlmsg_free(msg);
15248 }
15249
15250 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
15251                                         const u8 *ie, u8 ie_len,
15252                                         int sig_dbm, gfp_t gfp)
15253 {
15254         struct wireless_dev *wdev = dev->ieee80211_ptr;
15255         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15256         struct sk_buff *msg;
15257         void *hdr;
15258
15259         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
15260                 return;
15261
15262         trace_cfg80211_notify_new_peer_candidate(dev, addr);
15263
15264         msg = nlmsg_new(100 + ie_len, gfp);
15265         if (!msg)
15266                 return;
15267
15268         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
15269         if (!hdr) {
15270                 nlmsg_free(msg);
15271                 return;
15272         }
15273
15274         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15275             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15276             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
15277             (ie_len && ie &&
15278              nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
15279             (sig_dbm &&
15280              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
15281                 goto nla_put_failure;
15282
15283         genlmsg_end(msg, hdr);
15284
15285         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15286                                 NL80211_MCGRP_MLME, gfp);
15287         return;
15288
15289  nla_put_failure:
15290         nlmsg_free(msg);
15291 }
15292 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
15293
15294 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
15295                                  struct net_device *netdev, const u8 *addr,
15296                                  enum nl80211_key_type key_type, int key_id,
15297                                  const u8 *tsc, gfp_t gfp)
15298 {
15299         struct sk_buff *msg;
15300         void *hdr;
15301
15302         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15303         if (!msg)
15304                 return;
15305
15306         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
15307         if (!hdr) {
15308                 nlmsg_free(msg);
15309                 return;
15310         }
15311
15312         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15313             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15314             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
15315             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
15316             (key_id != -1 &&
15317              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
15318             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
15319                 goto nla_put_failure;
15320
15321         genlmsg_end(msg, hdr);
15322
15323         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15324                                 NL80211_MCGRP_MLME, gfp);
15325         return;
15326
15327  nla_put_failure:
15328         nlmsg_free(msg);
15329 }
15330
15331 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
15332                                     struct ieee80211_channel *channel_before,
15333                                     struct ieee80211_channel *channel_after)
15334 {
15335         struct sk_buff *msg;
15336         void *hdr;
15337         struct nlattr *nl_freq;
15338
15339         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
15340         if (!msg)
15341                 return;
15342
15343         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
15344         if (!hdr) {
15345                 nlmsg_free(msg);
15346                 return;
15347         }
15348
15349         /*
15350          * Since we are applying the beacon hint to a wiphy we know its
15351          * wiphy_idx is valid
15352          */
15353         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
15354                 goto nla_put_failure;
15355
15356         /* Before */
15357         nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE);
15358         if (!nl_freq)
15359                 goto nla_put_failure;
15360
15361         if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
15362                 goto nla_put_failure;
15363         nla_nest_end(msg, nl_freq);
15364
15365         /* After */
15366         nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER);
15367         if (!nl_freq)
15368                 goto nla_put_failure;
15369
15370         if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
15371                 goto nla_put_failure;
15372         nla_nest_end(msg, nl_freq);
15373
15374         genlmsg_end(msg, hdr);
15375
15376         rcu_read_lock();
15377         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
15378                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
15379         rcu_read_unlock();
15380
15381         return;
15382
15383 nla_put_failure:
15384         nlmsg_free(msg);
15385 }
15386
15387 static void nl80211_send_remain_on_chan_event(
15388         int cmd, struct cfg80211_registered_device *rdev,
15389         struct wireless_dev *wdev, u64 cookie,
15390         struct ieee80211_channel *chan,
15391         unsigned int duration, gfp_t gfp)
15392 {
15393         struct sk_buff *msg;
15394         void *hdr;
15395
15396         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15397         if (!msg)
15398                 return;
15399
15400         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
15401         if (!hdr) {
15402                 nlmsg_free(msg);
15403                 return;
15404         }
15405
15406         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15407             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15408                                          wdev->netdev->ifindex)) ||
15409             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15410                               NL80211_ATTR_PAD) ||
15411             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
15412             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
15413                         NL80211_CHAN_NO_HT) ||
15414             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15415                               NL80211_ATTR_PAD))
15416                 goto nla_put_failure;
15417
15418         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
15419             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
15420                 goto nla_put_failure;
15421
15422         genlmsg_end(msg, hdr);
15423
15424         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15425                                 NL80211_MCGRP_MLME, gfp);
15426         return;
15427
15428  nla_put_failure:
15429         nlmsg_free(msg);
15430 }
15431
15432 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
15433                                struct ieee80211_channel *chan,
15434                                unsigned int duration, gfp_t gfp)
15435 {
15436         struct wiphy *wiphy = wdev->wiphy;
15437         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15438
15439         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
15440         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
15441                                           rdev, wdev, cookie, chan,
15442                                           duration, gfp);
15443 }
15444 EXPORT_SYMBOL(cfg80211_ready_on_channel);
15445
15446 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
15447                                         struct ieee80211_channel *chan,
15448                                         gfp_t gfp)
15449 {
15450         struct wiphy *wiphy = wdev->wiphy;
15451         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15452
15453         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
15454         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
15455                                           rdev, wdev, cookie, chan, 0, gfp);
15456 }
15457 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
15458
15459 void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie,
15460                                         struct ieee80211_channel *chan,
15461                                         gfp_t gfp)
15462 {
15463         struct wiphy *wiphy = wdev->wiphy;
15464         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15465
15466         trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan);
15467         nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL,
15468                                           rdev, wdev, cookie, chan, 0, gfp);
15469 }
15470 EXPORT_SYMBOL(cfg80211_tx_mgmt_expired);
15471
15472 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
15473                       struct station_info *sinfo, gfp_t gfp)
15474 {
15475         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
15476         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15477         struct sk_buff *msg;
15478
15479         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
15480
15481         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15482         if (!msg)
15483                 return;
15484
15485         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
15486                                  rdev, dev, mac_addr, sinfo) < 0) {
15487                 nlmsg_free(msg);
15488                 return;
15489         }
15490
15491         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15492                                 NL80211_MCGRP_MLME, gfp);
15493 }
15494 EXPORT_SYMBOL(cfg80211_new_sta);
15495
15496 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
15497                             struct station_info *sinfo, gfp_t gfp)
15498 {
15499         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
15500         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15501         struct sk_buff *msg;
15502         struct station_info empty_sinfo = {};
15503
15504         if (!sinfo)
15505                 sinfo = &empty_sinfo;
15506
15507         trace_cfg80211_del_sta(dev, mac_addr);
15508
15509         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15510         if (!msg) {
15511                 cfg80211_sinfo_release_content(sinfo);
15512                 return;
15513         }
15514
15515         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
15516                                  rdev, dev, mac_addr, sinfo) < 0) {
15517                 nlmsg_free(msg);
15518                 return;
15519         }
15520
15521         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15522                                 NL80211_MCGRP_MLME, gfp);
15523 }
15524 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
15525
15526 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
15527                           enum nl80211_connect_failed_reason reason,
15528                           gfp_t gfp)
15529 {
15530         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
15531         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15532         struct sk_buff *msg;
15533         void *hdr;
15534
15535         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
15536         if (!msg)
15537                 return;
15538
15539         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
15540         if (!hdr) {
15541                 nlmsg_free(msg);
15542                 return;
15543         }
15544
15545         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15546             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
15547             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
15548                 goto nla_put_failure;
15549
15550         genlmsg_end(msg, hdr);
15551
15552         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15553                                 NL80211_MCGRP_MLME, gfp);
15554         return;
15555
15556  nla_put_failure:
15557         nlmsg_free(msg);
15558 }
15559 EXPORT_SYMBOL(cfg80211_conn_failed);
15560
15561 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
15562                                        const u8 *addr, gfp_t gfp)
15563 {
15564         struct wireless_dev *wdev = dev->ieee80211_ptr;
15565         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15566         struct sk_buff *msg;
15567         void *hdr;
15568         u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
15569
15570         if (!nlportid)
15571                 return false;
15572
15573         msg = nlmsg_new(100, gfp);
15574         if (!msg)
15575                 return true;
15576
15577         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
15578         if (!hdr) {
15579                 nlmsg_free(msg);
15580                 return true;
15581         }
15582
15583         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15584             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15585             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
15586                 goto nla_put_failure;
15587
15588         genlmsg_end(msg, hdr);
15589         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15590         return true;
15591
15592  nla_put_failure:
15593         nlmsg_free(msg);
15594         return true;
15595 }
15596
15597 bool cfg80211_rx_spurious_frame(struct net_device *dev,
15598                                 const u8 *addr, gfp_t gfp)
15599 {
15600         struct wireless_dev *wdev = dev->ieee80211_ptr;
15601         bool ret;
15602
15603         trace_cfg80211_rx_spurious_frame(dev, addr);
15604
15605         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
15606                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
15607                 trace_cfg80211_return_bool(false);
15608                 return false;
15609         }
15610         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
15611                                          addr, gfp);
15612         trace_cfg80211_return_bool(ret);
15613         return ret;
15614 }
15615 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
15616
15617 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
15618                                         const u8 *addr, gfp_t gfp)
15619 {
15620         struct wireless_dev *wdev = dev->ieee80211_ptr;
15621         bool ret;
15622
15623         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
15624
15625         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
15626                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
15627                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
15628                 trace_cfg80211_return_bool(false);
15629                 return false;
15630         }
15631         ret = __nl80211_unexpected_frame(dev,
15632                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
15633                                          addr, gfp);
15634         trace_cfg80211_return_bool(ret);
15635         return ret;
15636 }
15637 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
15638
15639 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
15640                       struct wireless_dev *wdev, u32 nlportid,
15641                       int freq, int sig_dbm,
15642                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
15643 {
15644         struct net_device *netdev = wdev->netdev;
15645         struct sk_buff *msg;
15646         void *hdr;
15647
15648         msg = nlmsg_new(100 + len, gfp);
15649         if (!msg)
15650                 return -ENOMEM;
15651
15652         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
15653         if (!hdr) {
15654                 nlmsg_free(msg);
15655                 return -ENOMEM;
15656         }
15657
15658         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15659             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15660                                         netdev->ifindex)) ||
15661             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15662                               NL80211_ATTR_PAD) ||
15663             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
15664             (sig_dbm &&
15665              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
15666             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
15667             (flags &&
15668              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
15669                 goto nla_put_failure;
15670
15671         genlmsg_end(msg, hdr);
15672
15673         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15674
15675  nla_put_failure:
15676         nlmsg_free(msg);
15677         return -ENOBUFS;
15678 }
15679
15680 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
15681                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
15682 {
15683         struct wiphy *wiphy = wdev->wiphy;
15684         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15685         struct net_device *netdev = wdev->netdev;
15686         struct sk_buff *msg;
15687         void *hdr;
15688
15689         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
15690
15691         msg = nlmsg_new(100 + len, gfp);
15692         if (!msg)
15693                 return;
15694
15695         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
15696         if (!hdr) {
15697                 nlmsg_free(msg);
15698                 return;
15699         }
15700
15701         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15702             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15703                                    netdev->ifindex)) ||
15704             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15705                               NL80211_ATTR_PAD) ||
15706             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
15707             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15708                               NL80211_ATTR_PAD) ||
15709             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
15710                 goto nla_put_failure;
15711
15712         genlmsg_end(msg, hdr);
15713
15714         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15715                                 NL80211_MCGRP_MLME, gfp);
15716         return;
15717
15718  nla_put_failure:
15719         nlmsg_free(msg);
15720 }
15721 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
15722
15723 static int __nl80211_rx_control_port(struct net_device *dev,
15724                                      struct sk_buff *skb,
15725                                      bool unencrypted, gfp_t gfp)
15726 {
15727         struct wireless_dev *wdev = dev->ieee80211_ptr;
15728         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15729         struct ethhdr *ehdr = eth_hdr(skb);
15730         const u8 *addr = ehdr->h_source;
15731         u16 proto = be16_to_cpu(skb->protocol);
15732         struct sk_buff *msg;
15733         void *hdr;
15734         struct nlattr *frame;
15735
15736         u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
15737
15738         if (!nlportid)
15739                 return -ENOENT;
15740
15741         msg = nlmsg_new(100 + skb->len, gfp);
15742         if (!msg)
15743                 return -ENOMEM;
15744
15745         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
15746         if (!hdr) {
15747                 nlmsg_free(msg);
15748                 return -ENOBUFS;
15749         }
15750
15751         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15752             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15753             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15754                               NL80211_ATTR_PAD) ||
15755             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
15756             nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
15757             (unencrypted && nla_put_flag(msg,
15758                                          NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
15759                 goto nla_put_failure;
15760
15761         frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
15762         if (!frame)
15763                 goto nla_put_failure;
15764
15765         skb_copy_bits(skb, 0, nla_data(frame), skb->len);
15766         genlmsg_end(msg, hdr);
15767
15768         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15769
15770  nla_put_failure:
15771         nlmsg_free(msg);
15772         return -ENOBUFS;
15773 }
15774
15775 bool cfg80211_rx_control_port(struct net_device *dev,
15776                               struct sk_buff *skb, bool unencrypted)
15777 {
15778         int ret;
15779
15780         trace_cfg80211_rx_control_port(dev, skb, unencrypted);
15781         ret = __nl80211_rx_control_port(dev, skb, unencrypted, GFP_ATOMIC);
15782         trace_cfg80211_return_bool(ret == 0);
15783         return ret == 0;
15784 }
15785 EXPORT_SYMBOL(cfg80211_rx_control_port);
15786
15787 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
15788                                             const char *mac, gfp_t gfp)
15789 {
15790         struct wireless_dev *wdev = dev->ieee80211_ptr;
15791         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15792         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15793         void **cb;
15794
15795         if (!msg)
15796                 return NULL;
15797
15798         cb = (void **)msg->cb;
15799
15800         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
15801         if (!cb[0]) {
15802                 nlmsg_free(msg);
15803                 return NULL;
15804         }
15805
15806         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15807             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15808                 goto nla_put_failure;
15809
15810         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
15811                 goto nla_put_failure;
15812
15813         cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM);
15814         if (!cb[1])
15815                 goto nla_put_failure;
15816
15817         cb[2] = rdev;
15818
15819         return msg;
15820  nla_put_failure:
15821         nlmsg_free(msg);
15822         return NULL;
15823 }
15824
15825 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
15826 {
15827         void **cb = (void **)msg->cb;
15828         struct cfg80211_registered_device *rdev = cb[2];
15829
15830         nla_nest_end(msg, cb[1]);
15831         genlmsg_end(msg, cb[0]);
15832
15833         memset(msg->cb, 0, sizeof(msg->cb));
15834
15835         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15836                                 NL80211_MCGRP_MLME, gfp);
15837 }
15838
15839 void cfg80211_cqm_rssi_notify(struct net_device *dev,
15840                               enum nl80211_cqm_rssi_threshold_event rssi_event,
15841                               s32 rssi_level, gfp_t gfp)
15842 {
15843         struct sk_buff *msg;
15844         struct wireless_dev *wdev = dev->ieee80211_ptr;
15845         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15846
15847         trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
15848
15849         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
15850                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
15851                 return;
15852
15853         if (wdev->cqm_config) {
15854                 wdev->cqm_config->last_rssi_event_value = rssi_level;
15855
15856                 cfg80211_cqm_rssi_update(rdev, dev);
15857
15858                 if (rssi_level == 0)
15859                         rssi_level = wdev->cqm_config->last_rssi_event_value;
15860         }
15861
15862         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
15863         if (!msg)
15864                 return;
15865
15866         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
15867                         rssi_event))
15868                 goto nla_put_failure;
15869
15870         if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
15871                                       rssi_level))
15872                 goto nla_put_failure;
15873
15874         cfg80211_send_cqm(msg, gfp);
15875
15876         return;
15877
15878  nla_put_failure:
15879         nlmsg_free(msg);
15880 }
15881 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
15882
15883 void cfg80211_cqm_txe_notify(struct net_device *dev,
15884                              const u8 *peer, u32 num_packets,
15885                              u32 rate, u32 intvl, gfp_t gfp)
15886 {
15887         struct sk_buff *msg;
15888
15889         msg = cfg80211_prepare_cqm(dev, peer, gfp);
15890         if (!msg)
15891                 return;
15892
15893         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
15894                 goto nla_put_failure;
15895
15896         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
15897                 goto nla_put_failure;
15898
15899         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
15900                 goto nla_put_failure;
15901
15902         cfg80211_send_cqm(msg, gfp);
15903         return;
15904
15905  nla_put_failure:
15906         nlmsg_free(msg);
15907 }
15908 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
15909
15910 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
15911                                  const u8 *peer, u32 num_packets, gfp_t gfp)
15912 {
15913         struct sk_buff *msg;
15914
15915         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
15916
15917         msg = cfg80211_prepare_cqm(dev, peer, gfp);
15918         if (!msg)
15919                 return;
15920
15921         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
15922                 goto nla_put_failure;
15923
15924         cfg80211_send_cqm(msg, gfp);
15925         return;
15926
15927  nla_put_failure:
15928         nlmsg_free(msg);
15929 }
15930 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
15931
15932 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
15933 {
15934         struct sk_buff *msg;
15935
15936         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
15937         if (!msg)
15938                 return;
15939
15940         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
15941                 goto nla_put_failure;
15942
15943         cfg80211_send_cqm(msg, gfp);
15944         return;
15945
15946  nla_put_failure:
15947         nlmsg_free(msg);
15948 }
15949 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
15950
15951 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
15952                                      struct net_device *netdev, const u8 *bssid,
15953                                      const u8 *replay_ctr, gfp_t gfp)
15954 {
15955         struct sk_buff *msg;
15956         struct nlattr *rekey_attr;
15957         void *hdr;
15958
15959         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15960         if (!msg)
15961                 return;
15962
15963         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
15964         if (!hdr) {
15965                 nlmsg_free(msg);
15966                 return;
15967         }
15968
15969         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15970             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15971             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
15972                 goto nla_put_failure;
15973
15974         rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA);
15975         if (!rekey_attr)
15976                 goto nla_put_failure;
15977
15978         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
15979                     NL80211_REPLAY_CTR_LEN, replay_ctr))
15980                 goto nla_put_failure;
15981
15982         nla_nest_end(msg, rekey_attr);
15983
15984         genlmsg_end(msg, hdr);
15985
15986         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15987                                 NL80211_MCGRP_MLME, gfp);
15988         return;
15989
15990  nla_put_failure:
15991         nlmsg_free(msg);
15992 }
15993
15994 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
15995                                const u8 *replay_ctr, gfp_t gfp)
15996 {
15997         struct wireless_dev *wdev = dev->ieee80211_ptr;
15998         struct wiphy *wiphy = wdev->wiphy;
15999         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16000
16001         trace_cfg80211_gtk_rekey_notify(dev, bssid);
16002         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
16003 }
16004 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
16005
16006 static void
16007 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
16008                                struct net_device *netdev, int index,
16009                                const u8 *bssid, bool preauth, gfp_t gfp)
16010 {
16011         struct sk_buff *msg;
16012         struct nlattr *attr;
16013         void *hdr;
16014
16015         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16016         if (!msg)
16017                 return;
16018
16019         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
16020         if (!hdr) {
16021                 nlmsg_free(msg);
16022                 return;
16023         }
16024
16025         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16026             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
16027                 goto nla_put_failure;
16028
16029         attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE);
16030         if (!attr)
16031                 goto nla_put_failure;
16032
16033         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
16034             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
16035             (preauth &&
16036              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
16037                 goto nla_put_failure;
16038
16039         nla_nest_end(msg, attr);
16040
16041         genlmsg_end(msg, hdr);
16042
16043         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16044                                 NL80211_MCGRP_MLME, gfp);
16045         return;
16046
16047  nla_put_failure:
16048         nlmsg_free(msg);
16049 }
16050
16051 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
16052                                      const u8 *bssid, bool preauth, gfp_t gfp)
16053 {
16054         struct wireless_dev *wdev = dev->ieee80211_ptr;
16055         struct wiphy *wiphy = wdev->wiphy;
16056         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16057
16058         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
16059         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
16060 }
16061 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
16062
16063 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
16064                                      struct net_device *netdev,
16065                                      struct cfg80211_chan_def *chandef,
16066                                      gfp_t gfp,
16067                                      enum nl80211_commands notif,
16068                                      u8 count)
16069 {
16070         struct sk_buff *msg;
16071         void *hdr;
16072
16073         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16074         if (!msg)
16075                 return;
16076
16077         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
16078         if (!hdr) {
16079                 nlmsg_free(msg);
16080                 return;
16081         }
16082
16083         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
16084                 goto nla_put_failure;
16085
16086         if (nl80211_send_chandef(msg, chandef))
16087                 goto nla_put_failure;
16088
16089         if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
16090             (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
16091                         goto nla_put_failure;
16092
16093         genlmsg_end(msg, hdr);
16094
16095         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16096                                 NL80211_MCGRP_MLME, gfp);
16097         return;
16098
16099  nla_put_failure:
16100         nlmsg_free(msg);
16101 }
16102
16103 void cfg80211_ch_switch_notify(struct net_device *dev,
16104                                struct cfg80211_chan_def *chandef)
16105 {
16106         struct wireless_dev *wdev = dev->ieee80211_ptr;
16107         struct wiphy *wiphy = wdev->wiphy;
16108         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16109
16110         ASSERT_WDEV_LOCK(wdev);
16111
16112         trace_cfg80211_ch_switch_notify(dev, chandef);
16113
16114         wdev->chandef = *chandef;
16115         wdev->preset_chandef = *chandef;
16116
16117         if (wdev->iftype == NL80211_IFTYPE_STATION &&
16118             !WARN_ON(!wdev->current_bss))
16119                 cfg80211_update_assoc_bss_entry(wdev, chandef->chan);
16120
16121         cfg80211_sched_dfs_chan_update(rdev);
16122
16123         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
16124                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0);
16125 }
16126 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
16127
16128 void cfg80211_ch_switch_started_notify(struct net_device *dev,
16129                                        struct cfg80211_chan_def *chandef,
16130                                        u8 count)
16131 {
16132         struct wireless_dev *wdev = dev->ieee80211_ptr;
16133         struct wiphy *wiphy = wdev->wiphy;
16134         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16135
16136         trace_cfg80211_ch_switch_started_notify(dev, chandef);
16137
16138         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
16139                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
16140 }
16141 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
16142
16143 void
16144 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
16145                      const struct cfg80211_chan_def *chandef,
16146                      enum nl80211_radar_event event,
16147                      struct net_device *netdev, gfp_t gfp)
16148 {
16149         struct sk_buff *msg;
16150         void *hdr;
16151
16152         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16153         if (!msg)
16154                 return;
16155
16156         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
16157         if (!hdr) {
16158                 nlmsg_free(msg);
16159                 return;
16160         }
16161
16162         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
16163                 goto nla_put_failure;
16164
16165         /* NOP and radar events don't need a netdev parameter */
16166         if (netdev) {
16167                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
16168
16169                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16170                     nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16171                                       NL80211_ATTR_PAD))
16172                         goto nla_put_failure;
16173         }
16174
16175         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
16176                 goto nla_put_failure;
16177
16178         if (nl80211_send_chandef(msg, chandef))
16179                 goto nla_put_failure;
16180
16181         genlmsg_end(msg, hdr);
16182
16183         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16184                                 NL80211_MCGRP_MLME, gfp);
16185         return;
16186
16187  nla_put_failure:
16188         nlmsg_free(msg);
16189 }
16190
16191 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
16192                                        struct sta_opmode_info *sta_opmode,
16193                                        gfp_t gfp)
16194 {
16195         struct sk_buff *msg;
16196         struct wireless_dev *wdev = dev->ieee80211_ptr;
16197         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16198         void *hdr;
16199
16200         if (WARN_ON(!mac))
16201                 return;
16202
16203         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16204         if (!msg)
16205                 return;
16206
16207         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
16208         if (!hdr) {
16209                 nlmsg_free(msg);
16210                 return;
16211         }
16212
16213         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
16214                 goto nla_put_failure;
16215
16216         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
16217                 goto nla_put_failure;
16218
16219         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
16220                 goto nla_put_failure;
16221
16222         if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
16223             nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
16224                 goto nla_put_failure;
16225
16226         if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
16227             nla_put_u8(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
16228                 goto nla_put_failure;
16229
16230         if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
16231             nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
16232                 goto nla_put_failure;
16233
16234         genlmsg_end(msg, hdr);
16235
16236         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16237                                 NL80211_MCGRP_MLME, gfp);
16238
16239         return;
16240
16241 nla_put_failure:
16242         nlmsg_free(msg);
16243 }
16244 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
16245
16246 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
16247                            u64 cookie, bool acked, s32 ack_signal,
16248                            bool is_valid_ack_signal, gfp_t gfp)
16249 {
16250         struct wireless_dev *wdev = dev->ieee80211_ptr;
16251         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16252         struct sk_buff *msg;
16253         void *hdr;
16254
16255         trace_cfg80211_probe_status(dev, addr, cookie, acked);
16256
16257         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16258
16259         if (!msg)
16260                 return;
16261
16262         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
16263         if (!hdr) {
16264                 nlmsg_free(msg);
16265                 return;
16266         }
16267
16268         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16269             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16270             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
16271             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
16272                               NL80211_ATTR_PAD) ||
16273             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
16274             (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
16275                                                 ack_signal)))
16276                 goto nla_put_failure;
16277
16278         genlmsg_end(msg, hdr);
16279
16280         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16281                                 NL80211_MCGRP_MLME, gfp);
16282         return;
16283
16284  nla_put_failure:
16285         nlmsg_free(msg);
16286 }
16287 EXPORT_SYMBOL(cfg80211_probe_status);
16288
16289 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
16290                                  const u8 *frame, size_t len,
16291                                  int freq, int sig_dbm)
16292 {
16293         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16294         struct sk_buff *msg;
16295         void *hdr;
16296         struct cfg80211_beacon_registration *reg;
16297
16298         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
16299
16300         spin_lock_bh(&rdev->beacon_registrations_lock);
16301         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
16302                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
16303                 if (!msg) {
16304                         spin_unlock_bh(&rdev->beacon_registrations_lock);
16305                         return;
16306                 }
16307
16308                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
16309                 if (!hdr)
16310                         goto nla_put_failure;
16311
16312                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16313                     (freq &&
16314                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
16315                     (sig_dbm &&
16316                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
16317                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
16318                         goto nla_put_failure;
16319
16320                 genlmsg_end(msg, hdr);
16321
16322                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
16323         }
16324         spin_unlock_bh(&rdev->beacon_registrations_lock);
16325         return;
16326
16327  nla_put_failure:
16328         spin_unlock_bh(&rdev->beacon_registrations_lock);
16329         nlmsg_free(msg);
16330 }
16331 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
16332
16333 #ifdef CONFIG_PM
16334 static int cfg80211_net_detect_results(struct sk_buff *msg,
16335                                        struct cfg80211_wowlan_wakeup *wakeup)
16336 {
16337         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
16338         struct nlattr *nl_results, *nl_match, *nl_freqs;
16339         int i, j;
16340
16341         nl_results = nla_nest_start_noflag(msg,
16342                                            NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
16343         if (!nl_results)
16344                 return -EMSGSIZE;
16345
16346         for (i = 0; i < nd->n_matches; i++) {
16347                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
16348
16349                 nl_match = nla_nest_start_noflag(msg, i);
16350                 if (!nl_match)
16351                         break;
16352
16353                 /* The SSID attribute is optional in nl80211, but for
16354                  * simplicity reasons it's always present in the
16355                  * cfg80211 structure.  If a driver can't pass the
16356                  * SSID, that needs to be changed.  A zero length SSID
16357                  * is still a valid SSID (wildcard), so it cannot be
16358                  * used for this purpose.
16359                  */
16360                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
16361                             match->ssid.ssid)) {
16362                         nla_nest_cancel(msg, nl_match);
16363                         goto out;
16364                 }
16365
16366                 if (match->n_channels) {
16367                         nl_freqs = nla_nest_start_noflag(msg,
16368                                                          NL80211_ATTR_SCAN_FREQUENCIES);
16369                         if (!nl_freqs) {
16370                                 nla_nest_cancel(msg, nl_match);
16371                                 goto out;
16372                         }
16373
16374                         for (j = 0; j < match->n_channels; j++) {
16375                                 if (nla_put_u32(msg, j, match->channels[j])) {
16376                                         nla_nest_cancel(msg, nl_freqs);
16377                                         nla_nest_cancel(msg, nl_match);
16378                                         goto out;
16379                                 }
16380                         }
16381
16382                         nla_nest_end(msg, nl_freqs);
16383                 }
16384
16385                 nla_nest_end(msg, nl_match);
16386         }
16387
16388 out:
16389         nla_nest_end(msg, nl_results);
16390         return 0;
16391 }
16392
16393 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
16394                                    struct cfg80211_wowlan_wakeup *wakeup,
16395                                    gfp_t gfp)
16396 {
16397         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16398         struct sk_buff *msg;
16399         void *hdr;
16400         int size = 200;
16401
16402         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
16403
16404         if (wakeup)
16405                 size += wakeup->packet_present_len;
16406
16407         msg = nlmsg_new(size, gfp);
16408         if (!msg)
16409                 return;
16410
16411         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
16412         if (!hdr)
16413                 goto free_msg;
16414
16415         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16416             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16417                               NL80211_ATTR_PAD))
16418                 goto free_msg;
16419
16420         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16421                                         wdev->netdev->ifindex))
16422                 goto free_msg;
16423
16424         if (wakeup) {
16425                 struct nlattr *reasons;
16426
16427                 reasons = nla_nest_start_noflag(msg,
16428                                                 NL80211_ATTR_WOWLAN_TRIGGERS);
16429                 if (!reasons)
16430                         goto free_msg;
16431
16432                 if (wakeup->disconnect &&
16433                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
16434                         goto free_msg;
16435                 if (wakeup->magic_pkt &&
16436                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
16437                         goto free_msg;
16438                 if (wakeup->gtk_rekey_failure &&
16439                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
16440                         goto free_msg;
16441                 if (wakeup->eap_identity_req &&
16442                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
16443                         goto free_msg;
16444                 if (wakeup->four_way_handshake &&
16445                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
16446                         goto free_msg;
16447                 if (wakeup->rfkill_release &&
16448                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
16449                         goto free_msg;
16450
16451                 if (wakeup->pattern_idx >= 0 &&
16452                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
16453                                 wakeup->pattern_idx))
16454                         goto free_msg;
16455
16456                 if (wakeup->tcp_match &&
16457                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
16458                         goto free_msg;
16459
16460                 if (wakeup->tcp_connlost &&
16461                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
16462                         goto free_msg;
16463
16464                 if (wakeup->tcp_nomoretokens &&
16465                     nla_put_flag(msg,
16466                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
16467                         goto free_msg;
16468
16469                 if (wakeup->packet) {
16470                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
16471                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
16472
16473                         if (!wakeup->packet_80211) {
16474                                 pkt_attr =
16475                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
16476                                 len_attr =
16477                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
16478                         }
16479
16480                         if (wakeup->packet_len &&
16481                             nla_put_u32(msg, len_attr, wakeup->packet_len))
16482                                 goto free_msg;
16483
16484                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
16485                                     wakeup->packet))
16486                                 goto free_msg;
16487                 }
16488
16489                 if (wakeup->net_detect &&
16490                     cfg80211_net_detect_results(msg, wakeup))
16491                                 goto free_msg;
16492
16493                 nla_nest_end(msg, reasons);
16494         }
16495
16496         genlmsg_end(msg, hdr);
16497
16498         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16499                                 NL80211_MCGRP_MLME, gfp);
16500         return;
16501
16502  free_msg:
16503         nlmsg_free(msg);
16504 }
16505 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
16506 #endif
16507
16508 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
16509                                 enum nl80211_tdls_operation oper,
16510                                 u16 reason_code, gfp_t gfp)
16511 {
16512         struct wireless_dev *wdev = dev->ieee80211_ptr;
16513         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16514         struct sk_buff *msg;
16515         void *hdr;
16516
16517         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
16518                                          reason_code);
16519
16520         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16521         if (!msg)
16522                 return;
16523
16524         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
16525         if (!hdr) {
16526                 nlmsg_free(msg);
16527                 return;
16528         }
16529
16530         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16531             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16532             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
16533             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
16534             (reason_code > 0 &&
16535              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
16536                 goto nla_put_failure;
16537
16538         genlmsg_end(msg, hdr);
16539
16540         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16541                                 NL80211_MCGRP_MLME, gfp);
16542         return;
16543
16544  nla_put_failure:
16545         nlmsg_free(msg);
16546 }
16547 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
16548
16549 static int nl80211_netlink_notify(struct notifier_block * nb,
16550                                   unsigned long state,
16551                                   void *_notify)
16552 {
16553         struct netlink_notify *notify = _notify;
16554         struct cfg80211_registered_device *rdev;
16555         struct wireless_dev *wdev;
16556         struct cfg80211_beacon_registration *reg, *tmp;
16557
16558         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
16559                 return NOTIFY_DONE;
16560
16561         rcu_read_lock();
16562
16563         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
16564                 struct cfg80211_sched_scan_request *sched_scan_req;
16565
16566                 list_for_each_entry_rcu(sched_scan_req,
16567                                         &rdev->sched_scan_req_list,
16568                                         list) {
16569                         if (sched_scan_req->owner_nlportid == notify->portid) {
16570                                 sched_scan_req->nl_owner_dead = true;
16571                                 schedule_work(&rdev->sched_scan_stop_wk);
16572                         }
16573                 }
16574
16575                 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
16576                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
16577
16578                         if (wdev->owner_nlportid == notify->portid) {
16579                                 wdev->nl_owner_dead = true;
16580                                 schedule_work(&rdev->destroy_work);
16581                         } else if (wdev->conn_owner_nlportid == notify->portid) {
16582                                 schedule_work(&wdev->disconnect_wk);
16583                         }
16584
16585                         cfg80211_release_pmsr(wdev, notify->portid);
16586                 }
16587
16588                 spin_lock_bh(&rdev->beacon_registrations_lock);
16589                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
16590                                          list) {
16591                         if (reg->nlportid == notify->portid) {
16592                                 list_del(&reg->list);
16593                                 kfree(reg);
16594                                 break;
16595                         }
16596                 }
16597                 spin_unlock_bh(&rdev->beacon_registrations_lock);
16598         }
16599
16600         rcu_read_unlock();
16601
16602         /*
16603          * It is possible that the user space process that is controlling the
16604          * indoor setting disappeared, so notify the regulatory core.
16605          */
16606         regulatory_netlink_notify(notify->portid);
16607         return NOTIFY_OK;
16608 }
16609
16610 static struct notifier_block nl80211_netlink_notifier = {
16611         .notifier_call = nl80211_netlink_notify,
16612 };
16613
16614 void cfg80211_ft_event(struct net_device *netdev,
16615                        struct cfg80211_ft_event_params *ft_event)
16616 {
16617         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
16618         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16619         struct sk_buff *msg;
16620         void *hdr;
16621
16622         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
16623
16624         if (!ft_event->target_ap)
16625                 return;
16626
16627         msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
16628                         GFP_KERNEL);
16629         if (!msg)
16630                 return;
16631
16632         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
16633         if (!hdr)
16634                 goto out;
16635
16636         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16637             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16638             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
16639                 goto out;
16640
16641         if (ft_event->ies &&
16642             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
16643                 goto out;
16644         if (ft_event->ric_ies &&
16645             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
16646                     ft_event->ric_ies))
16647                 goto out;
16648
16649         genlmsg_end(msg, hdr);
16650
16651         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16652                                 NL80211_MCGRP_MLME, GFP_KERNEL);
16653         return;
16654  out:
16655         nlmsg_free(msg);
16656 }
16657 EXPORT_SYMBOL(cfg80211_ft_event);
16658
16659 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
16660 {
16661         struct cfg80211_registered_device *rdev;
16662         struct sk_buff *msg;
16663         void *hdr;
16664         u32 nlportid;
16665
16666         rdev = wiphy_to_rdev(wdev->wiphy);
16667         if (!rdev->crit_proto_nlportid)
16668                 return;
16669
16670         nlportid = rdev->crit_proto_nlportid;
16671         rdev->crit_proto_nlportid = 0;
16672
16673         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16674         if (!msg)
16675                 return;
16676
16677         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
16678         if (!hdr)
16679                 goto nla_put_failure;
16680
16681         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16682             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16683                               NL80211_ATTR_PAD))
16684                 goto nla_put_failure;
16685
16686         genlmsg_end(msg, hdr);
16687
16688         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
16689         return;
16690
16691  nla_put_failure:
16692         nlmsg_free(msg);
16693 }
16694 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
16695
16696 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
16697 {
16698         struct wiphy *wiphy = wdev->wiphy;
16699         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16700         struct sk_buff *msg;
16701         void *hdr;
16702
16703         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16704         if (!msg)
16705                 return;
16706
16707         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
16708         if (!hdr)
16709                 goto out;
16710
16711         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16712             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
16713             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16714                               NL80211_ATTR_PAD))
16715                 goto out;
16716
16717         genlmsg_end(msg, hdr);
16718
16719         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
16720                                 NL80211_MCGRP_MLME, GFP_KERNEL);
16721         return;
16722  out:
16723         nlmsg_free(msg);
16724 }
16725
16726 int cfg80211_external_auth_request(struct net_device *dev,
16727                                    struct cfg80211_external_auth_params *params,
16728                                    gfp_t gfp)
16729 {
16730         struct wireless_dev *wdev = dev->ieee80211_ptr;
16731         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16732         struct sk_buff *msg;
16733         void *hdr;
16734
16735         if (!wdev->conn_owner_nlportid)
16736                 return -EINVAL;
16737
16738         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16739         if (!msg)
16740                 return -ENOMEM;
16741
16742         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
16743         if (!hdr)
16744                 goto nla_put_failure;
16745
16746         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16747             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16748             nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) ||
16749             nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
16750                         params->action) ||
16751             nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
16752             nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
16753                     params->ssid.ssid))
16754                 goto nla_put_failure;
16755
16756         genlmsg_end(msg, hdr);
16757         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
16758                         wdev->conn_owner_nlportid);
16759         return 0;
16760
16761  nla_put_failure:
16762         nlmsg_free(msg);
16763         return -ENOBUFS;
16764 }
16765 EXPORT_SYMBOL(cfg80211_external_auth_request);
16766
16767 void cfg80211_update_owe_info_event(struct net_device *netdev,
16768                                     struct cfg80211_update_owe_info *owe_info,
16769                                     gfp_t gfp)
16770 {
16771         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
16772         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16773         struct sk_buff *msg;
16774         void *hdr;
16775
16776         trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info);
16777
16778         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16779         if (!msg)
16780                 return;
16781
16782         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO);
16783         if (!hdr)
16784                 goto nla_put_failure;
16785
16786         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16787             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16788             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer))
16789                 goto nla_put_failure;
16790
16791         if (!owe_info->ie_len ||
16792             nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie))
16793                 goto nla_put_failure;
16794
16795         genlmsg_end(msg, hdr);
16796
16797         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16798                                 NL80211_MCGRP_MLME, gfp);
16799         return;
16800
16801 nla_put_failure:
16802         genlmsg_cancel(msg, hdr);
16803         nlmsg_free(msg);
16804 }
16805 EXPORT_SYMBOL(cfg80211_update_owe_info_event);
16806
16807 /* initialisation/exit functions */
16808
16809 int __init nl80211_init(void)
16810 {
16811         int err;
16812
16813         err = genl_register_family(&nl80211_fam);
16814         if (err)
16815                 return err;
16816
16817         err = netlink_register_notifier(&nl80211_netlink_notifier);
16818         if (err)
16819                 goto err_out;
16820
16821         return 0;
16822  err_out:
16823         genl_unregister_family(&nl80211_fam);
16824         return err;
16825 }
16826
16827 void nl80211_exit(void)
16828 {
16829         netlink_unregister_notifier(&nl80211_netlink_notifier);
16830         genl_unregister_family(&nl80211_fam);
16831 }