net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright 2013-2014  Intel Mobile Communications GmbH
   6  * Copyright 2015-2017  Intel Deutschland GmbH
   7  * Copyright (C) 2018 Intel Corporation
   8  */
   9
  10 #include <linux/if.h>
  11 #include <linux/module.h>
  12 #include <linux/err.h>
  13 #include <linux/slab.h>
  14 #include <linux/list.h>
  15 #include <linux/if_ether.h>
  16 #include <linux/ieee80211.h>
  17 #include <linux/nl80211.h>
  18 #include <linux/rtnetlink.h>
  19 #include <linux/netlink.h>
  20 #include <linux/nospec.h>
  21 #include <linux/etherdevice.h>
  22 #include <net/net_namespace.h>
  23 #include <net/genetlink.h>
  24 #include <net/cfg80211.h>
  25 #include <net/sock.h>
  26 #include <net/inet_connection_sock.h>
  27 #include "core.h"
  28 #include "nl80211.h"
  29 #include "reg.h"
  30 #include "rdev-ops.h"
  31
  32 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  33                                    struct genl_info *info,
  34                                    struct cfg80211_crypto_settings *settings,
  35                                    int cipher_limit);
  36
  37 /* the netlink family */
  38 static struct genl_family nl80211_fam;
  39
  40 /* multicast groups */
  41 enum nl80211_multicast_groups {
  42         NL80211_MCGRP_CONFIG,
  43         NL80211_MCGRP_SCAN,
  44         NL80211_MCGRP_REGULATORY,
  45         NL80211_MCGRP_MLME,
  46         NL80211_MCGRP_VENDOR,
  47         NL80211_MCGRP_NAN,
  48         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  49 };
  50
  51 static const struct genl_multicast_group nl80211_mcgrps[] = {
  52         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  53         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  54         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  55         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  56         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  57         [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
  58 #ifdef CONFIG_NL80211_TESTMODE
  59         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  60 #endif
  61 };
  62
  63 /* returns ERR_PTR values */
  64 static struct wireless_dev *
  65 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  66 {
  67         struct cfg80211_registered_device *rdev;
  68         struct wireless_dev *result = NULL;
  69         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  70         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  71         u64 wdev_id;
  72         int wiphy_idx = -1;
  73         int ifidx = -1;
  74
  75         ASSERT_RTNL();
  76
  77         if (!have_ifidx && !have_wdev_id)
  78                 return ERR_PTR(-EINVAL);
  79
  80         if (have_ifidx)
  81                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  82         if (have_wdev_id) {
  83                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  84                 wiphy_idx = wdev_id >> 32;
  85         }
  86
  87         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  88                 struct wireless_dev *wdev;
  89
  90                 if (wiphy_net(&rdev->wiphy) != netns)
  91                         continue;
  92
  93                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  94                         continue;
  95
  96                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
  97                         if (have_ifidx && wdev->netdev &&
  98                             wdev->netdev->ifindex == ifidx) {
  99                                 result = wdev;
 100                                 break;
 101                         }
 102                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 103                                 result = wdev;
 104                                 break;
 105                         }
 106                 }
 107
 108                 if (result)
 109                         break;
 110         }
 111
 112         if (result)
 113                 return result;
 114         return ERR_PTR(-ENODEV);
 115 }
 116
 117 static struct cfg80211_registered_device *
 118 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 119 {
 120         struct cfg80211_registered_device *rdev = NULL, *tmp;
 121         struct net_device *netdev;
 122
 123         ASSERT_RTNL();
 124
 125         if (!attrs[NL80211_ATTR_WIPHY] &&
 126             !attrs[NL80211_ATTR_IFINDEX] &&
 127             !attrs[NL80211_ATTR_WDEV])
 128                 return ERR_PTR(-EINVAL);
 129
 130         if (attrs[NL80211_ATTR_WIPHY])
 131                 rdev = cfg80211_rdev_by_wiphy_idx(
 132                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 133
 134         if (attrs[NL80211_ATTR_WDEV]) {
 135                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 136                 struct wireless_dev *wdev;
 137                 bool found = false;
 138
 139                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 140                 if (tmp) {
 141                         /* make sure wdev exists */
 142                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 143                                 if (wdev->identifier != (u32)wdev_id)
 144                                         continue;
 145                                 found = true;
 146                                 break;
 147                         }
 148
 149                         if (!found)
 150                                 tmp = NULL;
 151
 152                         if (rdev && tmp != rdev)
 153                                 return ERR_PTR(-EINVAL);
 154                         rdev = tmp;
 155                 }
 156         }
 157
 158         if (attrs[NL80211_ATTR_IFINDEX]) {
 159                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 160
 161                 netdev = __dev_get_by_index(netns, ifindex);
 162                 if (netdev) {
 163                         if (netdev->ieee80211_ptr)
 164                                 tmp = wiphy_to_rdev(
 165                                         netdev->ieee80211_ptr->wiphy);
 166                         else
 167                                 tmp = NULL;
 168
 169                         /* not wireless device -- return error */
 170                         if (!tmp)
 171                                 return ERR_PTR(-EINVAL);
 172
 173                         /* mismatch -- return error */
 174                         if (rdev && tmp != rdev)
 175                                 return ERR_PTR(-EINVAL);
 176
 177                         rdev = tmp;
 178                 }
 179         }
 180
 181         if (!rdev)
 182                 return ERR_PTR(-ENODEV);
 183
 184         if (netns != wiphy_net(&rdev->wiphy))
 185                 return ERR_PTR(-ENODEV);
 186
 187         return rdev;
 188 }
 189
 190 /*
 191  * This function returns a pointer to the driver
 192  * that the genl_info item that is passed refers to.
 193  *
 194  * The result of this can be a PTR_ERR and hence must
 195  * be checked with IS_ERR() for errors.
 196  */
 197 static struct cfg80211_registered_device *
 198 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 199 {
 200         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 201 }
 202
 203 static int validate_ie_attr(const struct nlattr *attr,
 204                             struct netlink_ext_ack *extack)
 205 {
 206         const u8 *pos;
 207         int len;
 208
 209         pos = nla_data(attr);
 210         len = nla_len(attr);
 211
 212         while (len) {
 213                 u8 elemlen;
 214
 215                 if (len < 2)
 216                         goto error;
 217                 len -= 2;
 218
 219                 elemlen = pos[1];
 220                 if (elemlen > len)
 221                         goto error;
 222
 223                 len -= elemlen;
 224                 pos += 2 + elemlen;
 225         }
 226
 227         return 0;
 228 error:
 229         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
 230         return -EINVAL;
 231 }
 232
 233 /* policy for the attributes */
 234 static const struct nla_policy
 235 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
 236         [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
 237         [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
 238                                         .len = U8_MAX },
 239         [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
 240                                              .len = U8_MAX },
 241 };
 242
 243 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 244         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 245         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 246                                       .len = 20-1 },
 247         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 248
 249         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 250         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 251         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 252         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 253         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 254
 255         [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 256         [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 257         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 258         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 259         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 260         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 261
 262         [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
 263         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 264         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 265
 266         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 267         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 268
 269         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 270         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 271                                     .len = WLAN_MAX_KEY_LEN },
 272         [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 5),
 273         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 274         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 275         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 276         [NL80211_ATTR_KEY_TYPE] =
 277                 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
 278
 279         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 280         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 281         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 282                                        .len = IEEE80211_MAX_DATA_LEN },
 283         [NL80211_ATTR_BEACON_TAIL] =
 284                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 285                                        IEEE80211_MAX_DATA_LEN),
 286         [NL80211_ATTR_STA_AID] =
 287                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 288         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 289         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 290         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 291                                                .len = NL80211_MAX_SUPP_RATES },
 292         [NL80211_ATTR_STA_PLINK_ACTION] =
 293                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
 294         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 295         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 296         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 297                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 298         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 299
 300         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 301         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 302
 303         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 304         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 305         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 306         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 307                                            .len = NL80211_MAX_SUPP_RATES },
 308         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 309
 310         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 311         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 312
 313         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 314
 315         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 316         [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
 317                                                    validate_ie_attr,
 318                                                    IEEE80211_MAX_DATA_LEN),
 319         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 320         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 321
 322         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 323                                 .len = IEEE80211_MAX_SSID_LEN },
 324         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 325         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 326         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 327         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 328         [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
 329                                                   NL80211_MFP_NO,
 330                                                   NL80211_MFP_OPTIONAL),
 331         [NL80211_ATTR_STA_FLAGS2] = {
 332                 .len = sizeof(struct nl80211_sta_flag_update),
 333         },
 334         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 335         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 336         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 337         [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
 338         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 339         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 340         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 341         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 342         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 343         [NL80211_ATTR_PMKID] = { .len = WLAN_PMKID_LEN },
 344         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 345         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 346         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 347         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 348                                  .len = IEEE80211_MAX_DATA_LEN },
 349         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 350         [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
 351                                                    NL80211_PS_DISABLED,
 352                                                    NL80211_PS_ENABLED),
 353         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 354         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 355         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 356         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 357         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 358         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 359         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 360         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 361         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 362         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 363         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 364         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 365         [NL80211_ATTR_STA_PLINK_STATE] =
 366                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
 367         [NL80211_ATTR_MESH_PEER_AID] =
 368                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 369         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 370         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 371         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 372         [NL80211_ATTR_HIDDEN_SSID] =
 373                 NLA_POLICY_RANGE(NLA_U32,
 374                                  NL80211_HIDDEN_SSID_NOT_IN_USE,
 375                                  NL80211_HIDDEN_SSID_ZERO_CONTENTS),
 376         [NL80211_ATTR_IE_PROBE_RESP] =
 377                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 378                                        IEEE80211_MAX_DATA_LEN),
 379         [NL80211_ATTR_IE_ASSOC_RESP] =
 380                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 381                                        IEEE80211_MAX_DATA_LEN),
 382         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 383         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 384         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 385         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 386         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 387         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 388         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 389         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 390         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 391         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 392         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 393                                       .len = IEEE80211_MAX_DATA_LEN },
 394         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 395         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 396         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 397                 .len = NL80211_HT_CAPABILITY_LEN
 398         },
 399         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 400         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 401         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 402         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 403         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 404         [NL80211_ATTR_AUTH_DATA] = { .type = NLA_BINARY, },
 405         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 406         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 407         [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
 408         [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
 409         [NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
 410                 NLA_POLICY_RANGE(NLA_U32,
 411                                  NL80211_MESH_POWER_UNKNOWN + 1,
 412                                  NL80211_MESH_POWER_MAX),
 413         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 414         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 415         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 416         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 417         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 418         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 419         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 420                 .len = NL80211_VHT_CAPABILITY_LEN,
 421         },
 422         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 423         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 424                                   .len = IEEE80211_MAX_DATA_LEN },
 425         [NL80211_ATTR_PEER_AID] =
 426                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 427         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 428         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 429         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 430         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 431         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 432         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 433         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 434         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 435         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 436         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 437         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 438         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 439         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 440                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 441         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 442         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 443         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 444         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 445         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 446         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 447         [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
 448         [NL80211_ATTR_USER_PRIO] =
 449                 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
 450         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 451         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 452         [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
 453         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 454         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 455         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 456         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 457         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 458         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 459         [NL80211_ATTR_STA_SUPPORT_P2P_PS] =
 460                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
 461         [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 462                 .len = VHT_MUMIMO_GROUPS_DATA_LEN
 463         },
 464         [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = { .len = ETH_ALEN },
 465         [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
 466         [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
 467         [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 468         [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
 469                                     .len = FILS_MAX_KEK_LEN },
 470         [NL80211_ATTR_FILS_NONCES] = { .len = 2 * FILS_NONCE_LEN },
 471         [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
 472         [NL80211_ATTR_BSSID] = { .len = ETH_ALEN },
 473         [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
 474         [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
 475                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 476         },
 477         [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
 478         [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
 479                                              .len = FILS_ERP_MAX_USERNAME_LEN },
 480         [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
 481                                           .len = FILS_ERP_MAX_REALM_LEN },
 482         [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
 483         [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
 484                                         .len = FILS_ERP_MAX_RRK_LEN },
 485         [NL80211_ATTR_FILS_CACHE_ID] = { .len = 2 },
 486         [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
 487         [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
 488         [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
 489
 490         [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
 491         [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
 492         [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
 493         [NL80211_ATTR_HE_CAPABILITY] = { .type = NLA_BINARY,
 494                                          .len = NL80211_HE_MAX_CAPABILITY_LEN },
 495
 496         [NL80211_ATTR_FTM_RESPONDER] = {
 497                 .type = NLA_NESTED,
 498                 .validation_data = nl80211_ftm_responder_policy,
 499         },
 500 };
 501
 502 /* policy for the key attributes */
 503 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 504         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 505         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 506         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 507         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 508         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 509         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 510         [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
 511         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 512 };
 513
 514 /* policy for the key default flags */
 515 static const struct nla_policy
 516 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 517         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 518         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 519 };
 520
 521 #ifdef CONFIG_PM
 522 /* policy for WoWLAN attributes */
 523 static const struct nla_policy
 524 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 525         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 526         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 527         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 528         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 529         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 530         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 531         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 532         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 533         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 534         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 535 };
 536
 537 static const struct nla_policy
 538 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 539         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 540         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 541         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 542         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 543         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 544         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 545         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 546                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 547         },
 548         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 549                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 550         },
 551         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 552         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 553         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 554 };
 555 #endif /* CONFIG_PM */
 556
 557 /* policy for coalesce rule attributes */
 558 static const struct nla_policy
 559 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 560         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 561         [NL80211_ATTR_COALESCE_RULE_CONDITION] =
 562                 NLA_POLICY_RANGE(NLA_U32,
 563                                  NL80211_COALESCE_CONDITION_MATCH,
 564                                  NL80211_COALESCE_CONDITION_NO_MATCH),
 565         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 566 };
 567
 568 /* policy for GTK rekey offload attributes */
 569 static const struct nla_policy
 570 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 571         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 572         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 573         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 574 };
 575
 576 static const struct nla_policy
 577 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 578         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 579                                                  .len = IEEE80211_MAX_SSID_LEN },
 580         [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = { .len = ETH_ALEN },
 581         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 582 };
 583
 584 static const struct nla_policy
 585 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 586         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 587         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 588 };
 589
 590 static const struct nla_policy
 591 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 592         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 593         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 594         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 595                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 596         },
 597 };
 598
 599 /* policy for NAN function attributes */
 600 static const struct nla_policy
 601 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 602         [NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 },
 603         [NL80211_NAN_FUNC_SERVICE_ID] = {
 604                                     .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 605         [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 606         [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 607         [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 608         [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 609         [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 610         [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = { .len = ETH_ALEN },
 611         [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 612         [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 613         [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 614                         .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 615         [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 616         [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 617         [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 618         [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 619         [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 620 };
 621
 622 /* policy for Service Response Filter attributes */
 623 static const struct nla_policy
 624 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 625         [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 626         [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 627                                  .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 628         [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 629         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 630 };
 631
 632 /* policy for packet pattern attributes */
 633 static const struct nla_policy
 634 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
 635         [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
 636         [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
 637         [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
 638 };
 639
 640 static int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
 641                                      struct cfg80211_registered_device **rdev,
 642                                      struct wireless_dev **wdev)
 643 {
 644         int err;
 645
 646         if (!cb->args[0]) {
 647                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 648                                   genl_family_attrbuf(&nl80211_fam),
 649                                   nl80211_fam.maxattr, nl80211_policy, NULL);
 650                 if (err)
 651                         return err;
 652
 653                 *wdev = __cfg80211_wdev_from_attrs(
 654                                         sock_net(cb->skb->sk),
 655                                         genl_family_attrbuf(&nl80211_fam));
 656                 if (IS_ERR(*wdev))
 657                         return PTR_ERR(*wdev);
 658                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 659                 /* 0 is the first index - add 1 to parse only once */
 660                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 661                 cb->args[1] = (*wdev)->identifier;
 662         } else {
 663                 /* subtract the 1 again here */
 664                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 665                 struct wireless_dev *tmp;
 666
 667                 if (!wiphy)
 668                         return -ENODEV;
 669                 *rdev = wiphy_to_rdev(wiphy);
 670                 *wdev = NULL;
 671
 672                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
 673                         if (tmp->identifier == cb->args[1]) {
 674                                 *wdev = tmp;
 675                                 break;
 676                         }
 677                 }
 678
 679                 if (!*wdev)
 680                         return -ENODEV;
 681         }
 682
 683         return 0;
 684 }
 685
 686 /* message building helper */
 687 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 688                                    int flags, u8 cmd)
 689 {
 690         /* since there is no private header just add the generic one */
 691         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 692 }
 693
 694 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
 695                                      const struct ieee80211_reg_rule *rule)
 696 {
 697         int j;
 698         struct nlattr *nl_wmm_rules =
 699                 nla_nest_start(msg, NL80211_FREQUENCY_ATTR_WMM);
 700
 701         if (!nl_wmm_rules)
 702                 goto nla_put_failure;
 703
 704         for (j = 0; j < IEEE80211_NUM_ACS; j++) {
 705                 struct nlattr *nl_wmm_rule = nla_nest_start(msg, j);
 706
 707                 if (!nl_wmm_rule)
 708                         goto nla_put_failure;
 709
 710                 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
 711                                 rule->wmm_rule.client[j].cw_min) ||
 712                     nla_put_u16(msg, NL80211_WMMR_CW_MAX,
 713                                 rule->wmm_rule.client[j].cw_max) ||
 714                     nla_put_u8(msg, NL80211_WMMR_AIFSN,
 715                                rule->wmm_rule.client[j].aifsn) ||
 716                     nla_put_u16(msg, NL80211_WMMR_TXOP,
 717                                 rule->wmm_rule.client[j].cot))
 718                         goto nla_put_failure;
 719
 720                 nla_nest_end(msg, nl_wmm_rule);
 721         }
 722         nla_nest_end(msg, nl_wmm_rules);
 723
 724         return 0;
 725
 726 nla_put_failure:
 727         return -ENOBUFS;
 728 }
 729
 730 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
 731                                    struct ieee80211_channel *chan,
 732                                    bool large)
 733 {
 734         /* Some channels must be completely excluded from the
 735          * list to protect old user-space tools from breaking
 736          */
 737         if (!large && chan->flags &
 738             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 739                 return 0;
 740
 741         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 742                         chan->center_freq))
 743                 goto nla_put_failure;
 744
 745         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 746             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 747                 goto nla_put_failure;
 748         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 749                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 750                         goto nla_put_failure;
 751                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 752                         goto nla_put_failure;
 753         }
 754         if (chan->flags & IEEE80211_CHAN_RADAR) {
 755                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 756                         goto nla_put_failure;
 757                 if (large) {
 758                         u32 time;
 759
 760                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 761
 762                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 763                                         chan->dfs_state))
 764                                 goto nla_put_failure;
 765                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 766                                         time))
 767                                 goto nla_put_failure;
 768                         if (nla_put_u32(msg,
 769                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 770                                         chan->dfs_cac_ms))
 771                                 goto nla_put_failure;
 772                 }
 773         }
 774
 775         if (large) {
 776                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 777                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 778                         goto nla_put_failure;
 779                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 780                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 781                         goto nla_put_failure;
 782                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 783                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 784                         goto nla_put_failure;
 785                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 786                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 787                         goto nla_put_failure;
 788                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 789                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 790                         goto nla_put_failure;
 791                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
 792                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
 793                         goto nla_put_failure;
 794                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 795                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 796                         goto nla_put_failure;
 797                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 798                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 799                         goto nla_put_failure;
 800         }
 801
 802         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 803                         DBM_TO_MBM(chan->max_power)))
 804                 goto nla_put_failure;
 805
 806         if (large) {
 807                 const struct ieee80211_reg_rule *rule =
 808                         freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
 809
 810                 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
 811                         if (nl80211_msg_put_wmm_rules(msg, rule))
 812                                 goto nla_put_failure;
 813                 }
 814         }
 815
 816         return 0;
 817
 818  nla_put_failure:
 819         return -ENOBUFS;
 820 }
 821
 822 static bool nl80211_put_txq_stats(struct sk_buff *msg,
 823                                   struct cfg80211_txq_stats *txqstats,
 824                                   int attrtype)
 825 {
 826         struct nlattr *txqattr;
 827
 828 #define PUT_TXQVAL_U32(attr, memb) do {                                   \
 829         if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) &&         \
 830             nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
 831                 return false;                                             \
 832         } while (0)
 833
 834         txqattr = nla_nest_start(msg, attrtype);
 835         if (!txqattr)
 836                 return false;
 837
 838         PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
 839         PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
 840         PUT_TXQVAL_U32(FLOWS, flows);
 841         PUT_TXQVAL_U32(DROPS, drops);
 842         PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
 843         PUT_TXQVAL_U32(OVERLIMIT, overlimit);
 844         PUT_TXQVAL_U32(OVERMEMORY, overmemory);
 845         PUT_TXQVAL_U32(COLLISIONS, collisions);
 846         PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
 847         PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
 848         PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
 849         nla_nest_end(msg, txqattr);
 850
 851 #undef PUT_TXQVAL_U32
 852         return true;
 853 }
 854
 855 /* netlink command implementations */
 856
 857 struct key_parse {
 858         struct key_params p;
 859         int idx;
 860         int type;
 861         bool def, defmgmt;
 862         bool def_uni, def_multi;
 863 };
 864
 865 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
 866                                  struct key_parse *k)
 867 {
 868         struct nlattr *tb[NL80211_KEY_MAX + 1];
 869         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 870                                    nl80211_key_policy, info->extack);
 871         if (err)
 872                 return err;
 873
 874         k->def = !!tb[NL80211_KEY_DEFAULT];
 875         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 876
 877         if (k->def) {
 878                 k->def_uni = true;
 879                 k->def_multi = true;
 880         }
 881         if (k->defmgmt)
 882                 k->def_multi = true;
 883
 884         if (tb[NL80211_KEY_IDX])
 885                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 886
 887         if (tb[NL80211_KEY_DATA]) {
 888                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 889                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 890         }
 891
 892         if (tb[NL80211_KEY_SEQ]) {
 893                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 894                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 895         }
 896
 897         if (tb[NL80211_KEY_CIPHER])
 898                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 899
 900         if (tb[NL80211_KEY_TYPE])
 901                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 902
 903         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 904                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 905
 906                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 907                                        tb[NL80211_KEY_DEFAULT_TYPES],
 908                                        nl80211_key_default_policy,
 909                                        info->extack);
 910                 if (err)
 911                         return err;
 912
 913                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 914                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 915         }
 916
 917         return 0;
 918 }
 919
 920 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 921 {
 922         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 923                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 924                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 925         }
 926
 927         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 928                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 929                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 930         }
 931
 932         if (info->attrs[NL80211_ATTR_KEY_IDX])
 933                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 934
 935         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 936                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 937
 938         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 939         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 940
 941         if (k->def) {
 942                 k->def_uni = true;
 943                 k->def_multi = true;
 944         }
 945         if (k->defmgmt)
 946                 k->def_multi = true;
 947
 948         if (info->attrs[NL80211_ATTR_KEY_TYPE])
 949                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 950
 951         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 952                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 953                 int err = nla_parse_nested(kdt,
 954                                            NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 955                                            info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 956                                            nl80211_key_default_policy,
 957                                            info->extack);
 958                 if (err)
 959                         return err;
 960
 961                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 962                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 963         }
 964
 965         return 0;
 966 }
 967
 968 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 969 {
 970         int err;
 971
 972         memset(k, 0, sizeof(*k));
 973         k->idx = -1;
 974         k->type = -1;
 975
 976         if (info->attrs[NL80211_ATTR_KEY])
 977                 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
 978         else
 979                 err = nl80211_parse_key_old(info, k);
 980
 981         if (err)
 982                 return err;
 983
 984         if (k->def && k->defmgmt) {
 985                 GENL_SET_ERR_MSG(info, "key with def && defmgmt is invalid");
 986                 return -EINVAL;
 987         }
 988
 989         if (k->defmgmt) {
 990                 if (k->def_uni || !k->def_multi) {
 991                         GENL_SET_ERR_MSG(info, "defmgmt key must be mcast");
 992                         return -EINVAL;
 993                 }
 994         }
 995
 996         if (k->idx != -1) {
 997                 if (k->defmgmt) {
 998                         if (k->idx < 4 || k->idx > 5) {
 999                                 GENL_SET_ERR_MSG(info,
1000                                                  "defmgmt key idx not 4 or 5");
1001                                 return -EINVAL;
1002                         }
1003                 } else if (k->def) {
1004                         if (k->idx < 0 || k->idx > 3) {
1005                                 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1006                                 return -EINVAL;
1007                         }
1008                 } else {
1009                         if (k->idx < 0 || k->idx > 5) {
1010                                 GENL_SET_ERR_MSG(info, "key idx not 0-5");
1011                                 return -EINVAL;
1012                         }
1013                 }
1014         }
1015
1016         return 0;
1017 }
1018
1019 static struct cfg80211_cached_keys *
1020 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1021                        struct genl_info *info, bool *no_ht)
1022 {
1023         struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1024         struct key_parse parse;
1025         struct nlattr *key;
1026         struct cfg80211_cached_keys *result;
1027         int rem, err, def = 0;
1028         bool have_key = false;
1029
1030         nla_for_each_nested(key, keys, rem) {
1031                 have_key = true;
1032                 break;
1033         }
1034
1035         if (!have_key)
1036                 return NULL;
1037
1038         result = kzalloc(sizeof(*result), GFP_KERNEL);
1039         if (!result)
1040                 return ERR_PTR(-ENOMEM);
1041
1042         result->def = -1;
1043
1044         nla_for_each_nested(key, keys, rem) {
1045                 memset(&parse, 0, sizeof(parse));
1046                 parse.idx = -1;
1047
1048                 err = nl80211_parse_key_new(info, key, &parse);
1049                 if (err)
1050                         goto error;
1051                 err = -EINVAL;
1052                 if (!parse.p.key)
1053                         goto error;
1054                 if (parse.idx < 0 || parse.idx > 3) {
1055                         GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1056                         goto error;
1057                 }
1058                 if (parse.def) {
1059                         if (def) {
1060                                 GENL_SET_ERR_MSG(info,
1061                                                  "only one key can be default");
1062                                 goto error;
1063                         }
1064                         def = 1;
1065                         result->def = parse.idx;
1066                         if (!parse.def_uni || !parse.def_multi)
1067                                 goto error;
1068                 } else if (parse.defmgmt)
1069                         goto error;
1070                 err = cfg80211_validate_key_settings(rdev, &parse.p,
1071                                                      parse.idx, false, NULL);
1072                 if (err)
1073                         goto error;
1074                 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1075                     parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1076                         GENL_SET_ERR_MSG(info, "connect key must be WEP");
1077                         err = -EINVAL;
1078                         goto error;
1079                 }
1080                 result->params[parse.idx].cipher = parse.p.cipher;
1081                 result->params[parse.idx].key_len = parse.p.key_len;
1082                 result->params[parse.idx].key = result->data[parse.idx];
1083                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1084
1085                 /* must be WEP key if we got here */
1086                 if (no_ht)
1087                         *no_ht = true;
1088         }
1089
1090         if (result->def < 0) {
1091                 err = -EINVAL;
1092                 GENL_SET_ERR_MSG(info, "need a default/TX key");
1093                 goto error;
1094         }
1095
1096         return result;
1097  error:
1098         kfree(result);
1099         return ERR_PTR(err);
1100 }
1101
1102 static int nl80211_key_allowed(struct wireless_dev *wdev)
1103 {
1104         ASSERT_WDEV_LOCK(wdev);
1105
1106         switch (wdev->iftype) {
1107         case NL80211_IFTYPE_AP:
1108         case NL80211_IFTYPE_AP_VLAN:
1109         case NL80211_IFTYPE_P2P_GO:
1110         case NL80211_IFTYPE_MESH_POINT:
1111                 break;
1112         case NL80211_IFTYPE_ADHOC:
1113         case NL80211_IFTYPE_STATION:
1114         case NL80211_IFTYPE_P2P_CLIENT:
1115                 if (!wdev->current_bss)
1116                         return -ENOLINK;
1117                 break;
1118         case NL80211_IFTYPE_UNSPECIFIED:
1119         case NL80211_IFTYPE_OCB:
1120         case NL80211_IFTYPE_MONITOR:
1121         case NL80211_IFTYPE_NAN:
1122         case NL80211_IFTYPE_P2P_DEVICE:
1123         case NL80211_IFTYPE_WDS:
1124         case NUM_NL80211_IFTYPES:
1125                 return -EINVAL;
1126         }
1127
1128         return 0;
1129 }
1130
1131 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1132                                                         struct nlattr *tb)
1133 {
1134         struct ieee80211_channel *chan;
1135
1136         if (tb == NULL)
1137                 return NULL;
1138         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
1139         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1140                 return NULL;
1141         return chan;
1142 }
1143
1144 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1145 {
1146         struct nlattr *nl_modes = nla_nest_start(msg, attr);
1147         int i;
1148
1149         if (!nl_modes)
1150                 goto nla_put_failure;
1151
1152         i = 0;
1153         while (ifmodes) {
1154                 if ((ifmodes & 1) && nla_put_flag(msg, i))
1155                         goto nla_put_failure;
1156                 ifmodes >>= 1;
1157                 i++;
1158         }
1159
1160         nla_nest_end(msg, nl_modes);
1161         return 0;
1162
1163 nla_put_failure:
1164         return -ENOBUFS;
1165 }
1166
1167 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1168                                           struct sk_buff *msg,
1169                                           bool large)
1170 {
1171         struct nlattr *nl_combis;
1172         int i, j;
1173
1174         nl_combis = nla_nest_start(msg,
1175                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
1176         if (!nl_combis)
1177                 goto nla_put_failure;
1178
1179         for (i = 0; i < wiphy->n_iface_combinations; i++) {
1180                 const struct ieee80211_iface_combination *c;
1181                 struct nlattr *nl_combi, *nl_limits;
1182
1183                 c = &wiphy->iface_combinations[i];
1184
1185                 nl_combi = nla_nest_start(msg, i + 1);
1186                 if (!nl_combi)
1187                         goto nla_put_failure;
1188
1189                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
1190                 if (!nl_limits)
1191                         goto nla_put_failure;
1192
1193                 for (j = 0; j < c->n_limits; j++) {
1194                         struct nlattr *nl_limit;
1195
1196                         nl_limit = nla_nest_start(msg, j + 1);
1197                         if (!nl_limit)
1198                                 goto nla_put_failure;
1199                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1200                                         c->limits[j].max))
1201                                 goto nla_put_failure;
1202                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1203                                                 c->limits[j].types))
1204                                 goto nla_put_failure;
1205                         nla_nest_end(msg, nl_limit);
1206                 }
1207
1208                 nla_nest_end(msg, nl_limits);
1209
1210                 if (c->beacon_int_infra_match &&
1211                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1212                         goto nla_put_failure;
1213                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1214                                 c->num_different_channels) ||
1215                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1216                                 c->max_interfaces))
1217                         goto nla_put_failure;
1218                 if (large &&
1219                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1220                                 c->radar_detect_widths) ||
1221                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1222                                 c->radar_detect_regions)))
1223                         goto nla_put_failure;
1224                 if (c->beacon_int_min_gcd &&
1225                     nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1226                                 c->beacon_int_min_gcd))
1227                         goto nla_put_failure;
1228
1229                 nla_nest_end(msg, nl_combi);
1230         }
1231
1232         nla_nest_end(msg, nl_combis);
1233
1234         return 0;
1235 nla_put_failure:
1236         return -ENOBUFS;
1237 }
1238
1239 #ifdef CONFIG_PM
1240 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1241                                         struct sk_buff *msg)
1242 {
1243         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1244         struct nlattr *nl_tcp;
1245
1246         if (!tcp)
1247                 return 0;
1248
1249         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1250         if (!nl_tcp)
1251                 return -ENOBUFS;
1252
1253         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1254                         tcp->data_payload_max))
1255                 return -ENOBUFS;
1256
1257         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1258                         tcp->data_payload_max))
1259                 return -ENOBUFS;
1260
1261         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1262                 return -ENOBUFS;
1263
1264         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1265                                 sizeof(*tcp->tok), tcp->tok))
1266                 return -ENOBUFS;
1267
1268         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1269                         tcp->data_interval_max))
1270                 return -ENOBUFS;
1271
1272         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1273                         tcp->wake_payload_max))
1274                 return -ENOBUFS;
1275
1276         nla_nest_end(msg, nl_tcp);
1277         return 0;
1278 }
1279
1280 static int nl80211_send_wowlan(struct sk_buff *msg,
1281                                struct cfg80211_registered_device *rdev,
1282                                bool large)
1283 {
1284         struct nlattr *nl_wowlan;
1285
1286         if (!rdev->wiphy.wowlan)
1287                 return 0;
1288
1289         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1290         if (!nl_wowlan)
1291                 return -ENOBUFS;
1292
1293         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1294              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1295             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1296              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1297             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1298              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1299             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1300              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1301             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1302              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1303             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1304              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1305             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1306              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1307             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1308              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1309                 return -ENOBUFS;
1310
1311         if (rdev->wiphy.wowlan->n_patterns) {
1312                 struct nl80211_pattern_support pat = {
1313                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1314                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1315                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1316                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1317                 };
1318
1319                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1320                             sizeof(pat), &pat))
1321                         return -ENOBUFS;
1322         }
1323
1324         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1325             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1326                         rdev->wiphy.wowlan->max_nd_match_sets))
1327                 return -ENOBUFS;
1328
1329         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1330                 return -ENOBUFS;
1331
1332         nla_nest_end(msg, nl_wowlan);
1333
1334         return 0;
1335 }
1336 #endif
1337
1338 static int nl80211_send_coalesce(struct sk_buff *msg,
1339                                  struct cfg80211_registered_device *rdev)
1340 {
1341         struct nl80211_coalesce_rule_support rule;
1342
1343         if (!rdev->wiphy.coalesce)
1344                 return 0;
1345
1346         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1347         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1348         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1349         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1350         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1351         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1352
1353         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1354                 return -ENOBUFS;
1355
1356         return 0;
1357 }
1358
1359 static int
1360 nl80211_send_iftype_data(struct sk_buff *msg,
1361                          const struct ieee80211_sband_iftype_data *iftdata)
1362 {
1363         const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1364
1365         if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1366                                 iftdata->types_mask))
1367                 return -ENOBUFS;
1368
1369         if (he_cap->has_he) {
1370                 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1371                             sizeof(he_cap->he_cap_elem.mac_cap_info),
1372                             he_cap->he_cap_elem.mac_cap_info) ||
1373                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1374                             sizeof(he_cap->he_cap_elem.phy_cap_info),
1375                             he_cap->he_cap_elem.phy_cap_info) ||
1376                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1377                             sizeof(he_cap->he_mcs_nss_supp),
1378                             &he_cap->he_mcs_nss_supp) ||
1379                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1380                             sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1381                         return -ENOBUFS;
1382         }
1383
1384         return 0;
1385 }
1386
1387 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1388                                       struct ieee80211_supported_band *sband)
1389 {
1390         struct nlattr *nl_rates, *nl_rate;
1391         struct ieee80211_rate *rate;
1392         int i;
1393
1394         /* add HT info */
1395         if (sband->ht_cap.ht_supported &&
1396             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1397                      sizeof(sband->ht_cap.mcs),
1398                      &sband->ht_cap.mcs) ||
1399              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1400                          sband->ht_cap.cap) ||
1401              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1402                         sband->ht_cap.ampdu_factor) ||
1403              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1404                         sband->ht_cap.ampdu_density)))
1405                 return -ENOBUFS;
1406
1407         /* add VHT info */
1408         if (sband->vht_cap.vht_supported &&
1409             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1410                      sizeof(sband->vht_cap.vht_mcs),
1411                      &sband->vht_cap.vht_mcs) ||
1412              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1413                          sband->vht_cap.cap)))
1414                 return -ENOBUFS;
1415
1416         if (sband->n_iftype_data) {
1417                 struct nlattr *nl_iftype_data =
1418                         nla_nest_start(msg, NL80211_BAND_ATTR_IFTYPE_DATA);
1419                 int err;
1420
1421                 if (!nl_iftype_data)
1422                         return -ENOBUFS;
1423
1424                 for (i = 0; i < sband->n_iftype_data; i++) {
1425                         struct nlattr *iftdata;
1426
1427                         iftdata = nla_nest_start(msg, i + 1);
1428                         if (!iftdata)
1429                                 return -ENOBUFS;
1430
1431                         err = nl80211_send_iftype_data(msg,
1432                                                        &sband->iftype_data[i]);
1433                         if (err)
1434                                 return err;
1435
1436                         nla_nest_end(msg, iftdata);
1437                 }
1438
1439                 nla_nest_end(msg, nl_iftype_data);
1440         }
1441
1442         /* add bitrates */
1443         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1444         if (!nl_rates)
1445                 return -ENOBUFS;
1446
1447         for (i = 0; i < sband->n_bitrates; i++) {
1448                 nl_rate = nla_nest_start(msg, i);
1449                 if (!nl_rate)
1450                         return -ENOBUFS;
1451
1452                 rate = &sband->bitrates[i];
1453                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1454                                 rate->bitrate))
1455                         return -ENOBUFS;
1456                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1457                     nla_put_flag(msg,
1458                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1459                         return -ENOBUFS;
1460
1461                 nla_nest_end(msg, nl_rate);
1462         }
1463
1464         nla_nest_end(msg, nl_rates);
1465
1466         return 0;
1467 }
1468
1469 static int
1470 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1471                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1472 {
1473         u16 stypes;
1474         struct nlattr *nl_ftypes, *nl_ifs;
1475         enum nl80211_iftype ift;
1476         int i;
1477
1478         if (!mgmt_stypes)
1479                 return 0;
1480
1481         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1482         if (!nl_ifs)
1483                 return -ENOBUFS;
1484
1485         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1486                 nl_ftypes = nla_nest_start(msg, ift);
1487                 if (!nl_ftypes)
1488                         return -ENOBUFS;
1489                 i = 0;
1490                 stypes = mgmt_stypes[ift].tx;
1491                 while (stypes) {
1492                         if ((stypes & 1) &&
1493                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1494                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1495                                 return -ENOBUFS;
1496                         stypes >>= 1;
1497                         i++;
1498                 }
1499                 nla_nest_end(msg, nl_ftypes);
1500         }
1501
1502         nla_nest_end(msg, nl_ifs);
1503
1504         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1505         if (!nl_ifs)
1506                 return -ENOBUFS;
1507
1508         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1509                 nl_ftypes = nla_nest_start(msg, ift);
1510                 if (!nl_ftypes)
1511                         return -ENOBUFS;
1512                 i = 0;
1513                 stypes = mgmt_stypes[ift].rx;
1514                 while (stypes) {
1515                         if ((stypes & 1) &&
1516                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1517                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1518                                 return -ENOBUFS;
1519                         stypes >>= 1;
1520                         i++;
1521                 }
1522                 nla_nest_end(msg, nl_ftypes);
1523         }
1524         nla_nest_end(msg, nl_ifs);
1525
1526         return 0;
1527 }
1528
1529 #define CMD(op, n)                                                      \
1530          do {                                                           \
1531                 if (rdev->ops->op) {                                    \
1532                         i++;                                            \
1533                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n))     \
1534                                 goto nla_put_failure;                   \
1535                 }                                                       \
1536         } while (0)
1537
1538 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
1539                                         struct sk_buff *msg)
1540 {
1541         int i = 0;
1542
1543         /*
1544          * do *NOT* add anything into this function, new things need to be
1545          * advertised only to new versions of userspace that can deal with
1546          * the split (and they can't possibly care about new features...
1547          */
1548         CMD(add_virtual_intf, NEW_INTERFACE);
1549         CMD(change_virtual_intf, SET_INTERFACE);
1550         CMD(add_key, NEW_KEY);
1551         CMD(start_ap, START_AP);
1552         CMD(add_station, NEW_STATION);
1553         CMD(add_mpath, NEW_MPATH);
1554         CMD(update_mesh_config, SET_MESH_CONFIG);
1555         CMD(change_bss, SET_BSS);
1556         CMD(auth, AUTHENTICATE);
1557         CMD(assoc, ASSOCIATE);
1558         CMD(deauth, DEAUTHENTICATE);
1559         CMD(disassoc, DISASSOCIATE);
1560         CMD(join_ibss, JOIN_IBSS);
1561         CMD(join_mesh, JOIN_MESH);
1562         CMD(set_pmksa, SET_PMKSA);
1563         CMD(del_pmksa, DEL_PMKSA);
1564         CMD(flush_pmksa, FLUSH_PMKSA);
1565         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1566                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1567         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1568         CMD(mgmt_tx, FRAME);
1569         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1570         if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1571                 i++;
1572                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1573                         goto nla_put_failure;
1574         }
1575         if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1576             rdev->ops->join_mesh) {
1577                 i++;
1578                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1579                         goto nla_put_failure;
1580         }
1581         CMD(set_wds_peer, SET_WDS_PEER);
1582         if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1583                 CMD(tdls_mgmt, TDLS_MGMT);
1584                 CMD(tdls_oper, TDLS_OPER);
1585         }
1586         if (rdev->wiphy.max_sched_scan_reqs)
1587                 CMD(sched_scan_start, START_SCHED_SCAN);
1588         CMD(probe_client, PROBE_CLIENT);
1589         CMD(set_noack_map, SET_NOACK_MAP);
1590         if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1591                 i++;
1592                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1593                         goto nla_put_failure;
1594         }
1595         CMD(start_p2p_device, START_P2P_DEVICE);
1596         CMD(set_mcast_rate, SET_MCAST_RATE);
1597 #ifdef CONFIG_NL80211_TESTMODE
1598         CMD(testmode_cmd, TESTMODE);
1599 #endif
1600
1601         if (rdev->ops->connect || rdev->ops->auth) {
1602                 i++;
1603                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1604                         goto nla_put_failure;
1605         }
1606
1607         if (rdev->ops->disconnect || rdev->ops->deauth) {
1608                 i++;
1609                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1610                         goto nla_put_failure;
1611         }
1612
1613         return i;
1614  nla_put_failure:
1615         return -ENOBUFS;
1616 }
1617
1618 struct nl80211_dump_wiphy_state {
1619         s64 filter_wiphy;
1620         long start;
1621         long split_start, band_start, chan_start, capa_start;
1622         bool split;
1623 };
1624
1625 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1626                               enum nl80211_commands cmd,
1627                               struct sk_buff *msg, u32 portid, u32 seq,
1628                               int flags, struct nl80211_dump_wiphy_state *state)
1629 {
1630         void *hdr;
1631         struct nlattr *nl_bands, *nl_band;
1632         struct nlattr *nl_freqs, *nl_freq;
1633         struct nlattr *nl_cmds;
1634         enum nl80211_band band;
1635         struct ieee80211_channel *chan;
1636         int i;
1637         const struct ieee80211_txrx_stypes *mgmt_stypes =
1638                                 rdev->wiphy.mgmt_stypes;
1639         u32 features;
1640
1641         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1642         if (!hdr)
1643                 return -ENOBUFS;
1644
1645         if (WARN_ON(!state))
1646                 return -EINVAL;
1647
1648         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1649             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1650                            wiphy_name(&rdev->wiphy)) ||
1651             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1652                         cfg80211_rdev_list_generation))
1653                 goto nla_put_failure;
1654
1655         if (cmd != NL80211_CMD_NEW_WIPHY)
1656                 goto finish;
1657
1658         switch (state->split_start) {
1659         case 0:
1660                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1661                                rdev->wiphy.retry_short) ||
1662                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1663                                rdev->wiphy.retry_long) ||
1664                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1665                                 rdev->wiphy.frag_threshold) ||
1666                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1667                                 rdev->wiphy.rts_threshold) ||
1668                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1669                                rdev->wiphy.coverage_class) ||
1670                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1671                                rdev->wiphy.max_scan_ssids) ||
1672                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1673                                rdev->wiphy.max_sched_scan_ssids) ||
1674                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1675                                 rdev->wiphy.max_scan_ie_len) ||
1676                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1677                                 rdev->wiphy.max_sched_scan_ie_len) ||
1678                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1679                                rdev->wiphy.max_match_sets) ||
1680                     nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1681                                 rdev->wiphy.max_sched_scan_plans) ||
1682                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1683                                 rdev->wiphy.max_sched_scan_plan_interval) ||
1684                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1685                                 rdev->wiphy.max_sched_scan_plan_iterations))
1686                         goto nla_put_failure;
1687
1688                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1689                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1690                         goto nla_put_failure;
1691                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1692                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1693                         goto nla_put_failure;
1694                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1695                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1696                         goto nla_put_failure;
1697                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1698                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1699                         goto nla_put_failure;
1700                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1701                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1702                         goto nla_put_failure;
1703                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1704                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1705                         goto nla_put_failure;
1706                 state->split_start++;
1707                 if (state->split)
1708                         break;
1709         case 1:
1710                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1711                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1712                             rdev->wiphy.cipher_suites))
1713                         goto nla_put_failure;
1714
1715                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1716                                rdev->wiphy.max_num_pmkids))
1717                         goto nla_put_failure;
1718
1719                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1720                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1721                         goto nla_put_failure;
1722
1723                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1724                                 rdev->wiphy.available_antennas_tx) ||
1725                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1726                                 rdev->wiphy.available_antennas_rx))
1727                         goto nla_put_failure;
1728
1729                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1730                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1731                                 rdev->wiphy.probe_resp_offload))
1732                         goto nla_put_failure;
1733
1734                 if ((rdev->wiphy.available_antennas_tx ||
1735                      rdev->wiphy.available_antennas_rx) &&
1736                     rdev->ops->get_antenna) {
1737                         u32 tx_ant = 0, rx_ant = 0;
1738                         int res;
1739
1740                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1741                         if (!res) {
1742                                 if (nla_put_u32(msg,
1743                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1744                                                 tx_ant) ||
1745                                     nla_put_u32(msg,
1746                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1747                                                 rx_ant))
1748                                         goto nla_put_failure;
1749                         }
1750                 }
1751
1752                 state->split_start++;
1753                 if (state->split)
1754                         break;
1755         case 2:
1756                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1757                                         rdev->wiphy.interface_modes))
1758                                 goto nla_put_failure;
1759                 state->split_start++;
1760                 if (state->split)
1761                         break;
1762         case 3:
1763                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1764                 if (!nl_bands)
1765                         goto nla_put_failure;
1766
1767                 for (band = state->band_start;
1768                      band < NUM_NL80211_BANDS; band++) {
1769                         struct ieee80211_supported_band *sband;
1770
1771                         sband = rdev->wiphy.bands[band];
1772
1773                         if (!sband)
1774                                 continue;
1775
1776                         nl_band = nla_nest_start(msg, band);
1777                         if (!nl_band)
1778                                 goto nla_put_failure;
1779
1780                         switch (state->chan_start) {
1781                         case 0:
1782                                 if (nl80211_send_band_rateinfo(msg, sband))
1783                                         goto nla_put_failure;
1784                                 state->chan_start++;
1785                                 if (state->split)
1786                                         break;
1787                         default:
1788                                 /* add frequencies */
1789                                 nl_freqs = nla_nest_start(
1790                                         msg, NL80211_BAND_ATTR_FREQS);
1791                                 if (!nl_freqs)
1792                                         goto nla_put_failure;
1793
1794                                 for (i = state->chan_start - 1;
1795                                      i < sband->n_channels;
1796                                      i++) {
1797                                         nl_freq = nla_nest_start(msg, i);
1798                                         if (!nl_freq)
1799                                                 goto nla_put_failure;
1800
1801                                         chan = &sband->channels[i];
1802
1803                                         if (nl80211_msg_put_channel(
1804                                                         msg, &rdev->wiphy, chan,
1805                                                         state->split))
1806                                                 goto nla_put_failure;
1807
1808                                         nla_nest_end(msg, nl_freq);
1809                                         if (state->split)
1810                                                 break;
1811                                 }
1812                                 if (i < sband->n_channels)
1813                                         state->chan_start = i + 2;
1814                                 else
1815                                         state->chan_start = 0;
1816                                 nla_nest_end(msg, nl_freqs);
1817                         }
1818
1819                         nla_nest_end(msg, nl_band);
1820
1821                         if (state->split) {
1822                                 /* start again here */
1823                                 if (state->chan_start)
1824                                         band--;
1825                                 break;
1826                         }
1827                 }
1828                 nla_nest_end(msg, nl_bands);
1829
1830                 if (band < NUM_NL80211_BANDS)
1831                         state->band_start = band + 1;
1832                 else
1833                         state->band_start = 0;
1834
1835                 /* if bands & channels are done, continue outside */
1836                 if (state->band_start == 0 && state->chan_start == 0)
1837                         state->split_start++;
1838                 if (state->split)
1839                         break;
1840         case 4:
1841                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1842                 if (!nl_cmds)
1843                         goto nla_put_failure;
1844
1845                 i = nl80211_add_commands_unsplit(rdev, msg);
1846                 if (i < 0)
1847                         goto nla_put_failure;
1848                 if (state->split) {
1849                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1850                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1851                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1852                                 CMD(channel_switch, CHANNEL_SWITCH);
1853                         CMD(set_qos_map, SET_QOS_MAP);
1854                         if (rdev->wiphy.features &
1855                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1856                                 CMD(add_tx_ts, ADD_TX_TS);
1857                         CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
1858                         CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
1859                 }
1860 #undef CMD
1861
1862                 nla_nest_end(msg, nl_cmds);
1863                 state->split_start++;
1864                 if (state->split)
1865                         break;
1866         case 5:
1867                 if (rdev->ops->remain_on_channel &&
1868                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1869                     nla_put_u32(msg,
1870                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1871                                 rdev->wiphy.max_remain_on_channel_duration))
1872                         goto nla_put_failure;
1873
1874                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1875                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1876                         goto nla_put_failure;
1877
1878                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1879                         goto nla_put_failure;
1880                 state->split_start++;
1881                 if (state->split)
1882                         break;
1883         case 6:
1884 #ifdef CONFIG_PM
1885                 if (nl80211_send_wowlan(msg, rdev, state->split))
1886                         goto nla_put_failure;
1887                 state->split_start++;
1888                 if (state->split)
1889                         break;
1890 #else
1891                 state->split_start++;
1892 #endif
1893         case 7:
1894                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1895                                         rdev->wiphy.software_iftypes))
1896                         goto nla_put_failure;
1897
1898                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1899                                                    state->split))
1900                         goto nla_put_failure;
1901
1902                 state->split_start++;
1903                 if (state->split)
1904                         break;
1905         case 8:
1906                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1907                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1908                                 rdev->wiphy.ap_sme_capa))
1909                         goto nla_put_failure;
1910
1911                 features = rdev->wiphy.features;
1912                 /*
1913                  * We can only add the per-channel limit information if the
1914                  * dump is split, otherwise it makes it too big. Therefore
1915                  * only advertise it in that case.
1916                  */
1917                 if (state->split)
1918                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1919                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1920                         goto nla_put_failure;
1921
1922                 if (rdev->wiphy.ht_capa_mod_mask &&
1923                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1924                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1925                             rdev->wiphy.ht_capa_mod_mask))
1926                         goto nla_put_failure;
1927
1928                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1929                     rdev->wiphy.max_acl_mac_addrs &&
1930                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1931                                 rdev->wiphy.max_acl_mac_addrs))
1932                         goto nla_put_failure;
1933
1934                 /*
1935                  * Any information below this point is only available to
1936                  * applications that can deal with it being split. This
1937                  * helps ensure that newly added capabilities don't break
1938                  * older tools by overrunning their buffers.
1939                  *
1940                  * We still increment split_start so that in the split
1941                  * case we'll continue with more data in the next round,
1942                  * but break unconditionally so unsplit data stops here.
1943                  */
1944                 state->split_start++;
1945                 break;
1946         case 9:
1947                 if (rdev->wiphy.extended_capabilities &&
1948                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1949                              rdev->wiphy.extended_capabilities_len,
1950                              rdev->wiphy.extended_capabilities) ||
1951                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1952                              rdev->wiphy.extended_capabilities_len,
1953                              rdev->wiphy.extended_capabilities_mask)))
1954                         goto nla_put_failure;
1955
1956                 if (rdev->wiphy.vht_capa_mod_mask &&
1957                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1958                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1959                             rdev->wiphy.vht_capa_mod_mask))
1960                         goto nla_put_failure;
1961
1962                 state->split_start++;
1963                 break;
1964         case 10:
1965                 if (nl80211_send_coalesce(msg, rdev))
1966                         goto nla_put_failure;
1967
1968                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1969                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1970                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1971                         goto nla_put_failure;
1972
1973                 if (rdev->wiphy.max_ap_assoc_sta &&
1974                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1975                                 rdev->wiphy.max_ap_assoc_sta))
1976                         goto nla_put_failure;
1977
1978                 state->split_start++;
1979                 break;
1980         case 11:
1981                 if (rdev->wiphy.n_vendor_commands) {
1982                         const struct nl80211_vendor_cmd_info *info;
1983                         struct nlattr *nested;
1984
1985                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1986                         if (!nested)
1987                                 goto nla_put_failure;
1988
1989                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1990                                 info = &rdev->wiphy.vendor_commands[i].info;
1991                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1992                                         goto nla_put_failure;
1993                         }
1994                         nla_nest_end(msg, nested);
1995                 }
1996
1997                 if (rdev->wiphy.n_vendor_events) {
1998                         const struct nl80211_vendor_cmd_info *info;
1999                         struct nlattr *nested;
2000
2001                         nested = nla_nest_start(msg,
2002                                                 NL80211_ATTR_VENDOR_EVENTS);
2003                         if (!nested)
2004                                 goto nla_put_failure;
2005
2006                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
2007                                 info = &rdev->wiphy.vendor_events[i];
2008                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2009                                         goto nla_put_failure;
2010                         }
2011                         nla_nest_end(msg, nested);
2012                 }
2013                 state->split_start++;
2014                 break;
2015         case 12:
2016                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
2017                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
2018                                rdev->wiphy.max_num_csa_counters))
2019                         goto nla_put_failure;
2020
2021                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2022                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
2023                         goto nla_put_failure;
2024
2025                 if (rdev->wiphy.max_sched_scan_reqs &&
2026                     nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
2027                                 rdev->wiphy.max_sched_scan_reqs))
2028                         goto nla_put_failure;
2029
2030                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2031                             sizeof(rdev->wiphy.ext_features),
2032                             rdev->wiphy.ext_features))
2033                         goto nla_put_failure;
2034
2035                 if (rdev->wiphy.bss_select_support) {
2036                         struct nlattr *nested;
2037                         u32 bss_select_support = rdev->wiphy.bss_select_support;
2038
2039                         nested = nla_nest_start(msg, NL80211_ATTR_BSS_SELECT);
2040                         if (!nested)
2041                                 goto nla_put_failure;
2042
2043                         i = 0;
2044                         while (bss_select_support) {
2045                                 if ((bss_select_support & 1) &&
2046                                     nla_put_flag(msg, i))
2047                                         goto nla_put_failure;
2048                                 i++;
2049                                 bss_select_support >>= 1;
2050                         }
2051                         nla_nest_end(msg, nested);
2052                 }
2053
2054                 state->split_start++;
2055                 break;
2056         case 13:
2057                 if (rdev->wiphy.num_iftype_ext_capab &&
2058                     rdev->wiphy.iftype_ext_capab) {
2059                         struct nlattr *nested_ext_capab, *nested;
2060
2061                         nested = nla_nest_start(msg,
2062                                                 NL80211_ATTR_IFTYPE_EXT_CAPA);
2063                         if (!nested)
2064                                 goto nla_put_failure;
2065
2066                         for (i = state->capa_start;
2067                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
2068                                 const struct wiphy_iftype_ext_capab *capab;
2069
2070                                 capab = &rdev->wiphy.iftype_ext_capab[i];
2071
2072                                 nested_ext_capab = nla_nest_start(msg, i);
2073                                 if (!nested_ext_capab ||
2074                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
2075                                                 capab->iftype) ||
2076                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
2077                                             capab->extended_capabilities_len,
2078                                             capab->extended_capabilities) ||
2079                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2080                                             capab->extended_capabilities_len,
2081                                             capab->extended_capabilities_mask))
2082                                         goto nla_put_failure;
2083
2084                                 nla_nest_end(msg, nested_ext_capab);
2085                                 if (state->split)
2086                                         break;
2087                         }
2088                         nla_nest_end(msg, nested);
2089                         if (i < rdev->wiphy.num_iftype_ext_capab) {
2090                                 state->capa_start = i + 1;
2091                                 break;
2092                         }
2093                 }
2094
2095                 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
2096                                 rdev->wiphy.nan_supported_bands))
2097                         goto nla_put_failure;
2098
2099                 if (wiphy_ext_feature_isset(&rdev->wiphy,
2100                                             NL80211_EXT_FEATURE_TXQS)) {
2101                         struct cfg80211_txq_stats txqstats = {};
2102                         int res;
2103
2104                         res = rdev_get_txq_stats(rdev, NULL, &txqstats);
2105                         if (!res &&
2106                             !nl80211_put_txq_stats(msg, &txqstats,
2107                                                    NL80211_ATTR_TXQ_STATS))
2108                                 goto nla_put_failure;
2109
2110                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
2111                                         rdev->wiphy.txq_limit))
2112                                 goto nla_put_failure;
2113                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
2114                                         rdev->wiphy.txq_memory_limit))
2115                                 goto nla_put_failure;
2116                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
2117                                         rdev->wiphy.txq_quantum))
2118                                 goto nla_put_failure;
2119                 }
2120
2121                 /* done */
2122                 state->split_start = 0;
2123                 break;
2124         }
2125  finish:
2126         genlmsg_end(msg, hdr);
2127         return 0;
2128
2129  nla_put_failure:
2130         genlmsg_cancel(msg, hdr);
2131         return -EMSGSIZE;
2132 }
2133
2134 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
2135                                     struct netlink_callback *cb,
2136                                     struct nl80211_dump_wiphy_state *state)
2137 {
2138         struct nlattr **tb = genl_family_attrbuf(&nl80211_fam);
2139         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, tb,
2140                               nl80211_fam.maxattr, nl80211_policy, NULL);
2141         /* ignore parse errors for backward compatibility */
2142         if (ret)
2143                 return 0;
2144
2145         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
2146         if (tb[NL80211_ATTR_WIPHY])
2147                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
2148         if (tb[NL80211_ATTR_WDEV])
2149                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
2150         if (tb[NL80211_ATTR_IFINDEX]) {
2151                 struct net_device *netdev;
2152                 struct cfg80211_registered_device *rdev;
2153                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2154
2155                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2156                 if (!netdev)
2157                         return -ENODEV;
2158                 if (netdev->ieee80211_ptr) {
2159                         rdev = wiphy_to_rdev(
2160                                 netdev->ieee80211_ptr->wiphy);
2161                         state->filter_wiphy = rdev->wiphy_idx;
2162                 }
2163         }
2164
2165         return 0;
2166 }
2167
2168 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
2169 {
2170         int idx = 0, ret;
2171         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
2172         struct cfg80211_registered_device *rdev;
2173
2174         rtnl_lock();
2175         if (!state) {
2176                 state = kzalloc(sizeof(*state), GFP_KERNEL);
2177                 if (!state) {
2178                         rtnl_unlock();
2179                         return -ENOMEM;
2180                 }
2181                 state->filter_wiphy = -1;
2182                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
2183                 if (ret) {
2184                         kfree(state);
2185                         rtnl_unlock();
2186                         return ret;
2187                 }
2188                 cb->args[0] = (long)state;
2189         }
2190
2191         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2192                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2193                         continue;
2194                 if (++idx <= state->start)
2195                         continue;
2196                 if (state->filter_wiphy != -1 &&
2197                     state->filter_wiphy != rdev->wiphy_idx)
2198                         continue;
2199                 /* attempt to fit multiple wiphy data chunks into the skb */
2200                 do {
2201                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
2202                                                  skb,
2203                                                  NETLINK_CB(cb->skb).portid,
2204                                                  cb->nlh->nlmsg_seq,
2205                                                  NLM_F_MULTI, state);
2206                         if (ret < 0) {
2207                                 /*
2208                                  * If sending the wiphy data didn't fit (ENOBUFS
2209                                  * or EMSGSIZE returned), this SKB is still
2210                                  * empty (so it's not too big because another
2211                                  * wiphy dataset is already in the skb) and
2212                                  * we've not tried to adjust the dump allocation
2213                                  * yet ... then adjust the alloc size to be
2214                                  * bigger, and return 1 but with the empty skb.
2215                                  * This results in an empty message being RX'ed
2216                                  * in userspace, but that is ignored.
2217                                  *
2218                                  * We can then retry with the larger buffer.
2219                                  */
2220                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
2221                                     !skb->len && !state->split &&
2222                                     cb->min_dump_alloc < 4096) {
2223                                         cb->min_dump_alloc = 4096;
2224                                         state->split_start = 0;
2225                                         rtnl_unlock();
2226                                         return 1;
2227                                 }
2228                                 idx--;
2229                                 break;
2230                         }
2231                 } while (state->split_start > 0);
2232                 break;
2233         }
2234         rtnl_unlock();
2235
2236         state->start = idx;
2237
2238         return skb->len;
2239 }
2240
2241 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
2242 {
2243         kfree((void *)cb->args[0]);
2244         return 0;
2245 }
2246
2247 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
2248 {
2249         struct sk_buff *msg;
2250         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2251         struct nl80211_dump_wiphy_state state = {};
2252
2253         msg = nlmsg_new(4096, GFP_KERNEL);
2254         if (!msg)
2255                 return -ENOMEM;
2256
2257         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
2258                                info->snd_portid, info->snd_seq, 0,
2259                                &state) < 0) {
2260                 nlmsg_free(msg);
2261                 return -ENOBUFS;
2262         }
2263
2264         return genlmsg_reply(msg, info);
2265 }
2266
2267 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2268         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
2269         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
2270         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
2271         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
2272         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
2273 };
2274
2275 static int parse_txq_params(struct nlattr *tb[],
2276                             struct ieee80211_txq_params *txq_params)
2277 {
2278         u8 ac;
2279
2280         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2281             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2282             !tb[NL80211_TXQ_ATTR_AIFS])
2283                 return -EINVAL;
2284
2285         ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2286         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2287         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2288         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2289         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2290
2291         if (ac >= NL80211_NUM_ACS)
2292                 return -EINVAL;
2293         txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
2294         return 0;
2295 }
2296
2297 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2298 {
2299         /*
2300          * You can only set the channel explicitly for WDS interfaces,
2301          * all others have their channel managed via their respective
2302          * "establish a connection" command (connect, join, ...)
2303          *
2304          * For AP/GO and mesh mode, the channel can be set with the
2305          * channel userspace API, but is only stored and passed to the
2306          * low-level driver when the AP starts or the mesh is joined.
2307          * This is for backward compatibility, userspace can also give
2308          * the channel in the start-ap or join-mesh commands instead.
2309          *
2310          * Monitors are special as they are normally slaved to
2311          * whatever else is going on, so they have their own special
2312          * operation to set the monitor channel if possible.
2313          */
2314         return !wdev ||
2315                 wdev->iftype == NL80211_IFTYPE_AP ||
2316                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2317                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
2318                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
2319 }
2320
2321 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2322                                  struct genl_info *info,
2323                                  struct cfg80211_chan_def *chandef)
2324 {
2325         struct netlink_ext_ack *extack = info->extack;
2326         struct nlattr **attrs = info->attrs;
2327         u32 control_freq;
2328
2329         if (!attrs[NL80211_ATTR_WIPHY_FREQ])
2330                 return -EINVAL;
2331
2332         control_freq = nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ]);
2333
2334         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
2335         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2336         chandef->center_freq1 = control_freq;
2337         chandef->center_freq2 = 0;
2338
2339         /* Primary channel not allowed */
2340         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) {
2341                 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
2342                                     "Channel is disabled");
2343                 return -EINVAL;
2344         }
2345
2346         if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2347                 enum nl80211_channel_type chantype;
2348
2349                 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2350
2351                 switch (chantype) {
2352                 case NL80211_CHAN_NO_HT:
2353                 case NL80211_CHAN_HT20:
2354                 case NL80211_CHAN_HT40PLUS:
2355                 case NL80211_CHAN_HT40MINUS:
2356                         cfg80211_chandef_create(chandef, chandef->chan,
2357                                                 chantype);
2358                         /* user input for center_freq is incorrect */
2359                         if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
2360                             chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
2361                                 NL_SET_ERR_MSG_ATTR(extack,
2362                                                     attrs[NL80211_ATTR_CENTER_FREQ1],
2363                                                     "bad center frequency 1");
2364                                 return -EINVAL;
2365                         }
2366                         /* center_freq2 must be zero */
2367                         if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
2368                             nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
2369                                 NL_SET_ERR_MSG_ATTR(extack,
2370                                                     attrs[NL80211_ATTR_CENTER_FREQ2],
2371                                                     "center frequency 2 can't be used");
2372                                 return -EINVAL;
2373                         }
2374                         break;
2375                 default:
2376                         NL_SET_ERR_MSG_ATTR(extack,
2377                                             attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
2378                                             "invalid channel type");
2379                         return -EINVAL;
2380                 }
2381         } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2382                 chandef->width =
2383                         nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2384                 if (attrs[NL80211_ATTR_CENTER_FREQ1])
2385                         chandef->center_freq1 =
2386                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
2387                 if (attrs[NL80211_ATTR_CENTER_FREQ2])
2388                         chandef->center_freq2 =
2389                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
2390         }
2391
2392         if (!cfg80211_chandef_valid(chandef)) {
2393                 NL_SET_ERR_MSG(extack, "invalid channel definition");
2394                 return -EINVAL;
2395         }
2396
2397         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2398                                      IEEE80211_CHAN_DISABLED)) {
2399                 NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
2400                 return -EINVAL;
2401         }
2402
2403         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2404              chandef->width == NL80211_CHAN_WIDTH_10) &&
2405             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
2406                 NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
2407                 return -EINVAL;
2408         }
2409
2410         return 0;
2411 }
2412
2413 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
2414                                  struct net_device *dev,
2415                                  struct genl_info *info)
2416 {
2417         struct cfg80211_chan_def chandef;
2418         int result;
2419         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2420         struct wireless_dev *wdev = NULL;
2421
2422         if (dev)
2423                 wdev = dev->ieee80211_ptr;
2424         if (!nl80211_can_set_dev_channel(wdev))
2425                 return -EOPNOTSUPP;
2426         if (wdev)
2427                 iftype = wdev->iftype;
2428
2429         result = nl80211_parse_chandef(rdev, info, &chandef);
2430         if (result)
2431                 return result;
2432
2433         switch (iftype) {
2434         case NL80211_IFTYPE_AP:
2435         case NL80211_IFTYPE_P2P_GO:
2436                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2437                                                    iftype)) {
2438                         result = -EINVAL;
2439                         break;
2440                 }
2441                 if (wdev->beacon_interval) {
2442                         if (!dev || !rdev->ops->set_ap_chanwidth ||
2443                             !(rdev->wiphy.features &
2444                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2445                                 result = -EBUSY;
2446                                 break;
2447                         }
2448
2449                         /* Only allow dynamic channel width changes */
2450                         if (chandef.chan != wdev->preset_chandef.chan) {
2451                                 result = -EBUSY;
2452                                 break;
2453                         }
2454                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2455                         if (result)
2456                                 break;
2457                 }
2458                 wdev->preset_chandef = chandef;
2459                 result = 0;
2460                 break;
2461         case NL80211_IFTYPE_MESH_POINT:
2462                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2463                 break;
2464         case NL80211_IFTYPE_MONITOR:
2465                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2466                 break;
2467         default:
2468                 result = -EINVAL;
2469         }
2470
2471         return result;
2472 }
2473
2474 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2475 {
2476         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2477         struct net_device *netdev = info->user_ptr[1];
2478
2479         return __nl80211_set_channel(rdev, netdev, info);
2480 }
2481
2482 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2483 {
2484         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2485         struct net_device *dev = info->user_ptr[1];
2486         struct wireless_dev *wdev = dev->ieee80211_ptr;
2487         const u8 *bssid;
2488
2489         if (!info->attrs[NL80211_ATTR_MAC])
2490                 return -EINVAL;
2491
2492         if (netif_running(dev))
2493                 return -EBUSY;
2494
2495         if (!rdev->ops->set_wds_peer)
2496                 return -EOPNOTSUPP;
2497
2498         if (wdev->iftype != NL80211_IFTYPE_WDS)
2499                 return -EOPNOTSUPP;
2500
2501         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2502         return rdev_set_wds_peer(rdev, dev, bssid);
2503 }
2504
2505 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2506 {
2507         struct cfg80211_registered_device *rdev;
2508         struct net_device *netdev = NULL;
2509         struct wireless_dev *wdev;
2510         int result = 0, rem_txq_params = 0;
2511         struct nlattr *nl_txq_params;
2512         u32 changed;
2513         u8 retry_short = 0, retry_long = 0;
2514         u32 frag_threshold = 0, rts_threshold = 0;
2515         u8 coverage_class = 0;
2516         u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
2517
2518         ASSERT_RTNL();
2519
2520         /*
2521          * Try to find the wiphy and netdev. Normally this
2522          * function shouldn't need the netdev, but this is
2523          * done for backward compatibility -- previously
2524          * setting the channel was done per wiphy, but now
2525          * it is per netdev. Previous userland like hostapd
2526          * also passed a netdev to set_wiphy, so that it is
2527          * possible to let that go to the right netdev!
2528          */
2529
2530         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2531                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2532
2533                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2534                 if (netdev && netdev->ieee80211_ptr)
2535                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2536                 else
2537                         netdev = NULL;
2538         }
2539
2540         if (!netdev) {
2541                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2542                                                   info->attrs);
2543                 if (IS_ERR(rdev))
2544                         return PTR_ERR(rdev);
2545                 wdev = NULL;
2546                 netdev = NULL;
2547                 result = 0;
2548         } else
2549                 wdev = netdev->ieee80211_ptr;
2550
2551         /*
2552          * end workaround code, by now the rdev is available
2553          * and locked, and wdev may or may not be NULL.
2554          */
2555
2556         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2557                 result = cfg80211_dev_rename(
2558                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2559
2560         if (result)
2561                 return result;
2562
2563         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2564                 struct ieee80211_txq_params txq_params;
2565                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2566
2567                 if (!rdev->ops->set_txq_params)
2568                         return -EOPNOTSUPP;
2569
2570                 if (!netdev)
2571                         return -EINVAL;
2572
2573                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2574                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2575                         return -EINVAL;
2576
2577                 if (!netif_running(netdev))
2578                         return -ENETDOWN;
2579
2580                 nla_for_each_nested(nl_txq_params,
2581                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2582                                     rem_txq_params) {
2583                         result = nla_parse_nested(tb, NL80211_TXQ_ATTR_MAX,
2584                                                   nl_txq_params,
2585                                                   txq_params_policy,
2586                                                   info->extack);
2587                         if (result)
2588                                 return result;
2589                         result = parse_txq_params(tb, &txq_params);
2590                         if (result)
2591                                 return result;
2592
2593                         result = rdev_set_txq_params(rdev, netdev,
2594                                                      &txq_params);
2595                         if (result)
2596                                 return result;
2597                 }
2598         }
2599
2600         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2601                 result = __nl80211_set_channel(
2602                         rdev,
2603                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2604                         info);
2605                 if (result)
2606                         return result;
2607         }
2608
2609         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2610                 struct wireless_dev *txp_wdev = wdev;
2611                 enum nl80211_tx_power_setting type;
2612                 int idx, mbm = 0;
2613
2614                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2615                         txp_wdev = NULL;
2616
2617                 if (!rdev->ops->set_tx_power)
2618                         return -EOPNOTSUPP;
2619
2620                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2621                 type = nla_get_u32(info->attrs[idx]);
2622
2623                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2624                     (type != NL80211_TX_POWER_AUTOMATIC))
2625                         return -EINVAL;
2626
2627                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2628                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2629                         mbm = nla_get_u32(info->attrs[idx]);
2630                 }
2631
2632                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2633                 if (result)
2634                         return result;
2635         }
2636
2637         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2638             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2639                 u32 tx_ant, rx_ant;
2640
2641                 if ((!rdev->wiphy.available_antennas_tx &&
2642                      !rdev->wiphy.available_antennas_rx) ||
2643                     !rdev->ops->set_antenna)
2644                         return -EOPNOTSUPP;
2645
2646                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2647                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2648
2649                 /* reject antenna configurations which don't match the
2650                  * available antenna masks, except for the "all" mask */
2651                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2652                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2653                         return -EINVAL;
2654
2655                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2656                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2657
2658                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2659                 if (result)
2660                         return result;
2661         }
2662
2663         changed = 0;
2664
2665         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2666                 retry_short = nla_get_u8(
2667                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2668
2669                 changed |= WIPHY_PARAM_RETRY_SHORT;
2670         }
2671
2672         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2673                 retry_long = nla_get_u8(
2674                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2675
2676                 changed |= WIPHY_PARAM_RETRY_LONG;
2677         }
2678
2679         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2680                 frag_threshold = nla_get_u32(
2681                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2682                 if (frag_threshold < 256)
2683                         return -EINVAL;
2684
2685                 if (frag_threshold != (u32) -1) {
2686                         /*
2687                          * Fragments (apart from the last one) are required to
2688                          * have even length. Make the fragmentation code
2689                          * simpler by stripping LSB should someone try to use
2690                          * odd threshold value.
2691                          */
2692                         frag_threshold &= ~0x1;
2693                 }
2694                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2695         }
2696
2697         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2698                 rts_threshold = nla_get_u32(
2699                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2700                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2701         }
2702
2703         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2704                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2705                         return -EINVAL;
2706
2707                 coverage_class = nla_get_u8(
2708                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2709                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2710         }
2711
2712         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2713                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2714                         return -EOPNOTSUPP;
2715
2716                 changed |= WIPHY_PARAM_DYN_ACK;
2717         }
2718
2719         if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
2720                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2721                                              NL80211_EXT_FEATURE_TXQS))
2722                         return -EOPNOTSUPP;
2723                 txq_limit = nla_get_u32(
2724                         info->attrs[NL80211_ATTR_TXQ_LIMIT]);
2725                 changed |= WIPHY_PARAM_TXQ_LIMIT;
2726         }
2727
2728         if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
2729                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2730                                              NL80211_EXT_FEATURE_TXQS))
2731                         return -EOPNOTSUPP;
2732                 txq_memory_limit = nla_get_u32(
2733                         info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
2734                 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
2735         }
2736
2737         if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
2738                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2739                                              NL80211_EXT_FEATURE_TXQS))
2740                         return -EOPNOTSUPP;
2741                 txq_quantum = nla_get_u32(
2742                         info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
2743                 changed |= WIPHY_PARAM_TXQ_QUANTUM;
2744         }
2745
2746         if (changed) {
2747                 u8 old_retry_short, old_retry_long;
2748                 u32 old_frag_threshold, old_rts_threshold;
2749                 u8 old_coverage_class;
2750                 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
2751
2752                 if (!rdev->ops->set_wiphy_params)
2753                         return -EOPNOTSUPP;
2754
2755                 old_retry_short = rdev->wiphy.retry_short;
2756                 old_retry_long = rdev->wiphy.retry_long;
2757                 old_frag_threshold = rdev->wiphy.frag_threshold;
2758                 old_rts_threshold = rdev->wiphy.rts_threshold;
2759                 old_coverage_class = rdev->wiphy.coverage_class;
2760                 old_txq_limit = rdev->wiphy.txq_limit;
2761                 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
2762                 old_txq_quantum = rdev->wiphy.txq_quantum;
2763
2764                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2765                         rdev->wiphy.retry_short = retry_short;
2766                 if (changed & WIPHY_PARAM_RETRY_LONG)
2767                         rdev->wiphy.retry_long = retry_long;
2768                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2769                         rdev->wiphy.frag_threshold = frag_threshold;
2770                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2771                         rdev->wiphy.rts_threshold = rts_threshold;
2772                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2773                         rdev->wiphy.coverage_class = coverage_class;
2774                 if (changed & WIPHY_PARAM_TXQ_LIMIT)
2775                         rdev->wiphy.txq_limit = txq_limit;
2776                 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
2777                         rdev->wiphy.txq_memory_limit = txq_memory_limit;
2778                 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
2779                         rdev->wiphy.txq_quantum = txq_quantum;
2780
2781                 result = rdev_set_wiphy_params(rdev, changed);
2782                 if (result) {
2783                         rdev->wiphy.retry_short = old_retry_short;
2784                         rdev->wiphy.retry_long = old_retry_long;
2785                         rdev->wiphy.frag_threshold = old_frag_threshold;
2786                         rdev->wiphy.rts_threshold = old_rts_threshold;
2787                         rdev->wiphy.coverage_class = old_coverage_class;
2788                         rdev->wiphy.txq_limit = old_txq_limit;
2789                         rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
2790                         rdev->wiphy.txq_quantum = old_txq_quantum;
2791                         return result;
2792                 }
2793         }
2794         return 0;
2795 }
2796
2797 static inline u64 wdev_id(struct wireless_dev *wdev)
2798 {
2799         return (u64)wdev->identifier |
2800                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2801 }
2802
2803 static int nl80211_send_chandef(struct sk_buff *msg,
2804                                 const struct cfg80211_chan_def *chandef)
2805 {
2806         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2807                 return -EINVAL;
2808
2809         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2810                         chandef->chan->center_freq))
2811                 return -ENOBUFS;
2812         switch (chandef->width) {
2813         case NL80211_CHAN_WIDTH_20_NOHT:
2814         case NL80211_CHAN_WIDTH_20:
2815         case NL80211_CHAN_WIDTH_40:
2816                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2817                                 cfg80211_get_chandef_type(chandef)))
2818                         return -ENOBUFS;
2819                 break;
2820         default:
2821                 break;
2822         }
2823         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2824                 return -ENOBUFS;
2825         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2826                 return -ENOBUFS;
2827         if (chandef->center_freq2 &&
2828             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2829                 return -ENOBUFS;
2830         return 0;
2831 }
2832
2833 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2834                               struct cfg80211_registered_device *rdev,
2835                               struct wireless_dev *wdev, bool removal)
2836 {
2837         struct net_device *dev = wdev->netdev;
2838         u8 cmd = NL80211_CMD_NEW_INTERFACE;
2839         void *hdr;
2840
2841         if (removal)
2842                 cmd = NL80211_CMD_DEL_INTERFACE;
2843
2844         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2845         if (!hdr)
2846                 return -1;
2847
2848         if (dev &&
2849             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2850              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2851                 goto nla_put_failure;
2852
2853         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2854             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2855             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
2856                               NL80211_ATTR_PAD) ||
2857             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2858             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2859                         rdev->devlist_generation ^
2860                         (cfg80211_rdev_list_generation << 2)) ||
2861             nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr))
2862                 goto nla_put_failure;
2863
2864         if (rdev->ops->get_channel) {
2865                 int ret;
2866                 struct cfg80211_chan_def chandef;
2867
2868                 ret = rdev_get_channel(rdev, wdev, &chandef);
2869                 if (ret == 0) {
2870                         if (nl80211_send_chandef(msg, &chandef))
2871                                 goto nla_put_failure;
2872                 }
2873         }
2874
2875         if (rdev->ops->get_tx_power) {
2876                 int dbm, ret;
2877
2878                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
2879                 if (ret == 0 &&
2880                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
2881                                 DBM_TO_MBM(dbm)))
2882                         goto nla_put_failure;
2883         }
2884
2885         wdev_lock(wdev);
2886         switch (wdev->iftype) {
2887         case NL80211_IFTYPE_AP:
2888                 if (wdev->ssid_len &&
2889                     nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2890                         goto nla_put_failure_locked;
2891                 break;
2892         case NL80211_IFTYPE_STATION:
2893         case NL80211_IFTYPE_P2P_CLIENT:
2894         case NL80211_IFTYPE_ADHOC: {
2895                 const u8 *ssid_ie;
2896                 if (!wdev->current_bss)
2897                         break;
2898                 rcu_read_lock();
2899                 ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
2900                                                WLAN_EID_SSID);
2901                 if (ssid_ie &&
2902                     nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2))
2903                         goto nla_put_failure_rcu_locked;
2904                 rcu_read_unlock();
2905                 break;
2906                 }
2907         default:
2908                 /* nothing */
2909                 break;
2910         }
2911         wdev_unlock(wdev);
2912
2913         if (rdev->ops->get_txq_stats) {
2914                 struct cfg80211_txq_stats txqstats = {};
2915                 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
2916
2917                 if (ret == 0 &&
2918                     !nl80211_put_txq_stats(msg, &txqstats,
2919                                            NL80211_ATTR_TXQ_STATS))
2920                         goto nla_put_failure;
2921         }
2922
2923         genlmsg_end(msg, hdr);
2924         return 0;
2925
2926  nla_put_failure_rcu_locked:
2927         rcu_read_unlock();
2928  nla_put_failure_locked:
2929         wdev_unlock(wdev);
2930  nla_put_failure:
2931         genlmsg_cancel(msg, hdr);
2932         return -EMSGSIZE;
2933 }
2934
2935 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2936 {
2937         int wp_idx = 0;
2938         int if_idx = 0;
2939         int wp_start = cb->args[0];
2940         int if_start = cb->args[1];
2941         int filter_wiphy = -1;
2942         struct cfg80211_registered_device *rdev;
2943         struct wireless_dev *wdev;
2944         int ret;
2945
2946         rtnl_lock();
2947         if (!cb->args[2]) {
2948                 struct nl80211_dump_wiphy_state state = {
2949                         .filter_wiphy = -1,
2950                 };
2951
2952                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
2953                 if (ret)
2954                         goto out_unlock;
2955
2956                 filter_wiphy = state.filter_wiphy;
2957
2958                 /*
2959                  * if filtering, set cb->args[2] to +1 since 0 is the default
2960                  * value needed to determine that parsing is necessary.
2961                  */
2962                 if (filter_wiphy >= 0)
2963                         cb->args[2] = filter_wiphy + 1;
2964                 else
2965                         cb->args[2] = -1;
2966         } else if (cb->args[2] > 0) {
2967                 filter_wiphy = cb->args[2] - 1;
2968         }
2969
2970         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2971                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2972                         continue;
2973                 if (wp_idx < wp_start) {
2974                         wp_idx++;
2975                         continue;
2976                 }
2977
2978                 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
2979                         continue;
2980
2981                 if_idx = 0;
2982
2983                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
2984                         if (if_idx < if_start) {
2985                                 if_idx++;
2986                                 continue;
2987                         }
2988                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2989                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2990                                                rdev, wdev, false) < 0) {
2991                                 goto out;
2992                         }
2993                         if_idx++;
2994                 }
2995
2996                 wp_idx++;
2997         }
2998  out:
2999         cb->args[0] = wp_idx;
3000         cb->args[1] = if_idx;
3001
3002         ret = skb->len;
3003  out_unlock:
3004         rtnl_unlock();
3005
3006         return ret;
3007 }
3008
3009 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
3010 {
3011         struct sk_buff *msg;
3012         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3013         struct wireless_dev *wdev = info->user_ptr[1];
3014
3015         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3016         if (!msg)
3017                 return -ENOMEM;
3018
3019         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3020                                rdev, wdev, false) < 0) {
3021                 nlmsg_free(msg);
3022                 return -ENOBUFS;
3023         }
3024
3025         return genlmsg_reply(msg, info);
3026 }
3027
3028 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
3029         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
3030         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
3031         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
3032         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
3033         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
3034         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
3035 };
3036
3037 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
3038 {
3039         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
3040         int flag;
3041
3042         *mntrflags = 0;
3043
3044         if (!nla)
3045                 return -EINVAL;
3046
3047         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX, nla,
3048                              mntr_flags_policy, NULL))
3049                 return -EINVAL;
3050
3051         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
3052                 if (flags[flag])
3053                         *mntrflags |= (1<<flag);
3054
3055         *mntrflags |= MONITOR_FLAG_CHANGED;
3056
3057         return 0;
3058 }
3059
3060 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
3061                                      enum nl80211_iftype type,
3062                                      struct genl_info *info,
3063                                      struct vif_params *params)
3064 {
3065         bool change = false;
3066         int err;
3067
3068         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
3069                 if (type != NL80211_IFTYPE_MONITOR)
3070                         return -EINVAL;
3071
3072                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
3073                                           &params->flags);
3074                 if (err)
3075                         return err;
3076
3077                 change = true;
3078         }
3079
3080         if (params->flags & MONITOR_FLAG_ACTIVE &&
3081             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
3082                 return -EOPNOTSUPP;
3083
3084         if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
3085                 const u8 *mumimo_groups;
3086                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3087
3088                 if (type != NL80211_IFTYPE_MONITOR)
3089                         return -EINVAL;
3090
3091                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3092                         return -EOPNOTSUPP;
3093
3094                 mumimo_groups =
3095                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
3096
3097                 /* bits 0 and 63 are reserved and must be zero */
3098                 if ((mumimo_groups[0] & BIT(0)) ||
3099                     (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
3100                         return -EINVAL;
3101
3102                 params->vht_mumimo_groups = mumimo_groups;
3103                 change = true;
3104         }
3105
3106         if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
3107                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3108
3109                 if (type != NL80211_IFTYPE_MONITOR)
3110                         return -EINVAL;
3111
3112                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3113                         return -EOPNOTSUPP;
3114
3115                 params->vht_mumimo_follow_addr =
3116                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
3117                 change = true;
3118         }
3119
3120         return change ? 1 : 0;
3121 }
3122
3123 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
3124                                struct net_device *netdev, u8 use_4addr,
3125                                enum nl80211_iftype iftype)
3126 {
3127         if (!use_4addr) {
3128                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
3129                         return -EBUSY;
3130                 return 0;
3131         }
3132
3133         switch (iftype) {
3134         case NL80211_IFTYPE_AP_VLAN:
3135                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
3136                         return 0;
3137                 break;
3138         case NL80211_IFTYPE_STATION:
3139                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
3140                         return 0;
3141                 break;
3142         default:
3143                 break;
3144         }
3145
3146         return -EOPNOTSUPP;
3147 }
3148
3149 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
3150 {
3151         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3152         struct vif_params params;
3153         int err;
3154         enum nl80211_iftype otype, ntype;
3155         struct net_device *dev = info->user_ptr[1];
3156         bool change = false;
3157
3158         memset(&params, 0, sizeof(params));
3159
3160         otype = ntype = dev->ieee80211_ptr->iftype;
3161
3162         if (info->attrs[NL80211_ATTR_IFTYPE]) {
3163                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3164                 if (otype != ntype)
3165                         change = true;
3166         }
3167
3168         if (info->attrs[NL80211_ATTR_MESH_ID]) {
3169                 struct wireless_dev *wdev = dev->ieee80211_ptr;
3170
3171                 if (ntype != NL80211_IFTYPE_MESH_POINT)
3172                         return -EINVAL;
3173                 if (netif_running(dev))
3174                         return -EBUSY;
3175
3176                 wdev_lock(wdev);
3177                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3178                              IEEE80211_MAX_MESH_ID_LEN);
3179                 wdev->mesh_id_up_len =
3180                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3181                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3182                        wdev->mesh_id_up_len);
3183                 wdev_unlock(wdev);
3184         }
3185
3186         if (info->attrs[NL80211_ATTR_4ADDR]) {
3187                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3188                 change = true;
3189                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
3190                 if (err)
3191                         return err;
3192         } else {
3193                 params.use_4addr = -1;
3194         }
3195
3196         err = nl80211_parse_mon_options(rdev, ntype, info, &params);
3197         if (err < 0)
3198                 return err;
3199         if (err > 0)
3200                 change = true;
3201
3202         if (change)
3203                 err = cfg80211_change_iface(rdev, dev, ntype, &params);
3204         else
3205                 err = 0;
3206
3207         if (!err && params.use_4addr != -1)
3208                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
3209
3210         return err;
3211 }
3212
3213 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
3214 {
3215         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3216         struct vif_params params;
3217         struct wireless_dev *wdev;
3218         struct sk_buff *msg;
3219         int err;
3220         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
3221
3222         /* to avoid failing a new interface creation due to pending removal */
3223         cfg80211_destroy_ifaces(rdev);
3224
3225         memset(&params, 0, sizeof(params));
3226
3227         if (!info->attrs[NL80211_ATTR_IFNAME])
3228                 return -EINVAL;
3229
3230         if (info->attrs[NL80211_ATTR_IFTYPE])
3231                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3232
3233         if (!rdev->ops->add_virtual_intf ||
3234             !(rdev->wiphy.interface_modes & (1 << type)))
3235                 return -EOPNOTSUPP;
3236
3237         if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
3238              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
3239             info->attrs[NL80211_ATTR_MAC]) {
3240                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
3241                            ETH_ALEN);
3242                 if (!is_valid_ether_addr(params.macaddr))
3243                         return -EADDRNOTAVAIL;
3244         }
3245
3246         if (info->attrs[NL80211_ATTR_4ADDR]) {
3247                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3248                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
3249                 if (err)
3250                         return err;
3251         }
3252
3253         err = nl80211_parse_mon_options(rdev, type, info, &params);
3254         if (err < 0)
3255                 return err;
3256
3257         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3258         if (!msg)
3259                 return -ENOMEM;
3260
3261         wdev = rdev_add_virtual_intf(rdev,
3262                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
3263                                 NET_NAME_USER, type, &params);
3264         if (WARN_ON(!wdev)) {
3265                 nlmsg_free(msg);
3266                 return -EPROTO;
3267         } else if (IS_ERR(wdev)) {
3268                 nlmsg_free(msg);
3269                 return PTR_ERR(wdev);
3270         }
3271
3272         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
3273                 wdev->owner_nlportid = info->snd_portid;
3274
3275         switch (type) {
3276         case NL80211_IFTYPE_MESH_POINT:
3277                 if (!info->attrs[NL80211_ATTR_MESH_ID])
3278                         break;
3279                 wdev_lock(wdev);
3280                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3281                              IEEE80211_MAX_MESH_ID_LEN);
3282                 wdev->mesh_id_up_len =
3283                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3284                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3285                        wdev->mesh_id_up_len);
3286                 wdev_unlock(wdev);
3287                 break;
3288         case NL80211_IFTYPE_NAN:
3289         case NL80211_IFTYPE_P2P_DEVICE:
3290                 /*
3291                  * P2P Device and NAN do not have a netdev, so don't go
3292                  * through the netdev notifier and must be added here
3293                  */
3294                 cfg80211_init_wdev(rdev, wdev);
3295                 break;
3296         default:
3297                 break;
3298         }
3299
3300         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3301                                rdev, wdev, false) < 0) {
3302                 nlmsg_free(msg);
3303                 return -ENOBUFS;
3304         }
3305
3306         return genlmsg_reply(msg, info);
3307 }
3308
3309 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
3310 {
3311         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3312         struct wireless_dev *wdev = info->user_ptr[1];
3313
3314         if (!rdev->ops->del_virtual_intf)
3315                 return -EOPNOTSUPP;
3316
3317         /*
3318          * If we remove a wireless device without a netdev then clear
3319          * user_ptr[1] so that nl80211_post_doit won't dereference it
3320          * to check if it needs to do dev_put(). Otherwise it crashes
3321          * since the wdev has been freed, unlike with a netdev where
3322          * we need the dev_put() for the netdev to really be freed.
3323          */
3324         if (!wdev->netdev)
3325                 info->user_ptr[1] = NULL;
3326
3327         return rdev_del_virtual_intf(rdev, wdev);
3328 }
3329
3330 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
3331 {
3332         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3333         struct net_device *dev = info->user_ptr[1];
3334         u16 noack_map;
3335
3336         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
3337                 return -EINVAL;
3338
3339         if (!rdev->ops->set_noack_map)
3340                 return -EOPNOTSUPP;
3341
3342         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
3343
3344         return rdev_set_noack_map(rdev, dev, noack_map);
3345 }
3346
3347 struct get_key_cookie {
3348         struct sk_buff *msg;
3349         int error;
3350         int idx;
3351 };
3352
3353 static void get_key_callback(void *c, struct key_params *params)
3354 {
3355         struct nlattr *key;
3356         struct get_key_cookie *cookie = c;
3357
3358         if ((params->key &&
3359              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
3360                      params->key_len, params->key)) ||
3361             (params->seq &&
3362              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
3363                      params->seq_len, params->seq)) ||
3364             (params->cipher &&
3365              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
3366                          params->cipher)))
3367                 goto nla_put_failure;
3368
3369         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
3370         if (!key)
3371                 goto nla_put_failure;
3372
3373         if ((params->key &&
3374              nla_put(cookie->msg, NL80211_KEY_DATA,
3375                      params->key_len, params->key)) ||
3376             (params->seq &&
3377              nla_put(cookie->msg, NL80211_KEY_SEQ,
3378                      params->seq_len, params->seq)) ||
3379             (params->cipher &&
3380              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
3381                          params->cipher)))
3382                 goto nla_put_failure;
3383
3384         if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
3385                 goto nla_put_failure;
3386
3387         nla_nest_end(cookie->msg, key);
3388
3389         return;
3390  nla_put_failure:
3391         cookie->error = 1;
3392 }
3393
3394 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
3395 {
3396         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3397         int err;
3398         struct net_device *dev = info->user_ptr[1];
3399         u8 key_idx = 0;
3400         const u8 *mac_addr = NULL;
3401         bool pairwise;
3402         struct get_key_cookie cookie = {
3403                 .error = 0,
3404         };
3405         void *hdr;
3406         struct sk_buff *msg;
3407
3408         if (info->attrs[NL80211_ATTR_KEY_IDX])
3409                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
3410
3411         if (info->attrs[NL80211_ATTR_MAC])
3412                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3413
3414         pairwise = !!mac_addr;
3415         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
3416                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
3417
3418                 if (kt != NL80211_KEYTYPE_GROUP &&
3419                     kt != NL80211_KEYTYPE_PAIRWISE)
3420                         return -EINVAL;
3421                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
3422         }
3423
3424         if (!rdev->ops->get_key)
3425                 return -EOPNOTSUPP;
3426
3427         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3428                 return -ENOENT;
3429
3430         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3431         if (!msg)
3432                 return -ENOMEM;
3433
3434         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3435                              NL80211_CMD_NEW_KEY);
3436         if (!hdr)
3437                 goto nla_put_failure;
3438
3439         cookie.msg = msg;
3440         cookie.idx = key_idx;
3441
3442         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3443             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
3444                 goto nla_put_failure;
3445         if (mac_addr &&
3446             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
3447                 goto nla_put_failure;
3448
3449         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
3450                            get_key_callback);
3451
3452         if (err)
3453                 goto free_msg;
3454
3455         if (cookie.error)
3456                 goto nla_put_failure;
3457
3458         genlmsg_end(msg, hdr);
3459         return genlmsg_reply(msg, info);
3460
3461  nla_put_failure:
3462         err = -ENOBUFS;
3463  free_msg:
3464         nlmsg_free(msg);
3465         return err;
3466 }
3467
3468 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
3469 {
3470         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3471         struct key_parse key;
3472         int err;
3473         struct net_device *dev = info->user_ptr[1];
3474
3475         err = nl80211_parse_key(info, &key);
3476         if (err)
3477                 return err;
3478
3479         if (key.idx < 0)
3480                 return -EINVAL;
3481
3482         /* only support setting default key */
3483         if (!key.def && !key.defmgmt)
3484                 return -EINVAL;
3485
3486         wdev_lock(dev->ieee80211_ptr);
3487
3488         if (key.def) {
3489                 if (!rdev->ops->set_default_key) {
3490                         err = -EOPNOTSUPP;
3491                         goto out;
3492                 }
3493
3494                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3495                 if (err)
3496                         goto out;
3497
3498                 err = rdev_set_default_key(rdev, dev, key.idx,
3499                                                  key.def_uni, key.def_multi);
3500
3501                 if (err)
3502                         goto out;
3503
3504 #ifdef CONFIG_CFG80211_WEXT
3505                 dev->ieee80211_ptr->wext.default_key = key.idx;
3506 #endif
3507         } else {
3508                 if (key.def_uni || !key.def_multi) {
3509                         err = -EINVAL;
3510                         goto out;
3511                 }
3512
3513                 if (!rdev->ops->set_default_mgmt_key) {
3514                         err = -EOPNOTSUPP;
3515                         goto out;
3516                 }
3517
3518                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3519                 if (err)
3520                         goto out;
3521
3522                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
3523                 if (err)
3524                         goto out;
3525
3526 #ifdef CONFIG_CFG80211_WEXT
3527                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3528 #endif
3529         }
3530
3531  out:
3532         wdev_unlock(dev->ieee80211_ptr);
3533
3534         return err;
3535 }
3536
3537 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3538 {
3539         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3540         int err;
3541         struct net_device *dev = info->user_ptr[1];
3542         struct key_parse key;
3543         const u8 *mac_addr = NULL;
3544
3545         err = nl80211_parse_key(info, &key);
3546         if (err)
3547                 return err;
3548
3549         if (!key.p.key)
3550                 return -EINVAL;
3551
3552         if (info->attrs[NL80211_ATTR_MAC])
3553                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3554
3555         if (key.type == -1) {
3556                 if (mac_addr)
3557                         key.type = NL80211_KEYTYPE_PAIRWISE;
3558                 else
3559                         key.type = NL80211_KEYTYPE_GROUP;
3560         }
3561
3562         /* for now */
3563         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3564             key.type != NL80211_KEYTYPE_GROUP)
3565                 return -EINVAL;
3566
3567         if (!rdev->ops->add_key)
3568                 return -EOPNOTSUPP;
3569
3570         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3571                                            key.type == NL80211_KEYTYPE_PAIRWISE,
3572                                            mac_addr))
3573                 return -EINVAL;
3574
3575         wdev_lock(dev->ieee80211_ptr);
3576         err = nl80211_key_allowed(dev->ieee80211_ptr);
3577         if (!err)
3578                 err = rdev_add_key(rdev, dev, key.idx,
3579                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3580                                     mac_addr, &key.p);
3581         wdev_unlock(dev->ieee80211_ptr);
3582
3583         return err;
3584 }
3585
3586 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3587 {
3588         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3589         int err;
3590         struct net_device *dev = info->user_ptr[1];
3591         u8 *mac_addr = NULL;
3592         struct key_parse key;
3593
3594         err = nl80211_parse_key(info, &key);
3595         if (err)
3596                 return err;
3597
3598         if (info->attrs[NL80211_ATTR_MAC])
3599                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3600
3601         if (key.type == -1) {
3602                 if (mac_addr)
3603                         key.type = NL80211_KEYTYPE_PAIRWISE;
3604                 else
3605                         key.type = NL80211_KEYTYPE_GROUP;
3606         }
3607
3608         /* for now */
3609         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3610             key.type != NL80211_KEYTYPE_GROUP)
3611                 return -EINVAL;
3612
3613         if (!rdev->ops->del_key)
3614                 return -EOPNOTSUPP;
3615
3616         wdev_lock(dev->ieee80211_ptr);
3617         err = nl80211_key_allowed(dev->ieee80211_ptr);
3618
3619         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3620             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3621                 err = -ENOENT;
3622
3623         if (!err)
3624                 err = rdev_del_key(rdev, dev, key.idx,
3625                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3626                                    mac_addr);
3627
3628 #ifdef CONFIG_CFG80211_WEXT
3629         if (!err) {
3630                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3631                         dev->ieee80211_ptr->wext.default_key = -1;
3632                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3633                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3634         }
3635 #endif
3636         wdev_unlock(dev->ieee80211_ptr);
3637
3638         return err;
3639 }
3640
3641 /* This function returns an error or the number of nested attributes */
3642 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3643 {
3644         struct nlattr *attr;
3645         int n_entries = 0, tmp;
3646
3647         nla_for_each_nested(attr, nl_attr, tmp) {
3648                 if (nla_len(attr) != ETH_ALEN)
3649                         return -EINVAL;
3650
3651                 n_entries++;
3652         }
3653
3654         return n_entries;
3655 }
3656
3657 /*
3658  * This function parses ACL information and allocates memory for ACL data.
3659  * On successful return, the calling function is responsible to free the
3660  * ACL buffer returned by this function.
3661  */
3662 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3663                                                 struct genl_info *info)
3664 {
3665         enum nl80211_acl_policy acl_policy;
3666         struct nlattr *attr;
3667         struct cfg80211_acl_data *acl;
3668         int i = 0, n_entries, tmp;
3669
3670         if (!wiphy->max_acl_mac_addrs)
3671                 return ERR_PTR(-EOPNOTSUPP);
3672
3673         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3674                 return ERR_PTR(-EINVAL);
3675
3676         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3677         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3678             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3679                 return ERR_PTR(-EINVAL);
3680
3681         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3682                 return ERR_PTR(-EINVAL);
3683
3684         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3685         if (n_entries < 0)
3686                 return ERR_PTR(n_entries);
3687
3688         if (n_entries > wiphy->max_acl_mac_addrs)
3689                 return ERR_PTR(-ENOTSUPP);
3690
3691         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3692                       GFP_KERNEL);
3693         if (!acl)
3694                 return ERR_PTR(-ENOMEM);
3695
3696         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3697                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3698                 i++;
3699         }
3700
3701         acl->n_acl_entries = n_entries;
3702         acl->acl_policy = acl_policy;
3703
3704         return acl;
3705 }
3706
3707 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3708 {
3709         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3710         struct net_device *dev = info->user_ptr[1];
3711         struct cfg80211_acl_data *acl;
3712         int err;
3713
3714         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3715             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3716                 return -EOPNOTSUPP;
3717
3718         if (!dev->ieee80211_ptr->beacon_interval)
3719                 return -EINVAL;
3720
3721         acl = parse_acl_data(&rdev->wiphy, info);
3722         if (IS_ERR(acl))
3723                 return PTR_ERR(acl);
3724
3725         err = rdev_set_mac_acl(rdev, dev, acl);
3726
3727         kfree(acl);
3728
3729         return err;
3730 }
3731
3732 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
3733                            u8 *rates, u8 rates_len)
3734 {
3735         u8 i;
3736         u32 mask = 0;
3737
3738         for (i = 0; i < rates_len; i++) {
3739                 int rate = (rates[i] & 0x7f) * 5;
3740                 int ridx;
3741
3742                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
3743                         struct ieee80211_rate *srate =
3744                                 &sband->bitrates[ridx];
3745                         if (rate == srate->bitrate) {
3746                                 mask |= 1 << ridx;
3747                                 break;
3748                         }
3749                 }
3750                 if (ridx == sband->n_bitrates)
3751                         return 0; /* rate not found */
3752         }
3753
3754         return mask;
3755 }
3756
3757 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
3758                                u8 *rates, u8 rates_len,
3759                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
3760 {
3761         u8 i;
3762
3763         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
3764
3765         for (i = 0; i < rates_len; i++) {
3766                 int ridx, rbit;
3767
3768                 ridx = rates[i] / 8;
3769                 rbit = BIT(rates[i] % 8);
3770
3771                 /* check validity */
3772                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
3773                         return false;
3774
3775                 /* check availability */
3776                 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
3777                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
3778                         mcs[ridx] |= rbit;
3779                 else
3780                         return false;
3781         }
3782
3783         return true;
3784 }
3785
3786 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
3787 {
3788         u16 mcs_mask = 0;
3789
3790         switch (vht_mcs_map) {
3791         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
3792                 break;
3793         case IEEE80211_VHT_MCS_SUPPORT_0_7:
3794                 mcs_mask = 0x00FF;
3795                 break;
3796         case IEEE80211_VHT_MCS_SUPPORT_0_8:
3797                 mcs_mask = 0x01FF;
3798                 break;
3799         case IEEE80211_VHT_MCS_SUPPORT_0_9:
3800                 mcs_mask = 0x03FF;
3801                 break;
3802         default:
3803                 break;
3804         }
3805
3806         return mcs_mask;
3807 }
3808
3809 static void vht_build_mcs_mask(u16 vht_mcs_map,
3810                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
3811 {
3812         u8 nss;
3813
3814         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
3815                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
3816                 vht_mcs_map >>= 2;
3817         }
3818 }
3819
3820 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
3821                              struct nl80211_txrate_vht *txrate,
3822                              u16 mcs[NL80211_VHT_NSS_MAX])
3823 {
3824         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3825         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
3826         u8 i;
3827
3828         if (!sband->vht_cap.vht_supported)
3829                 return false;
3830
3831         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
3832
3833         /* Build vht_mcs_mask from VHT capabilities */
3834         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
3835
3836         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3837                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
3838                         mcs[i] = txrate->mcs[i];
3839                 else
3840                         return false;
3841         }
3842
3843         return true;
3844 }
3845
3846 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
3847         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
3848                                     .len = NL80211_MAX_SUPP_RATES },
3849         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
3850                                 .len = NL80211_MAX_SUPP_HT_RATES },
3851         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
3852         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
3853 };
3854
3855 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
3856                                          struct cfg80211_bitrate_mask *mask)
3857 {
3858         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
3859         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3860         int rem, i;
3861         struct nlattr *tx_rates;
3862         struct ieee80211_supported_band *sband;
3863         u16 vht_tx_mcs_map;
3864
3865         memset(mask, 0, sizeof(*mask));
3866         /* Default to all rates enabled */
3867         for (i = 0; i < NUM_NL80211_BANDS; i++) {
3868                 sband = rdev->wiphy.bands[i];
3869
3870                 if (!sband)
3871                         continue;
3872
3873                 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
3874                 memcpy(mask->control[i].ht_mcs,
3875                        sband->ht_cap.mcs.rx_mask,
3876                        sizeof(mask->control[i].ht_mcs));
3877
3878                 if (!sband->vht_cap.vht_supported)
3879                         continue;
3880
3881                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3882                 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
3883         }
3884
3885         /* if no rates are given set it back to the defaults */
3886         if (!info->attrs[NL80211_ATTR_TX_RATES])
3887                 goto out;
3888
3889         /* The nested attribute uses enum nl80211_band as the index. This maps
3890          * directly to the enum nl80211_band values used in cfg80211.
3891          */
3892         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
3893         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
3894                 enum nl80211_band band = nla_type(tx_rates);
3895                 int err;
3896
3897                 if (band < 0 || band >= NUM_NL80211_BANDS)
3898                         return -EINVAL;
3899                 sband = rdev->wiphy.bands[band];
3900                 if (sband == NULL)
3901                         return -EINVAL;
3902                 err = nla_parse_nested(tb, NL80211_TXRATE_MAX, tx_rates,
3903                                        nl80211_txattr_policy, info->extack);
3904                 if (err)
3905                         return err;
3906                 if (tb[NL80211_TXRATE_LEGACY]) {
3907                         mask->control[band].legacy = rateset_to_mask(
3908                                 sband,
3909                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
3910                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
3911                         if ((mask->control[band].legacy == 0) &&
3912                             nla_len(tb[NL80211_TXRATE_LEGACY]))
3913                                 return -EINVAL;
3914                 }
3915                 if (tb[NL80211_TXRATE_HT]) {
3916                         if (!ht_rateset_to_mask(
3917                                         sband,
3918                                         nla_data(tb[NL80211_TXRATE_HT]),
3919                                         nla_len(tb[NL80211_TXRATE_HT]),
3920                                         mask->control[band].ht_mcs))
3921                                 return -EINVAL;
3922                 }
3923                 if (tb[NL80211_TXRATE_VHT]) {
3924                         if (!vht_set_mcs_mask(
3925                                         sband,
3926                                         nla_data(tb[NL80211_TXRATE_VHT]),
3927                                         mask->control[band].vht_mcs))
3928                                 return -EINVAL;
3929                 }
3930                 if (tb[NL80211_TXRATE_GI]) {
3931                         mask->control[band].gi =
3932                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
3933                         if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
3934                                 return -EINVAL;
3935                 }
3936
3937                 if (mask->control[band].legacy == 0) {
3938                         /* don't allow empty legacy rates if HT or VHT
3939                          * are not even supported.
3940                          */
3941                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
3942                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
3943                                 return -EINVAL;
3944
3945                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
3946                                 if (mask->control[band].ht_mcs[i])
3947                                         goto out;
3948
3949                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
3950                                 if (mask->control[band].vht_mcs[i])
3951                                         goto out;
3952
3953                         /* legacy and mcs rates may not be both empty */
3954                         return -EINVAL;
3955                 }
3956         }
3957
3958 out:
3959         return 0;
3960 }
3961
3962 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
3963                                    enum nl80211_band band,
3964                                    struct cfg80211_bitrate_mask *beacon_rate)
3965 {
3966         u32 count_ht, count_vht, i;
3967         u32 rate = beacon_rate->control[band].legacy;
3968
3969         /* Allow only one rate */
3970         if (hweight32(rate) > 1)
3971                 return -EINVAL;
3972
3973         count_ht = 0;
3974         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3975                 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
3976                         return -EINVAL;
3977                 } else if (beacon_rate->control[band].ht_mcs[i]) {
3978                         count_ht++;
3979                         if (count_ht > 1)
3980                                 return -EINVAL;
3981                 }
3982                 if (count_ht && rate)
3983                         return -EINVAL;
3984         }
3985
3986         count_vht = 0;
3987         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3988                 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
3989                         return -EINVAL;
3990                 } else if (beacon_rate->control[band].vht_mcs[i]) {
3991                         count_vht++;
3992                         if (count_vht > 1)
3993                                 return -EINVAL;
3994                 }
3995                 if (count_vht && rate)
3996                         return -EINVAL;
3997         }
3998
3999         if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht))
4000                 return -EINVAL;
4001
4002         if (rate &&
4003             !wiphy_ext_feature_isset(&rdev->wiphy,
4004                                      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
4005                 return -EINVAL;
4006         if (count_ht &&
4007             !wiphy_ext_feature_isset(&rdev->wiphy,
4008                                      NL80211_EXT_FEATURE_BEACON_RATE_HT))
4009                 return -EINVAL;
4010         if (count_vht &&
4011             !wiphy_ext_feature_isset(&rdev->wiphy,
4012                                      NL80211_EXT_FEATURE_BEACON_RATE_VHT))
4013                 return -EINVAL;
4014
4015         return 0;
4016 }
4017
4018 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
4019                                 struct nlattr *attrs[],
4020                                 struct cfg80211_beacon_data *bcn)
4021 {
4022         bool haveinfo = false;
4023         int err;
4024
4025         memset(bcn, 0, sizeof(*bcn));
4026
4027         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
4028                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
4029                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
4030                 if (!bcn->head_len)
4031                         return -EINVAL;
4032                 haveinfo = true;
4033         }
4034
4035         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
4036                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
4037                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
4038                 haveinfo = true;
4039         }
4040
4041         if (!haveinfo)
4042                 return -EINVAL;
4043
4044         if (attrs[NL80211_ATTR_IE]) {
4045                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
4046                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
4047         }
4048
4049         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
4050                 bcn->proberesp_ies =
4051                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4052                 bcn->proberesp_ies_len =
4053                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4054         }
4055
4056         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
4057                 bcn->assocresp_ies =
4058                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4059                 bcn->assocresp_ies_len =
4060                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4061         }
4062
4063         if (attrs[NL80211_ATTR_PROBE_RESP]) {
4064                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
4065                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
4066         }
4067
4068         if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
4069                 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
4070
4071                 err = nla_parse_nested(tb, NL80211_FTM_RESP_ATTR_MAX,
4072                                        attrs[NL80211_ATTR_FTM_RESPONDER],
4073                                        NULL, NULL);
4074                 if (err)
4075                         return err;
4076
4077                 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
4078                     wiphy_ext_feature_isset(&rdev->wiphy,
4079                                             NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
4080                         bcn->ftm_responder = 1;
4081                 else
4082                         return -EOPNOTSUPP;
4083
4084                 if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
4085                         bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
4086                         bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
4087                 }
4088
4089                 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
4090                         bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
4091                         bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
4092                 }
4093         } else {
4094                 bcn->ftm_responder = -1;
4095         }
4096
4097         return 0;
4098 }
4099
4100 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
4101                                             const u8 *rates)
4102 {
4103         int i;
4104
4105         if (!rates)
4106                 return;
4107
4108         for (i = 0; i < rates[1]; i++) {
4109                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
4110                         params->ht_required = true;
4111                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
4112                         params->vht_required = true;
4113         }
4114 }
4115
4116 /*
4117  * Since the nl80211 API didn't include, from the beginning, attributes about
4118  * HT/VHT requirements/capabilities, we parse them out of the IEs for the
4119  * benefit of drivers that rebuild IEs in the firmware.
4120  */
4121 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
4122 {
4123         const struct cfg80211_beacon_data *bcn = &params->beacon;
4124         size_t ies_len = bcn->tail_len;
4125         const u8 *ies = bcn->tail;
4126         const u8 *rates;
4127         const u8 *cap;
4128
4129         rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len);
4130         nl80211_check_ap_rate_selectors(params, rates);
4131
4132         rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
4133         nl80211_check_ap_rate_selectors(params, rates);
4134
4135         cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len);
4136         if (cap && cap[1] >= sizeof(*params->ht_cap))
4137                 params->ht_cap = (void *)(cap + 2);
4138         cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
4139         if (cap && cap[1] >= sizeof(*params->vht_cap))
4140                 params->vht_cap = (void *)(cap + 2);
4141         cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
4142         if (cap && cap[1] >= sizeof(*params->he_cap) + 1)
4143                 params->he_cap = (void *)(cap + 3);
4144 }
4145
4146 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
4147                                    struct cfg80211_ap_settings *params)
4148 {
4149         struct wireless_dev *wdev;
4150         bool ret = false;
4151
4152         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
4153                 if (wdev->iftype != NL80211_IFTYPE_AP &&
4154                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
4155                         continue;
4156
4157                 if (!wdev->preset_chandef.chan)
4158                         continue;
4159
4160                 params->chandef = wdev->preset_chandef;
4161                 ret = true;
4162                 break;
4163         }
4164
4165         return ret;
4166 }
4167
4168 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
4169                                     enum nl80211_auth_type auth_type,
4170                                     enum nl80211_commands cmd)
4171 {
4172         if (auth_type > NL80211_AUTHTYPE_MAX)
4173                 return false;
4174
4175         switch (cmd) {
4176         case NL80211_CMD_AUTHENTICATE:
4177                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
4178                     auth_type == NL80211_AUTHTYPE_SAE)
4179                         return false;
4180                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
4181                                              NL80211_EXT_FEATURE_FILS_STA) &&
4182                     (auth_type == NL80211_AUTHTYPE_FILS_SK ||
4183                      auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4184                      auth_type == NL80211_AUTHTYPE_FILS_PK))
4185                         return false;
4186                 return true;
4187         case NL80211_CMD_CONNECT:
4188                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
4189                     auth_type == NL80211_AUTHTYPE_SAE)
4190                         return false;
4191
4192                 /* FILS with SK PFS or PK not supported yet */
4193                 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4194                     auth_type == NL80211_AUTHTYPE_FILS_PK)
4195                         return false;
4196                 if (!wiphy_ext_feature_isset(
4197                             &rdev->wiphy,
4198                             NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
4199                     auth_type == NL80211_AUTHTYPE_FILS_SK)
4200                         return false;
4201                 return true;
4202         case NL80211_CMD_START_AP:
4203                 /* SAE not supported yet */
4204                 if (auth_type == NL80211_AUTHTYPE_SAE)
4205                         return false;
4206                 /* FILS not supported yet */
4207                 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
4208                     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4209                     auth_type == NL80211_AUTHTYPE_FILS_PK)
4210                         return false;
4211                 return true;
4212         default:
4213                 return false;
4214         }
4215 }
4216
4217 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
4218 {
4219         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4220         struct net_device *dev = info->user_ptr[1];
4221         struct wireless_dev *wdev = dev->ieee80211_ptr;
4222         struct cfg80211_ap_settings params;
4223         int err;
4224
4225         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4226             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4227                 return -EOPNOTSUPP;
4228
4229         if (!rdev->ops->start_ap)
4230                 return -EOPNOTSUPP;
4231
4232         if (wdev->beacon_interval)
4233                 return -EALREADY;
4234
4235         memset(&params, 0, sizeof(params));
4236
4237         /* these are required for START_AP */
4238         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
4239             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
4240             !info->attrs[NL80211_ATTR_BEACON_HEAD])
4241                 return -EINVAL;
4242
4243         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon);
4244         if (err)
4245                 return err;
4246
4247         params.beacon_interval =
4248                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
4249         params.dtim_period =
4250                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
4251
4252         err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
4253                                            params.beacon_interval);
4254         if (err)
4255                 return err;
4256
4257         /*
4258          * In theory, some of these attributes should be required here
4259          * but since they were not used when the command was originally
4260          * added, keep them optional for old user space programs to let
4261          * them continue to work with drivers that do not need the
4262          * additional information -- drivers must check!
4263          */
4264         if (info->attrs[NL80211_ATTR_SSID]) {
4265                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4266                 params.ssid_len =
4267                         nla_len(info->attrs[NL80211_ATTR_SSID]);
4268                 if (params.ssid_len == 0 ||
4269                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
4270                         return -EINVAL;
4271         }
4272
4273         if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
4274                 params.hidden_ssid = nla_get_u32(
4275                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
4276
4277         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
4278
4279         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4280                 params.auth_type = nla_get_u32(
4281                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
4282                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
4283                                              NL80211_CMD_START_AP))
4284                         return -EINVAL;
4285         } else
4286                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4287
4288         err = nl80211_crypto_settings(rdev, info, &params.crypto,
4289                                       NL80211_MAX_NR_CIPHER_SUITES);
4290         if (err)
4291                 return err;
4292
4293         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
4294                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
4295                         return -EOPNOTSUPP;
4296                 params.inactivity_timeout = nla_get_u16(
4297                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
4298         }
4299
4300         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4301                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4302                         return -EINVAL;
4303                 params.p2p_ctwindow =
4304                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4305                 if (params.p2p_ctwindow != 0 &&
4306                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4307                         return -EINVAL;
4308         }
4309
4310         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4311                 u8 tmp;
4312
4313                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4314                         return -EINVAL;
4315                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4316                 params.p2p_opp_ps = tmp;
4317                 if (params.p2p_opp_ps != 0 &&
4318                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4319                         return -EINVAL;
4320         }
4321
4322         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4323                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
4324                 if (err)
4325                         return err;
4326         } else if (wdev->preset_chandef.chan) {
4327                 params.chandef = wdev->preset_chandef;
4328         } else if (!nl80211_get_ap_channel(rdev, &params))
4329                 return -EINVAL;
4330
4331         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
4332                                            wdev->iftype))
4333                 return -EINVAL;
4334
4335         if (info->attrs[NL80211_ATTR_TX_RATES]) {
4336                 err = nl80211_parse_tx_bitrate_mask(info, &params.beacon_rate);
4337                 if (err)
4338                         return err;
4339
4340                 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
4341                                               &params.beacon_rate);
4342                 if (err)
4343                         return err;
4344         }
4345
4346         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
4347                 params.smps_mode =
4348                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
4349                 switch (params.smps_mode) {
4350                 case NL80211_SMPS_OFF:
4351                         break;
4352                 case NL80211_SMPS_STATIC:
4353                         if (!(rdev->wiphy.features &
4354                               NL80211_FEATURE_STATIC_SMPS))
4355                                 return -EINVAL;
4356                         break;
4357                 case NL80211_SMPS_DYNAMIC:
4358                         if (!(rdev->wiphy.features &
4359                               NL80211_FEATURE_DYNAMIC_SMPS))
4360                                 return -EINVAL;
4361                         break;
4362                 default:
4363                         return -EINVAL;
4364                 }
4365         } else {
4366                 params.smps_mode = NL80211_SMPS_OFF;
4367         }
4368
4369         params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
4370         if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
4371                 return -EOPNOTSUPP;
4372
4373         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
4374                 params.acl = parse_acl_data(&rdev->wiphy, info);
4375                 if (IS_ERR(params.acl))
4376                         return PTR_ERR(params.acl);
4377         }
4378
4379         nl80211_calculate_ap_params(&params);
4380
4381         wdev_lock(wdev);
4382         err = rdev_start_ap(rdev, dev, &params);
4383         if (!err) {
4384                 wdev->preset_chandef = params.chandef;
4385                 wdev->beacon_interval = params.beacon_interval;
4386                 wdev->chandef = params.chandef;
4387                 wdev->ssid_len = params.ssid_len;
4388                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
4389
4390                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4391                         wdev->conn_owner_nlportid = info->snd_portid;
4392         }
4393         wdev_unlock(wdev);
4394
4395         kfree(params.acl);
4396
4397         return err;
4398 }
4399
4400 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
4401 {
4402         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4403         struct net_device *dev = info->user_ptr[1];
4404         struct wireless_dev *wdev = dev->ieee80211_ptr;
4405         struct cfg80211_beacon_data params;
4406         int err;
4407
4408         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4409             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4410                 return -EOPNOTSUPP;
4411
4412         if (!rdev->ops->change_beacon)
4413                 return -EOPNOTSUPP;
4414
4415         if (!wdev->beacon_interval)
4416                 return -EINVAL;
4417
4418         err = nl80211_parse_beacon(rdev, info->attrs, &params);
4419         if (err)
4420                 return err;
4421
4422         wdev_lock(wdev);
4423         err = rdev_change_beacon(rdev, dev, &params);
4424         wdev_unlock(wdev);
4425
4426         return err;
4427 }
4428
4429 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
4430 {
4431         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4432         struct net_device *dev = info->user_ptr[1];
4433
4434         return cfg80211_stop_ap(rdev, dev, false);
4435 }
4436
4437 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
4438         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
4439         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
4440         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
4441         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
4442         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
4443         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
4444 };
4445
4446 static int parse_station_flags(struct genl_info *info,
4447                                enum nl80211_iftype iftype,
4448                                struct station_parameters *params)
4449 {
4450         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
4451         struct nlattr *nla;
4452         int flag;
4453
4454         /*
4455          * Try parsing the new attribute first so userspace
4456          * can specify both for older kernels.
4457          */
4458         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
4459         if (nla) {
4460                 struct nl80211_sta_flag_update *sta_flags;
4461
4462                 sta_flags = nla_data(nla);
4463                 params->sta_flags_mask = sta_flags->mask;
4464                 params->sta_flags_set = sta_flags->set;
4465                 params->sta_flags_set &= params->sta_flags_mask;
4466                 if ((params->sta_flags_mask |
4467                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
4468                         return -EINVAL;
4469                 return 0;
4470         }
4471
4472         /* if present, parse the old attribute */
4473
4474         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
4475         if (!nla)
4476                 return 0;
4477
4478         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX, nla,
4479                              sta_flags_policy, info->extack))
4480                 return -EINVAL;
4481
4482         /*
4483          * Only allow certain flags for interface types so that
4484          * other attributes are silently ignored. Remember that
4485          * this is backward compatibility code with old userspace
4486          * and shouldn't be hit in other cases anyway.
4487          */
4488         switch (iftype) {
4489         case NL80211_IFTYPE_AP:
4490         case NL80211_IFTYPE_AP_VLAN:
4491         case NL80211_IFTYPE_P2P_GO:
4492                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4493                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4494                                          BIT(NL80211_STA_FLAG_WME) |
4495                                          BIT(NL80211_STA_FLAG_MFP);
4496                 break;
4497         case NL80211_IFTYPE_P2P_CLIENT:
4498         case NL80211_IFTYPE_STATION:
4499                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4500                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
4501                 break;
4502         case NL80211_IFTYPE_MESH_POINT:
4503                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4504                                          BIT(NL80211_STA_FLAG_MFP) |
4505                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
4506                 break;
4507         default:
4508                 return -EINVAL;
4509         }
4510
4511         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
4512                 if (flags[flag]) {
4513                         params->sta_flags_set |= (1<<flag);
4514
4515                         /* no longer support new API additions in old API */
4516                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
4517                                 return -EINVAL;
4518                 }
4519         }
4520
4521         return 0;
4522 }
4523
4524 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
4525                                  int attr)
4526 {
4527         struct nlattr *rate;
4528         u32 bitrate;
4529         u16 bitrate_compat;
4530         enum nl80211_rate_info rate_flg;
4531
4532         rate = nla_nest_start(msg, attr);
4533         if (!rate)
4534                 return false;
4535
4536         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
4537         bitrate = cfg80211_calculate_bitrate(info);
4538         /* report 16-bit bitrate only if we can */
4539         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
4540         if (bitrate > 0 &&
4541             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
4542                 return false;
4543         if (bitrate_compat > 0 &&
4544             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
4545                 return false;
4546
4547         switch (info->bw) {
4548         case RATE_INFO_BW_5:
4549                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
4550                 break;
4551         case RATE_INFO_BW_10:
4552                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
4553                 break;
4554         default:
4555                 WARN_ON(1);
4556                 /* fall through */
4557         case RATE_INFO_BW_20:
4558                 rate_flg = 0;
4559                 break;
4560         case RATE_INFO_BW_40:
4561                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
4562                 break;
4563         case RATE_INFO_BW_80:
4564                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
4565                 break;
4566         case RATE_INFO_BW_160:
4567                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
4568                 break;
4569         case RATE_INFO_BW_HE_RU:
4570                 rate_flg = 0;
4571                 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
4572         }
4573
4574         if (rate_flg && nla_put_flag(msg, rate_flg))
4575                 return false;
4576
4577         if (info->flags & RATE_INFO_FLAGS_MCS) {
4578                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
4579                         return false;
4580                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4581                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4582                         return false;
4583         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
4584                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
4585                         return false;
4586                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
4587                         return false;
4588                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4589                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4590                         return false;
4591         } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
4592                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
4593                         return false;
4594                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
4595                         return false;
4596                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
4597                         return false;
4598                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
4599                         return false;
4600                 if (info->bw == RATE_INFO_BW_HE_RU &&
4601                     nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
4602                                info->he_ru_alloc))
4603                         return false;
4604         }
4605
4606         nla_nest_end(msg, rate);
4607         return true;
4608 }
4609
4610 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
4611                                int id)
4612 {
4613         void *attr;
4614         int i = 0;
4615
4616         if (!mask)
4617                 return true;
4618
4619         attr = nla_nest_start(msg, id);
4620         if (!attr)
4621                 return false;
4622
4623         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
4624                 if (!(mask & BIT(i)))
4625                         continue;
4626
4627                 if (nla_put_u8(msg, i, signal[i]))
4628                         return false;
4629         }
4630
4631         nla_nest_end(msg, attr);
4632
4633         return true;
4634 }
4635
4636 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
4637                                 u32 seq, int flags,
4638                                 struct cfg80211_registered_device *rdev,
4639                                 struct net_device *dev,
4640                                 const u8 *mac_addr, struct station_info *sinfo)
4641 {
4642         void *hdr;
4643         struct nlattr *sinfoattr, *bss_param;
4644
4645         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
4646         if (!hdr)
4647                 return -1;
4648
4649         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4650             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
4651             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
4652                 goto nla_put_failure;
4653
4654         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
4655         if (!sinfoattr)
4656                 goto nla_put_failure;
4657
4658 #define PUT_SINFO(attr, memb, type) do {                                \
4659         BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
4660         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
4661             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
4662                              sinfo->memb))                              \
4663                 goto nla_put_failure;                                   \
4664         } while (0)
4665 #define PUT_SINFO_U64(attr, memb) do {                                  \
4666         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
4667             nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
4668                               sinfo->memb, NL80211_STA_INFO_PAD))       \
4669                 goto nla_put_failure;                                   \
4670         } while (0)
4671
4672         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
4673         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
4674
4675         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
4676                              BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
4677             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
4678                         (u32)sinfo->rx_bytes))
4679                 goto nla_put_failure;
4680
4681         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
4682                              BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
4683             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
4684                         (u32)sinfo->tx_bytes))
4685                 goto nla_put_failure;
4686
4687         PUT_SINFO_U64(RX_BYTES64, rx_bytes);
4688         PUT_SINFO_U64(TX_BYTES64, tx_bytes);
4689         PUT_SINFO(LLID, llid, u16);
4690         PUT_SINFO(PLID, plid, u16);
4691         PUT_SINFO(PLINK_STATE, plink_state, u8);
4692         PUT_SINFO_U64(RX_DURATION, rx_duration);
4693
4694         switch (rdev->wiphy.signal_type) {
4695         case CFG80211_SIGNAL_TYPE_MBM:
4696                 PUT_SINFO(SIGNAL, signal, u8);
4697                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
4698                 break;
4699         default:
4700                 break;
4701         }
4702         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
4703                 if (!nl80211_put_signal(msg, sinfo->chains,
4704                                         sinfo->chain_signal,
4705                                         NL80211_STA_INFO_CHAIN_SIGNAL))
4706                         goto nla_put_failure;
4707         }
4708         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
4709                 if (!nl80211_put_signal(msg, sinfo->chains,
4710                                         sinfo->chain_signal_avg,
4711                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
4712                         goto nla_put_failure;
4713         }
4714         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
4715                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
4716                                           NL80211_STA_INFO_TX_BITRATE))
4717                         goto nla_put_failure;
4718         }
4719         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
4720                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
4721                                           NL80211_STA_INFO_RX_BITRATE))
4722                         goto nla_put_failure;
4723         }
4724
4725         PUT_SINFO(RX_PACKETS, rx_packets, u32);
4726         PUT_SINFO(TX_PACKETS, tx_packets, u32);
4727         PUT_SINFO(TX_RETRIES, tx_retries, u32);
4728         PUT_SINFO(TX_FAILED, tx_failed, u32);
4729         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
4730         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
4731         PUT_SINFO(LOCAL_PM, local_pm, u32);
4732         PUT_SINFO(PEER_PM, peer_pm, u32);
4733         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
4734
4735         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
4736                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
4737                 if (!bss_param)
4738                         goto nla_put_failure;
4739
4740                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
4741                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
4742                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
4743                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
4744                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
4745                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
4746                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
4747                                sinfo->bss_param.dtim_period) ||
4748                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
4749                                 sinfo->bss_param.beacon_interval))
4750                         goto nla_put_failure;
4751
4752                 nla_nest_end(msg, bss_param);
4753         }
4754         if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
4755             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
4756                     sizeof(struct nl80211_sta_flag_update),
4757                     &sinfo->sta_flags))
4758                 goto nla_put_failure;
4759
4760         PUT_SINFO_U64(T_OFFSET, t_offset);
4761         PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
4762         PUT_SINFO_U64(BEACON_RX, rx_beacon);
4763         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
4764         PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
4765         PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
4766         if (wiphy_ext_feature_isset(&rdev->wiphy,
4767                                     NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
4768                 PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
4769                 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
4770         }
4771
4772 #undef PUT_SINFO
4773 #undef PUT_SINFO_U64
4774
4775         if (sinfo->pertid) {
4776                 struct nlattr *tidsattr;
4777                 int tid;
4778
4779                 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS);
4780                 if (!tidsattr)
4781                         goto nla_put_failure;
4782
4783                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
4784                         struct cfg80211_tid_stats *tidstats;
4785                         struct nlattr *tidattr;
4786
4787                         tidstats = &sinfo->pertid[tid];
4788
4789                         if (!tidstats->filled)
4790                                 continue;
4791
4792                         tidattr = nla_nest_start(msg, tid + 1);
4793                         if (!tidattr)
4794                                 goto nla_put_failure;
4795
4796 #define PUT_TIDVAL_U64(attr, memb) do {                                 \
4797         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
4798             nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,          \
4799                               tidstats->memb, NL80211_TID_STATS_PAD))   \
4800                 goto nla_put_failure;                                   \
4801         } while (0)
4802
4803                         PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
4804                         PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
4805                         PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
4806                         PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
4807
4808 #undef PUT_TIDVAL_U64
4809                         if ((tidstats->filled &
4810                              BIT(NL80211_TID_STATS_TXQ_STATS)) &&
4811                             !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
4812                                                    NL80211_TID_STATS_TXQ_STATS))
4813                                 goto nla_put_failure;
4814
4815                         nla_nest_end(msg, tidattr);
4816                 }
4817
4818                 nla_nest_end(msg, tidsattr);
4819         }
4820
4821         nla_nest_end(msg, sinfoattr);
4822
4823         if (sinfo->assoc_req_ies_len &&
4824             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
4825                     sinfo->assoc_req_ies))
4826                 goto nla_put_failure;
4827
4828         cfg80211_sinfo_release_content(sinfo);
4829         genlmsg_end(msg, hdr);
4830         return 0;
4831
4832  nla_put_failure:
4833         cfg80211_sinfo_release_content(sinfo);
4834         genlmsg_cancel(msg, hdr);
4835         return -EMSGSIZE;
4836 }
4837
4838 static int nl80211_dump_station(struct sk_buff *skb,
4839                                 struct netlink_callback *cb)
4840 {
4841         struct station_info sinfo;
4842         struct cfg80211_registered_device *rdev;
4843         struct wireless_dev *wdev;
4844         u8 mac_addr[ETH_ALEN];
4845         int sta_idx = cb->args[2];
4846         int err;
4847
4848         rtnl_lock();
4849         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
4850         if (err)
4851                 goto out_err;
4852
4853         if (!wdev->netdev) {
4854                 err = -EINVAL;
4855                 goto out_err;
4856         }
4857
4858         if (!rdev->ops->dump_station) {
4859                 err = -EOPNOTSUPP;
4860                 goto out_err;
4861         }
4862
4863         while (1) {
4864                 memset(&sinfo, 0, sizeof(sinfo));
4865                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
4866                                         mac_addr, &sinfo);
4867                 if (err == -ENOENT)
4868                         break;
4869                 if (err)
4870                         goto out_err;
4871
4872                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
4873                                 NETLINK_CB(cb->skb).portid,
4874                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4875                                 rdev, wdev->netdev, mac_addr,
4876                                 &sinfo) < 0)
4877                         goto out;
4878
4879                 sta_idx++;
4880         }
4881
4882  out:
4883         cb->args[2] = sta_idx;
4884         err = skb->len;
4885  out_err:
4886         rtnl_unlock();
4887
4888         return err;
4889 }
4890
4891 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
4892 {
4893         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4894         struct net_device *dev = info->user_ptr[1];
4895         struct station_info sinfo;
4896         struct sk_buff *msg;
4897         u8 *mac_addr = NULL;
4898         int err;
4899
4900         memset(&sinfo, 0, sizeof(sinfo));
4901
4902         if (!info->attrs[NL80211_ATTR_MAC])
4903                 return -EINVAL;
4904
4905         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4906
4907         if (!rdev->ops->get_station)
4908                 return -EOPNOTSUPP;
4909
4910         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
4911         if (err)
4912                 return err;
4913
4914         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4915         if (!msg) {
4916                 cfg80211_sinfo_release_content(&sinfo);
4917                 return -ENOMEM;
4918         }
4919
4920         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
4921                                  info->snd_portid, info->snd_seq, 0,
4922                                  rdev, dev, mac_addr, &sinfo) < 0) {
4923                 nlmsg_free(msg);
4924                 return -ENOBUFS;
4925         }
4926
4927         return genlmsg_reply(msg, info);
4928 }
4929
4930 int cfg80211_check_station_change(struct wiphy *wiphy,
4931                                   struct station_parameters *params,
4932                                   enum cfg80211_station_type statype)
4933 {
4934         if (params->listen_interval != -1 &&
4935             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4936                 return -EINVAL;
4937
4938         if (params->support_p2p_ps != -1 &&
4939             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4940                 return -EINVAL;
4941
4942         if (params->aid &&
4943             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
4944             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4945                 return -EINVAL;
4946
4947         /* When you run into this, adjust the code below for the new flag */
4948         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4949
4950         switch (statype) {
4951         case CFG80211_STA_MESH_PEER_KERNEL:
4952         case CFG80211_STA_MESH_PEER_USER:
4953                 /*
4954                  * No ignoring the TDLS flag here -- the userspace mesh
4955                  * code doesn't have the bug of including TDLS in the
4956                  * mask everywhere.
4957                  */
4958                 if (params->sta_flags_mask &
4959                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4960                                   BIT(NL80211_STA_FLAG_MFP) |
4961                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
4962                         return -EINVAL;
4963                 break;
4964         case CFG80211_STA_TDLS_PEER_SETUP:
4965         case CFG80211_STA_TDLS_PEER_ACTIVE:
4966                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4967                         return -EINVAL;
4968                 /* ignore since it can't change */
4969                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4970                 break;
4971         default:
4972                 /* disallow mesh-specific things */
4973                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
4974                         return -EINVAL;
4975                 if (params->local_pm)
4976                         return -EINVAL;
4977                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4978                         return -EINVAL;
4979         }
4980
4981         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4982             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
4983                 /* TDLS can't be set, ... */
4984                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4985                         return -EINVAL;
4986                 /*
4987                  * ... but don't bother the driver with it. This works around
4988                  * a hostapd/wpa_supplicant issue -- it always includes the
4989                  * TLDS_PEER flag in the mask even for AP mode.
4990                  */
4991                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4992         }
4993
4994         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4995             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4996                 /* reject other things that can't change */
4997                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
4998                         return -EINVAL;
4999                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
5000                         return -EINVAL;
5001                 if (params->supported_rates)
5002                         return -EINVAL;
5003                 if (params->ext_capab || params->ht_capa || params->vht_capa ||
5004                     params->he_capa)
5005                         return -EINVAL;
5006         }
5007
5008         if (statype != CFG80211_STA_AP_CLIENT &&
5009             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
5010                 if (params->vlan)
5011                         return -EINVAL;
5012         }
5013
5014         switch (statype) {
5015         case CFG80211_STA_AP_MLME_CLIENT:
5016                 /* Use this only for authorizing/unauthorizing a station */
5017                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
5018                         return -EOPNOTSUPP;
5019                 break;
5020         case CFG80211_STA_AP_CLIENT:
5021         case CFG80211_STA_AP_CLIENT_UNASSOC:
5022                 /* accept only the listed bits */
5023                 if (params->sta_flags_mask &
5024                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
5025                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5026                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
5027                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
5028                                   BIT(NL80211_STA_FLAG_WME) |
5029                                   BIT(NL80211_STA_FLAG_MFP)))
5030                         return -EINVAL;
5031
5032                 /* but authenticated/associated only if driver handles it */
5033                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5034                     params->sta_flags_mask &
5035                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5036                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
5037                         return -EINVAL;
5038                 break;
5039         case CFG80211_STA_IBSS:
5040         case CFG80211_STA_AP_STA:
5041                 /* reject any changes other than AUTHORIZED */
5042                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
5043                         return -EINVAL;
5044                 break;
5045         case CFG80211_STA_TDLS_PEER_SETUP:
5046                 /* reject any changes other than AUTHORIZED or WME */
5047                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
5048                                                BIT(NL80211_STA_FLAG_WME)))
5049                         return -EINVAL;
5050                 /* force (at least) rates when authorizing */
5051                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
5052                     !params->supported_rates)
5053                         return -EINVAL;
5054                 break;
5055         case CFG80211_STA_TDLS_PEER_ACTIVE:
5056                 /* reject any changes */
5057                 return -EINVAL;
5058         case CFG80211_STA_MESH_PEER_KERNEL:
5059                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
5060                         return -EINVAL;
5061                 break;
5062         case CFG80211_STA_MESH_PEER_USER:
5063                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
5064                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
5065                         return -EINVAL;
5066                 break;
5067         }
5068
5069         /*
5070          * Older kernel versions ignored this attribute entirely, so don't
5071          * reject attempts to update it but mark it as unused instead so the
5072          * driver won't look at the data.
5073          */
5074         if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
5075             statype != CFG80211_STA_TDLS_PEER_SETUP)
5076                 params->opmode_notif_used = false;
5077
5078         return 0;
5079 }
5080 EXPORT_SYMBOL(cfg80211_check_station_change);
5081
5082 /*
5083  * Get vlan interface making sure it is running and on the right wiphy.
5084  */
5085 static struct net_device *get_vlan(struct genl_info *info,
5086                                    struct cfg80211_registered_device *rdev)
5087 {
5088         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
5089         struct net_device *v;
5090         int ret;
5091
5092         if (!vlanattr)
5093                 return NULL;
5094
5095         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
5096         if (!v)
5097                 return ERR_PTR(-ENODEV);
5098
5099         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
5100                 ret = -EINVAL;
5101                 goto error;
5102         }
5103
5104         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5105             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5106             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
5107                 ret = -EINVAL;
5108                 goto error;
5109         }
5110
5111         if (!netif_running(v)) {
5112                 ret = -ENETDOWN;
5113                 goto error;
5114         }
5115
5116         return v;
5117  error:
5118         dev_put(v);
5119         return ERR_PTR(ret);
5120 }
5121
5122 static const struct nla_policy
5123 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
5124         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
5125         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
5126 };
5127
5128 static int nl80211_parse_sta_wme(struct genl_info *info,
5129                                  struct station_parameters *params)
5130 {
5131         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
5132         struct nlattr *nla;
5133         int err;
5134
5135         /* parse WME attributes if present */
5136         if (!info->attrs[NL80211_ATTR_STA_WME])
5137                 return 0;
5138
5139         nla = info->attrs[NL80211_ATTR_STA_WME];
5140         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
5141                                nl80211_sta_wme_policy, info->extack);
5142         if (err)
5143                 return err;
5144
5145         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
5146                 params->uapsd_queues = nla_get_u8(
5147                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
5148         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
5149                 return -EINVAL;
5150
5151         if (tb[NL80211_STA_WME_MAX_SP])
5152                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
5153
5154         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
5155                 return -EINVAL;
5156
5157         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
5158
5159         return 0;
5160 }
5161
5162 static int nl80211_parse_sta_channel_info(struct genl_info *info,
5163                                       struct station_parameters *params)
5164 {
5165         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
5166                 params->supported_channels =
5167                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
5168                 params->supported_channels_len =
5169                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
5170                 /*
5171                  * Need to include at least one (first channel, number of
5172                  * channels) tuple for each subband, and must have proper
5173                  * tuples for the rest of the data as well.
5174                  */
5175                 if (params->supported_channels_len < 2)
5176                         return -EINVAL;
5177                 if (params->supported_channels_len % 2)
5178                         return -EINVAL;
5179         }
5180
5181         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
5182                 params->supported_oper_classes =
5183                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
5184                 params->supported_oper_classes_len =
5185                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
5186                 /*
5187                  * The value of the Length field of the Supported Operating
5188                  * Classes element is between 2 and 253.
5189                  */
5190                 if (params->supported_oper_classes_len < 2 ||
5191                     params->supported_oper_classes_len > 253)
5192                         return -EINVAL;
5193         }
5194         return 0;
5195 }
5196
5197 static int nl80211_set_station_tdls(struct genl_info *info,
5198                                     struct station_parameters *params)
5199 {
5200         int err;
5201         /* Dummy STA entry gets updated once the peer capabilities are known */
5202         if (info->attrs[NL80211_ATTR_PEER_AID])
5203                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5204         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5205                 params->ht_capa =
5206                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5207         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5208                 params->vht_capa =
5209                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5210         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
5211                 params->he_capa =
5212                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5213                 params->he_capa_len =
5214                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5215
5216                 if (params->he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN)
5217                         return -EINVAL;
5218         }
5219
5220         err = nl80211_parse_sta_channel_info(info, params);
5221         if (err)
5222                 return err;
5223
5224         return nl80211_parse_sta_wme(info, params);
5225 }
5226
5227 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
5228 {
5229         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5230         struct net_device *dev = info->user_ptr[1];
5231         struct station_parameters params;
5232         u8 *mac_addr;
5233         int err;
5234
5235         memset(&params, 0, sizeof(params));
5236
5237         if (!rdev->ops->change_station)
5238                 return -EOPNOTSUPP;
5239
5240         /*
5241          * AID and listen_interval properties can be set only for unassociated
5242          * station. Include these parameters here and will check them in
5243          * cfg80211_check_station_change().
5244          */
5245         if (info->attrs[NL80211_ATTR_STA_AID])
5246                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5247
5248         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5249                 params.listen_interval =
5250                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5251         else
5252                 params.listen_interval = -1;
5253
5254         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
5255                 params.support_p2p_ps =
5256                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5257         else
5258                 params.support_p2p_ps = -1;
5259
5260         if (!info->attrs[NL80211_ATTR_MAC])
5261                 return -EINVAL;
5262
5263         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5264
5265         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
5266                 params.supported_rates =
5267                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5268                 params.supported_rates_len =
5269                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5270         }
5271
5272         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5273                 params.capability =
5274                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5275                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5276         }
5277
5278         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5279                 params.ext_capab =
5280                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5281                 params.ext_capab_len =
5282                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5283         }
5284
5285         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5286                 return -EINVAL;
5287
5288         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
5289                 params.plink_action =
5290                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5291
5292         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
5293                 params.plink_state =
5294                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
5295                 if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
5296                         params.peer_aid = nla_get_u16(
5297                                 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
5298                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
5299         }
5300
5301         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
5302                 params.local_pm = nla_get_u32(
5303                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
5304
5305         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5306                 params.opmode_notif_used = true;
5307                 params.opmode_notif =
5308                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5309         }
5310
5311         /* Include parameters for TDLS peer (will check later) */
5312         err = nl80211_set_station_tdls(info, &params);
5313         if (err)
5314                 return err;
5315
5316         params.vlan = get_vlan(info, rdev);
5317         if (IS_ERR(params.vlan))
5318                 return PTR_ERR(params.vlan);
5319
5320         switch (dev->ieee80211_ptr->iftype) {
5321         case NL80211_IFTYPE_AP:
5322         case NL80211_IFTYPE_AP_VLAN:
5323         case NL80211_IFTYPE_P2P_GO:
5324         case NL80211_IFTYPE_P2P_CLIENT:
5325         case NL80211_IFTYPE_STATION:
5326         case NL80211_IFTYPE_ADHOC:
5327         case NL80211_IFTYPE_MESH_POINT:
5328                 break;
5329         default:
5330                 err = -EOPNOTSUPP;
5331                 goto out_put_vlan;
5332         }
5333
5334         /* driver will call cfg80211_check_station_change() */
5335         err = rdev_change_station(rdev, dev, mac_addr, &params);
5336
5337  out_put_vlan:
5338         if (params.vlan)
5339                 dev_put(params.vlan);
5340
5341         return err;
5342 }
5343
5344 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
5345 {
5346         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5347         int err;
5348         struct net_device *dev = info->user_ptr[1];
5349         struct station_parameters params;
5350         u8 *mac_addr = NULL;
5351         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5352                          BIT(NL80211_STA_FLAG_ASSOCIATED);
5353
5354         memset(&params, 0, sizeof(params));
5355
5356         if (!rdev->ops->add_station)
5357                 return -EOPNOTSUPP;
5358
5359         if (!info->attrs[NL80211_ATTR_MAC])
5360                 return -EINVAL;
5361
5362         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5363                 return -EINVAL;
5364
5365         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
5366                 return -EINVAL;
5367
5368         if (!info->attrs[NL80211_ATTR_STA_AID] &&
5369             !info->attrs[NL80211_ATTR_PEER_AID])
5370                 return -EINVAL;
5371
5372         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5373         params.supported_rates =
5374                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5375         params.supported_rates_len =
5376                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5377         params.listen_interval =
5378                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5379
5380         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
5381                 params.support_p2p_ps =
5382                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5383         } else {
5384                 /*
5385                  * if not specified, assume it's supported for P2P GO interface,
5386                  * and is NOT supported for AP interface
5387                  */
5388                 params.support_p2p_ps =
5389                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
5390         }
5391
5392         if (info->attrs[NL80211_ATTR_PEER_AID])
5393                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5394         else
5395                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5396
5397         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5398                 params.capability =
5399                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5400                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5401         }
5402
5403         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5404                 params.ext_capab =
5405                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5406                 params.ext_capab_len =
5407                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5408         }
5409
5410         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5411                 params.ht_capa =
5412                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5413
5414         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5415                 params.vht_capa =
5416                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5417
5418         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
5419                 params.he_capa =
5420                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5421                 params.he_capa_len =
5422                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5423
5424                 /* max len is validated in nla policy */
5425                 if (params.he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN)
5426                         return -EINVAL;
5427         }
5428
5429         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5430                 params.opmode_notif_used = true;
5431                 params.opmode_notif =
5432                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5433         }
5434
5435         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
5436                 params.plink_action =
5437                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5438
5439         err = nl80211_parse_sta_channel_info(info, &params);
5440         if (err)
5441                 return err;
5442
5443         err = nl80211_parse_sta_wme(info, &params);
5444         if (err)
5445                 return err;
5446
5447         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5448                 return -EINVAL;
5449
5450         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
5451          * as userspace might just pass through the capabilities from the IEs
5452          * directly, rather than enforcing this restriction and returning an
5453          * error in this case.
5454          */
5455         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
5456                 params.ht_capa = NULL;
5457                 params.vht_capa = NULL;
5458
5459                 /* HE requires WME */
5460                 if (params.he_capa_len)
5461                         return -EINVAL;
5462         }
5463
5464         /* When you run into this, adjust the code below for the new flag */
5465         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
5466
5467         switch (dev->ieee80211_ptr->iftype) {
5468         case NL80211_IFTYPE_AP:
5469         case NL80211_IFTYPE_AP_VLAN:
5470         case NL80211_IFTYPE_P2P_GO:
5471                 /* ignore WME attributes if iface/sta is not capable */
5472                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
5473                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
5474                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5475
5476                 /* TDLS peers cannot be added */
5477                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5478                     info->attrs[NL80211_ATTR_PEER_AID])
5479                         return -EINVAL;
5480                 /* but don't bother the driver with it */
5481                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5482
5483                 /* allow authenticated/associated only if driver handles it */
5484                 if (!(rdev->wiphy.features &
5485                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5486                     params.sta_flags_mask & auth_assoc)
5487                         return -EINVAL;
5488
5489                 /* Older userspace, or userspace wanting to be compatible with
5490                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
5491                  * and assoc flags in the mask, but assumes the station will be
5492                  * added as associated anyway since this was the required driver
5493                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
5494                  * introduced.
5495                  * In order to not bother drivers with this quirk in the API
5496                  * set the flags in both the mask and set for new stations in
5497                  * this case.
5498                  */
5499                 if (!(params.sta_flags_mask & auth_assoc)) {
5500                         params.sta_flags_mask |= auth_assoc;
5501                         params.sta_flags_set |= auth_assoc;
5502                 }
5503
5504                 /* must be last in here for error handling */
5505                 params.vlan = get_vlan(info, rdev);
5506                 if (IS_ERR(params.vlan))
5507                         return PTR_ERR(params.vlan);
5508                 break;
5509         case NL80211_IFTYPE_MESH_POINT:
5510                 /* ignore uAPSD data */
5511                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5512
5513                 /* associated is disallowed */
5514                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
5515                         return -EINVAL;
5516                 /* TDLS peers cannot be added */
5517                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5518                     info->attrs[NL80211_ATTR_PEER_AID])
5519                         return -EINVAL;
5520                 break;
5521         case NL80211_IFTYPE_STATION:
5522         case NL80211_IFTYPE_P2P_CLIENT:
5523                 /* ignore uAPSD data */
5524                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5525
5526                 /* these are disallowed */
5527                 if (params.sta_flags_mask &
5528                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
5529                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
5530                         return -EINVAL;
5531                 /* Only TDLS peers can be added */
5532                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
5533                         return -EINVAL;
5534                 /* Can only add if TDLS ... */
5535                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
5536                         return -EOPNOTSUPP;
5537                 /* ... with external setup is supported */
5538                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
5539                         return -EOPNOTSUPP;
5540                 /*
5541                  * Older wpa_supplicant versions always mark the TDLS peer
5542                  * as authorized, but it shouldn't yet be.
5543                  */
5544                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
5545                 break;
5546         default:
5547                 return -EOPNOTSUPP;
5548         }
5549
5550         /* be aware of params.vlan when changing code here */
5551
5552         err = rdev_add_station(rdev, dev, mac_addr, &params);
5553
5554         if (params.vlan)
5555                 dev_put(params.vlan);
5556         return err;
5557 }
5558
5559 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
5560 {
5561         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5562         struct net_device *dev = info->user_ptr[1];
5563         struct station_del_parameters params;
5564
5565         memset(&params, 0, sizeof(params));
5566
5567         if (info->attrs[NL80211_ATTR_MAC])
5568                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
5569
5570         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5571             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5572             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5573             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5574                 return -EINVAL;
5575
5576         if (!rdev->ops->del_station)
5577                 return -EOPNOTSUPP;
5578
5579         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
5580                 params.subtype =
5581                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
5582                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
5583                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
5584                         return -EINVAL;
5585         } else {
5586                 /* Default to Deauthentication frame */
5587                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
5588         }
5589
5590         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
5591                 params.reason_code =
5592                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5593                 if (params.reason_code == 0)
5594                         return -EINVAL; /* 0 is reserved */
5595         } else {
5596                 /* Default to reason code 2 */
5597                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
5598         }
5599
5600         return rdev_del_station(rdev, dev, &params);
5601 }
5602
5603 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
5604                                 int flags, struct net_device *dev,
5605                                 u8 *dst, u8 *next_hop,
5606                                 struct mpath_info *pinfo)
5607 {
5608         void *hdr;
5609         struct nlattr *pinfoattr;
5610
5611         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
5612         if (!hdr)
5613                 return -1;
5614
5615         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5616             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
5617             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
5618             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
5619                 goto nla_put_failure;
5620
5621         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
5622         if (!pinfoattr)
5623                 goto nla_put_failure;
5624         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
5625             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
5626                         pinfo->frame_qlen))
5627                 goto nla_put_failure;
5628         if (((pinfo->filled & MPATH_INFO_SN) &&
5629              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
5630             ((pinfo->filled & MPATH_INFO_METRIC) &&
5631              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
5632                          pinfo->metric)) ||
5633             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
5634              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
5635                          pinfo->exptime)) ||
5636             ((pinfo->filled & MPATH_INFO_FLAGS) &&
5637              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
5638                         pinfo->flags)) ||
5639             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
5640              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
5641                          pinfo->discovery_timeout)) ||
5642             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
5643              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
5644                         pinfo->discovery_retries)))
5645                 goto nla_put_failure;
5646
5647         nla_nest_end(msg, pinfoattr);
5648
5649         genlmsg_end(msg, hdr);
5650         return 0;
5651
5652  nla_put_failure:
5653         genlmsg_cancel(msg, hdr);
5654         return -EMSGSIZE;
5655 }
5656
5657 static int nl80211_dump_mpath(struct sk_buff *skb,
5658                               struct netlink_callback *cb)
5659 {
5660         struct mpath_info pinfo;
5661         struct cfg80211_registered_device *rdev;
5662         struct wireless_dev *wdev;
5663         u8 dst[ETH_ALEN];
5664         u8 next_hop[ETH_ALEN];
5665         int path_idx = cb->args[2];
5666         int err;
5667
5668         rtnl_lock();
5669         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
5670         if (err)
5671                 goto out_err;
5672
5673         if (!rdev->ops->dump_mpath) {
5674                 err = -EOPNOTSUPP;
5675                 goto out_err;
5676         }
5677
5678         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5679                 err = -EOPNOTSUPP;
5680                 goto out_err;
5681         }
5682
5683         while (1) {
5684                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
5685                                       next_hop, &pinfo);
5686                 if (err == -ENOENT)
5687                         break;
5688                 if (err)
5689                         goto out_err;
5690
5691                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5692                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
5693                                        wdev->netdev, dst, next_hop,
5694                                        &pinfo) < 0)
5695                         goto out;
5696
5697                 path_idx++;
5698         }
5699
5700  out:
5701         cb->args[2] = path_idx;
5702         err = skb->len;
5703  out_err:
5704         rtnl_unlock();
5705         return err;
5706 }
5707
5708 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
5709 {
5710         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5711         int err;
5712         struct net_device *dev = info->user_ptr[1];
5713         struct mpath_info pinfo;
5714         struct sk_buff *msg;
5715         u8 *dst = NULL;
5716         u8 next_hop[ETH_ALEN];
5717
5718         memset(&pinfo, 0, sizeof(pinfo));
5719
5720         if (!info->attrs[NL80211_ATTR_MAC])
5721                 return -EINVAL;
5722
5723         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5724
5725         if (!rdev->ops->get_mpath)
5726                 return -EOPNOTSUPP;
5727
5728         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5729                 return -EOPNOTSUPP;
5730
5731         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
5732         if (err)
5733                 return err;
5734
5735         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5736         if (!msg)
5737                 return -ENOMEM;
5738
5739         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5740                                  dev, dst, next_hop, &pinfo) < 0) {
5741                 nlmsg_free(msg);
5742                 return -ENOBUFS;
5743         }
5744
5745         return genlmsg_reply(msg, info);
5746 }
5747
5748 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
5749 {
5750         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5751         struct net_device *dev = info->user_ptr[1];
5752         u8 *dst = NULL;
5753         u8 *next_hop = NULL;
5754
5755         if (!info->attrs[NL80211_ATTR_MAC])
5756                 return -EINVAL;
5757
5758         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5759                 return -EINVAL;
5760
5761         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5762         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5763
5764         if (!rdev->ops->change_mpath)
5765                 return -EOPNOTSUPP;
5766
5767         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5768                 return -EOPNOTSUPP;
5769
5770         return rdev_change_mpath(rdev, dev, dst, next_hop);
5771 }
5772
5773 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
5774 {
5775         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5776         struct net_device *dev = info->user_ptr[1];
5777         u8 *dst = NULL;
5778         u8 *next_hop = NULL;
5779
5780         if (!info->attrs[NL80211_ATTR_MAC])
5781                 return -EINVAL;
5782
5783         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5784                 return -EINVAL;
5785
5786         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5787         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5788
5789         if (!rdev->ops->add_mpath)
5790                 return -EOPNOTSUPP;
5791
5792         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5793                 return -EOPNOTSUPP;
5794
5795         return rdev_add_mpath(rdev, dev, dst, next_hop);
5796 }
5797
5798 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
5799 {
5800         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5801         struct net_device *dev = info->user_ptr[1];
5802         u8 *dst = NULL;
5803
5804         if (info->attrs[NL80211_ATTR_MAC])
5805                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5806
5807         if (!rdev->ops->del_mpath)
5808                 return -EOPNOTSUPP;
5809
5810         return rdev_del_mpath(rdev, dev, dst);
5811 }
5812
5813 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
5814 {
5815         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5816         int err;
5817         struct net_device *dev = info->user_ptr[1];
5818         struct mpath_info pinfo;
5819         struct sk_buff *msg;
5820         u8 *dst = NULL;
5821         u8 mpp[ETH_ALEN];
5822
5823         memset(&pinfo, 0, sizeof(pinfo));
5824
5825         if (!info->attrs[NL80211_ATTR_MAC])
5826                 return -EINVAL;
5827
5828         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5829
5830         if (!rdev->ops->get_mpp)
5831                 return -EOPNOTSUPP;
5832
5833         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5834                 return -EOPNOTSUPP;
5835
5836         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
5837         if (err)
5838                 return err;
5839
5840         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5841         if (!msg)
5842                 return -ENOMEM;
5843
5844         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5845                                dev, dst, mpp, &pinfo) < 0) {
5846                 nlmsg_free(msg);
5847                 return -ENOBUFS;
5848         }
5849
5850         return genlmsg_reply(msg, info);
5851 }
5852
5853 static int nl80211_dump_mpp(struct sk_buff *skb,
5854                             struct netlink_callback *cb)
5855 {
5856         struct mpath_info pinfo;
5857         struct cfg80211_registered_device *rdev;
5858         struct wireless_dev *wdev;
5859         u8 dst[ETH_ALEN];
5860         u8 mpp[ETH_ALEN];
5861         int path_idx = cb->args[2];
5862         int err;
5863
5864         rtnl_lock();
5865         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
5866         if (err)
5867                 goto out_err;
5868
5869         if (!rdev->ops->dump_mpp) {
5870                 err = -EOPNOTSUPP;
5871                 goto out_err;
5872         }
5873
5874         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5875                 err = -EOPNOTSUPP;
5876                 goto out_err;
5877         }
5878
5879         while (1) {
5880                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
5881                                     mpp, &pinfo);
5882                 if (err == -ENOENT)
5883                         break;
5884                 if (err)
5885                         goto out_err;
5886
5887                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5888                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
5889                                        wdev->netdev, dst, mpp,
5890                                        &pinfo) < 0)
5891                         goto out;
5892
5893                 path_idx++;
5894         }
5895
5896  out:
5897         cb->args[2] = path_idx;
5898         err = skb->len;
5899  out_err:
5900         rtnl_unlock();
5901         return err;
5902 }
5903
5904 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
5905 {
5906         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5907         struct net_device *dev = info->user_ptr[1];
5908         struct wireless_dev *wdev = dev->ieee80211_ptr;
5909         struct bss_parameters params;
5910         int err;
5911
5912         memset(&params, 0, sizeof(params));
5913         /* default to not changing parameters */
5914         params.use_cts_prot = -1;
5915         params.use_short_preamble = -1;
5916         params.use_short_slot_time = -1;
5917         params.ap_isolate = -1;
5918         params.ht_opmode = -1;
5919         params.p2p_ctwindow = -1;
5920         params.p2p_opp_ps = -1;
5921
5922         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
5923                 params.use_cts_prot =
5924                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
5925         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
5926                 params.use_short_preamble =
5927                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
5928         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
5929                 params.use_short_slot_time =
5930                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
5931         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5932                 params.basic_rates =
5933                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5934                 params.basic_rates_len =
5935                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5936         }
5937         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
5938                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
5939         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
5940                 params.ht_opmode =
5941                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
5942
5943         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
5944                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5945                         return -EINVAL;
5946                 params.p2p_ctwindow =
5947                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
5948                 if (params.p2p_ctwindow != 0 &&
5949                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
5950                         return -EINVAL;
5951         }
5952
5953         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
5954                 u8 tmp;
5955
5956                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5957                         return -EINVAL;
5958                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
5959                 params.p2p_opp_ps = tmp;
5960                 if (params.p2p_opp_ps &&
5961                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
5962                         return -EINVAL;
5963         }
5964
5965         if (!rdev->ops->change_bss)
5966                 return -EOPNOTSUPP;
5967
5968         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5969             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5970                 return -EOPNOTSUPP;
5971
5972         wdev_lock(wdev);
5973         err = rdev_change_bss(rdev, dev, &params);
5974         wdev_unlock(wdev);
5975
5976         return err;
5977 }
5978
5979 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
5980 {
5981         char *data = NULL;
5982         bool is_indoor;
5983         enum nl80211_user_reg_hint_type user_reg_hint_type;
5984         u32 owner_nlportid;
5985
5986         /*
5987          * You should only get this when cfg80211 hasn't yet initialized
5988          * completely when built-in to the kernel right between the time
5989          * window between nl80211_init() and regulatory_init(), if that is
5990          * even possible.
5991          */
5992         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
5993                 return -EINPROGRESS;
5994
5995         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
5996                 user_reg_hint_type =
5997                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
5998         else
5999                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
6000
6001         switch (user_reg_hint_type) {
6002         case NL80211_USER_REG_HINT_USER:
6003         case NL80211_USER_REG_HINT_CELL_BASE:
6004                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6005                         return -EINVAL;
6006
6007                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6008                 return regulatory_hint_user(data, user_reg_hint_type);
6009         case NL80211_USER_REG_HINT_INDOOR:
6010                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
6011                         owner_nlportid = info->snd_portid;
6012                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
6013                 } else {
6014                         owner_nlportid = 0;
6015                         is_indoor = true;
6016                 }
6017
6018                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
6019         default:
6020                 return -EINVAL;
6021         }
6022 }
6023
6024 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
6025 {
6026         return reg_reload_regdb();
6027 }
6028
6029 static int nl80211_get_mesh_config(struct sk_buff *skb,
6030                                    struct genl_info *info)
6031 {
6032         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6033         struct net_device *dev = info->user_ptr[1];
6034         struct wireless_dev *wdev = dev->ieee80211_ptr;
6035         struct mesh_config cur_params;
6036         int err = 0;
6037         void *hdr;
6038         struct nlattr *pinfoattr;
6039         struct sk_buff *msg;
6040
6041         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6042                 return -EOPNOTSUPP;
6043
6044         if (!rdev->ops->get_mesh_config)
6045                 return -EOPNOTSUPP;
6046
6047         wdev_lock(wdev);
6048         /* If not connected, get default parameters */
6049         if (!wdev->mesh_id_len)
6050                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
6051         else
6052                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
6053         wdev_unlock(wdev);
6054
6055         if (err)
6056                 return err;
6057
6058         /* Draw up a netlink message to send back */
6059         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6060         if (!msg)
6061                 return -ENOMEM;
6062         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6063                              NL80211_CMD_GET_MESH_CONFIG);
6064         if (!hdr)
6065                 goto out;
6066         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
6067         if (!pinfoattr)
6068                 goto nla_put_failure;
6069         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6070             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
6071                         cur_params.dot11MeshRetryTimeout) ||
6072             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
6073                         cur_params.dot11MeshConfirmTimeout) ||
6074             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
6075                         cur_params.dot11MeshHoldingTimeout) ||
6076             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
6077                         cur_params.dot11MeshMaxPeerLinks) ||
6078             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
6079                        cur_params.dot11MeshMaxRetries) ||
6080             nla_put_u8(msg, NL80211_MESHCONF_TTL,
6081                        cur_params.dot11MeshTTL) ||
6082             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
6083                        cur_params.element_ttl) ||
6084             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
6085                        cur_params.auto_open_plinks) ||
6086             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
6087                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
6088             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
6089                        cur_params.dot11MeshHWMPmaxPREQretries) ||
6090             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
6091                         cur_params.path_refresh_time) ||
6092             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
6093                         cur_params.min_discovery_timeout) ||
6094             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
6095                         cur_params.dot11MeshHWMPactivePathTimeout) ||
6096             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
6097                         cur_params.dot11MeshHWMPpreqMinInterval) ||
6098             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
6099                         cur_params.dot11MeshHWMPperrMinInterval) ||
6100             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
6101                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
6102             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
6103                        cur_params.dot11MeshHWMPRootMode) ||
6104             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
6105                         cur_params.dot11MeshHWMPRannInterval) ||
6106             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
6107                        cur_params.dot11MeshGateAnnouncementProtocol) ||
6108             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
6109                        cur_params.dot11MeshForwarding) ||
6110             nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
6111                         cur_params.rssi_threshold) ||
6112             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
6113                         cur_params.ht_opmode) ||
6114             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6115                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
6116             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6117                         cur_params.dot11MeshHWMProotInterval) ||
6118             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6119                         cur_params.dot11MeshHWMPconfirmationInterval) ||
6120             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
6121                         cur_params.power_mode) ||
6122             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
6123                         cur_params.dot11MeshAwakeWindowDuration) ||
6124             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
6125                         cur_params.plink_timeout))
6126                 goto nla_put_failure;
6127         nla_nest_end(msg, pinfoattr);
6128         genlmsg_end(msg, hdr);
6129         return genlmsg_reply(msg, info);
6130
6131  nla_put_failure:
6132  out:
6133         nlmsg_free(msg);
6134         return -ENOBUFS;
6135 }
6136
6137 static const struct nla_policy
6138 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
6139         [NL80211_MESHCONF_RETRY_TIMEOUT] =
6140                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
6141         [NL80211_MESHCONF_CONFIRM_TIMEOUT] =
6142                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
6143         [NL80211_MESHCONF_HOLDING_TIMEOUT] =
6144                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
6145         [NL80211_MESHCONF_MAX_PEER_LINKS] =
6146                 NLA_POLICY_RANGE(NLA_U16, 0, 255),
6147         [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
6148         [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
6149         [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
6150         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
6151         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
6152                 NLA_POLICY_RANGE(NLA_U32, 1, 255),
6153         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
6154         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
6155         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
6156         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
6157         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
6158                 NLA_POLICY_MIN(NLA_U16, 1),
6159         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
6160                 NLA_POLICY_MIN(NLA_U16, 1),
6161         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
6162                 NLA_POLICY_MIN(NLA_U16, 1),
6163         [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
6164         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
6165                 NLA_POLICY_MIN(NLA_U16, 1),
6166         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
6167         [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
6168         [NL80211_MESHCONF_RSSI_THRESHOLD] =
6169                 NLA_POLICY_RANGE(NLA_S32, -255, 0),
6170         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
6171         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
6172         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
6173                 NLA_POLICY_MIN(NLA_U16, 1),
6174         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
6175                 NLA_POLICY_MIN(NLA_U16, 1),
6176         [NL80211_MESHCONF_POWER_MODE] =
6177                 NLA_POLICY_RANGE(NLA_U32,
6178                                  NL80211_MESH_POWER_ACTIVE,
6179                                  NL80211_MESH_POWER_MAX),
6180         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
6181         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
6182 };
6183
6184 static const struct nla_policy
6185         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
6186         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
6187         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
6188         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
6189         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
6190         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
6191         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
6192         [NL80211_MESH_SETUP_IE] =
6193                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
6194                                        IEEE80211_MAX_DATA_LEN),
6195         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
6196 };
6197
6198 static int nl80211_parse_mesh_config(struct genl_info *info,
6199                                      struct mesh_config *cfg,
6200                                      u32 *mask_out)
6201 {
6202         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
6203         u32 mask = 0;
6204         u16 ht_opmode;
6205
6206 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn)       \
6207 do {                                                                    \
6208         if (tb[attr]) {                                                 \
6209                 cfg->param = fn(tb[attr]);                              \
6210                 mask |= BIT((attr) - 1);                                \
6211         }                                                               \
6212 } while (0)
6213
6214         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
6215                 return -EINVAL;
6216         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
6217                              info->attrs[NL80211_ATTR_MESH_CONFIG],
6218                              nl80211_meshconf_params_policy, info->extack))
6219                 return -EINVAL;
6220
6221         /* This makes sure that there aren't more than 32 mesh config
6222          * parameters (otherwise our bitfield scheme would not work.) */
6223         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
6224
6225         /* Fill in the params struct */
6226         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
6227                                   NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
6228         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
6229                                   NL80211_MESHCONF_CONFIRM_TIMEOUT,
6230                                   nla_get_u16);
6231         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
6232                                   NL80211_MESHCONF_HOLDING_TIMEOUT,
6233                                   nla_get_u16);
6234         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
6235                                   NL80211_MESHCONF_MAX_PEER_LINKS,
6236                                   nla_get_u16);
6237         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
6238                                   NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
6239         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
6240                                   NL80211_MESHCONF_TTL, nla_get_u8);
6241         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
6242                                   NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
6243         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
6244                                   NL80211_MESHCONF_AUTO_OPEN_PLINKS,
6245                                   nla_get_u8);
6246         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
6247                                   mask,
6248                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
6249                                   nla_get_u32);
6250         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
6251                                   NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
6252                                   nla_get_u8);
6253         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
6254                                   NL80211_MESHCONF_PATH_REFRESH_TIME,
6255                                   nla_get_u32);
6256         if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
6257             (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
6258                 return -EINVAL;
6259         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
6260                                   NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
6261                                   nla_get_u16);
6262         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
6263                                   mask,
6264                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
6265                                   nla_get_u32);
6266         if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
6267             (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
6268              cfg->dot11MeshHWMPactivePathTimeout > 65535))
6269                 return -EINVAL;
6270         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
6271                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
6272                                   nla_get_u16);
6273         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
6274                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
6275                                   nla_get_u16);
6276         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6277                                   dot11MeshHWMPnetDiameterTraversalTime, mask,
6278                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
6279                                   nla_get_u16);
6280         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
6281                                   NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
6282         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
6283                                   NL80211_MESHCONF_HWMP_RANN_INTERVAL,
6284                                   nla_get_u16);
6285         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
6286                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
6287                                   nla_get_u8);
6288         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
6289                                   NL80211_MESHCONF_FORWARDING, nla_get_u8);
6290         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
6291                                   NL80211_MESHCONF_RSSI_THRESHOLD,
6292                                   nla_get_s32);
6293         /*
6294          * Check HT operation mode based on
6295          * IEEE 802.11-2016 9.4.2.57 HT Operation element.
6296          */
6297         if (tb[NL80211_MESHCONF_HT_OPMODE]) {
6298                 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
6299
6300                 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
6301                                   IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
6302                                   IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
6303                         return -EINVAL;
6304
6305                 /* NON_HT_STA bit is reserved, but some programs set it */
6306                 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
6307
6308                 cfg->ht_opmode = ht_opmode;
6309                 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
6310         }
6311         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6312                                   dot11MeshHWMPactivePathToRootTimeout, mask,
6313                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6314                                   nla_get_u32);
6315         if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
6316             (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
6317              cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
6318                 return -EINVAL;
6319         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
6320                                   NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6321                                   nla_get_u16);
6322         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
6323                                   mask,
6324                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6325                                   nla_get_u16);
6326         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
6327                                   NL80211_MESHCONF_POWER_MODE, nla_get_u32);
6328         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
6329                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
6330         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
6331                                   NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
6332         if (mask_out)
6333                 *mask_out = mask;
6334
6335         return 0;
6336
6337 #undef FILL_IN_MESH_PARAM_IF_SET
6338 }
6339
6340 static int nl80211_parse_mesh_setup(struct genl_info *info,
6341                                      struct mesh_setup *setup)
6342 {
6343         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6344         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
6345
6346         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
6347                 return -EINVAL;
6348         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
6349                              info->attrs[NL80211_ATTR_MESH_SETUP],
6350                              nl80211_mesh_setup_params_policy, info->extack))
6351                 return -EINVAL;
6352
6353         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
6354                 setup->sync_method =
6355                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
6356                  IEEE80211_SYNC_METHOD_VENDOR :
6357                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
6358
6359         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
6360                 setup->path_sel_proto =
6361                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
6362                  IEEE80211_PATH_PROTOCOL_VENDOR :
6363                  IEEE80211_PATH_PROTOCOL_HWMP;
6364
6365         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
6366                 setup->path_metric =
6367                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
6368                  IEEE80211_PATH_METRIC_VENDOR :
6369                  IEEE80211_PATH_METRIC_AIRTIME;
6370
6371         if (tb[NL80211_MESH_SETUP_IE]) {
6372                 struct nlattr *ieattr =
6373                         tb[NL80211_MESH_SETUP_IE];
6374                 setup->ie = nla_data(ieattr);
6375                 setup->ie_len = nla_len(ieattr);
6376         }
6377         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
6378             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
6379                 return -EINVAL;
6380         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
6381         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
6382         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
6383         if (setup->is_secure)
6384                 setup->user_mpm = true;
6385
6386         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
6387                 if (!setup->user_mpm)
6388                         return -EINVAL;
6389                 setup->auth_id =
6390                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
6391         }
6392
6393         return 0;
6394 }
6395
6396 static int nl80211_update_mesh_config(struct sk_buff *skb,
6397                                       struct genl_info *info)
6398 {
6399         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6400         struct net_device *dev = info->user_ptr[1];
6401         struct wireless_dev *wdev = dev->ieee80211_ptr;
6402         struct mesh_config cfg;
6403         u32 mask;
6404         int err;
6405
6406         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6407                 return -EOPNOTSUPP;
6408
6409         if (!rdev->ops->update_mesh_config)
6410                 return -EOPNOTSUPP;
6411
6412         err = nl80211_parse_mesh_config(info, &cfg, &mask);
6413         if (err)
6414                 return err;
6415
6416         wdev_lock(wdev);
6417         if (!wdev->mesh_id_len)
6418                 err = -ENOLINK;
6419
6420         if (!err)
6421                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
6422
6423         wdev_unlock(wdev);
6424
6425         return err;
6426 }
6427
6428 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
6429                               struct sk_buff *msg)
6430 {
6431         struct nlattr *nl_reg_rules;
6432         unsigned int i;
6433
6434         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
6435             (regdom->dfs_region &&
6436              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
6437                 goto nla_put_failure;
6438
6439         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
6440         if (!nl_reg_rules)
6441                 goto nla_put_failure;
6442
6443         for (i = 0; i < regdom->n_reg_rules; i++) {
6444                 struct nlattr *nl_reg_rule;
6445                 const struct ieee80211_reg_rule *reg_rule;
6446                 const struct ieee80211_freq_range *freq_range;
6447                 const struct ieee80211_power_rule *power_rule;
6448                 unsigned int max_bandwidth_khz;
6449
6450                 reg_rule = &regdom->reg_rules[i];
6451                 freq_range = &reg_rule->freq_range;
6452                 power_rule = &reg_rule->power_rule;
6453
6454                 nl_reg_rule = nla_nest_start(msg, i);
6455                 if (!nl_reg_rule)
6456                         goto nla_put_failure;
6457
6458                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
6459                 if (!max_bandwidth_khz)
6460                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
6461                                                                   reg_rule);
6462
6463                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
6464                                 reg_rule->flags) ||
6465                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
6466                                 freq_range->start_freq_khz) ||
6467                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
6468                                 freq_range->end_freq_khz) ||
6469                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
6470                                 max_bandwidth_khz) ||
6471                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
6472                                 power_rule->max_antenna_gain) ||
6473                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
6474                                 power_rule->max_eirp) ||
6475                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
6476                                 reg_rule->dfs_cac_ms))
6477                         goto nla_put_failure;
6478
6479                 nla_nest_end(msg, nl_reg_rule);
6480         }
6481
6482         nla_nest_end(msg, nl_reg_rules);
6483         return 0;
6484
6485 nla_put_failure:
6486         return -EMSGSIZE;
6487 }
6488
6489 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
6490 {
6491         const struct ieee80211_regdomain *regdom = NULL;
6492         struct cfg80211_registered_device *rdev;
6493         struct wiphy *wiphy = NULL;
6494         struct sk_buff *msg;
6495         void *hdr;
6496
6497         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6498         if (!msg)
6499                 return -ENOBUFS;
6500
6501         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6502                              NL80211_CMD_GET_REG);
6503         if (!hdr)
6504                 goto put_failure;
6505
6506         if (info->attrs[NL80211_ATTR_WIPHY]) {
6507                 bool self_managed;
6508
6509                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
6510                 if (IS_ERR(rdev)) {
6511                         nlmsg_free(msg);
6512                         return PTR_ERR(rdev);
6513                 }
6514
6515                 wiphy = &rdev->wiphy;
6516                 self_managed = wiphy->regulatory_flags &
6517                                REGULATORY_WIPHY_SELF_MANAGED;
6518                 regdom = get_wiphy_regdom(wiphy);
6519
6520                 /* a self-managed-reg device must have a private regdom */
6521                 if (WARN_ON(!regdom && self_managed)) {
6522                         nlmsg_free(msg);
6523                         return -EINVAL;
6524                 }
6525
6526                 if (regdom &&
6527                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6528                         goto nla_put_failure;
6529         }
6530
6531         if (!wiphy && reg_last_request_cell_base() &&
6532             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6533                         NL80211_USER_REG_HINT_CELL_BASE))
6534                 goto nla_put_failure;
6535
6536         rcu_read_lock();
6537
6538         if (!regdom)
6539                 regdom = rcu_dereference(cfg80211_regdomain);
6540
6541         if (nl80211_put_regdom(regdom, msg))
6542                 goto nla_put_failure_rcu;
6543
6544         rcu_read_unlock();
6545
6546         genlmsg_end(msg, hdr);
6547         return genlmsg_reply(msg, info);
6548
6549 nla_put_failure_rcu:
6550         rcu_read_unlock();
6551 nla_put_failure:
6552 put_failure:
6553         nlmsg_free(msg);
6554         return -EMSGSIZE;
6555 }
6556
6557 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
6558                                u32 seq, int flags, struct wiphy *wiphy,
6559                                const struct ieee80211_regdomain *regdom)
6560 {
6561         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6562                                    NL80211_CMD_GET_REG);
6563
6564         if (!hdr)
6565                 return -1;
6566
6567         genl_dump_check_consistent(cb, hdr);
6568
6569         if (nl80211_put_regdom(regdom, msg))
6570                 goto nla_put_failure;
6571
6572         if (!wiphy && reg_last_request_cell_base() &&
6573             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6574                         NL80211_USER_REG_HINT_CELL_BASE))
6575                 goto nla_put_failure;
6576
6577         if (wiphy &&
6578             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6579                 goto nla_put_failure;
6580
6581         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
6582             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
6583                 goto nla_put_failure;
6584
6585         genlmsg_end(msg, hdr);
6586         return 0;
6587
6588 nla_put_failure:
6589         genlmsg_cancel(msg, hdr);
6590         return -EMSGSIZE;
6591 }
6592
6593 static int nl80211_get_reg_dump(struct sk_buff *skb,
6594                                 struct netlink_callback *cb)
6595 {
6596         const struct ieee80211_regdomain *regdom = NULL;
6597         struct cfg80211_registered_device *rdev;
6598         int err, reg_idx, start = cb->args[2];
6599
6600         rtnl_lock();
6601
6602         if (cfg80211_regdomain && start == 0) {
6603                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6604                                           NLM_F_MULTI, NULL,
6605                                           rtnl_dereference(cfg80211_regdomain));
6606                 if (err < 0)
6607                         goto out_err;
6608         }
6609
6610         /* the global regdom is idx 0 */
6611         reg_idx = 1;
6612         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
6613                 regdom = get_wiphy_regdom(&rdev->wiphy);
6614                 if (!regdom)
6615                         continue;
6616
6617                 if (++reg_idx <= start)
6618                         continue;
6619
6620                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6621                                           NLM_F_MULTI, &rdev->wiphy, regdom);
6622                 if (err < 0) {
6623                         reg_idx--;
6624                         break;
6625                 }
6626         }
6627
6628         cb->args[2] = reg_idx;
6629         err = skb->len;
6630 out_err:
6631         rtnl_unlock();
6632         return err;
6633 }
6634
6635 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
6636 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
6637         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
6638         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
6639         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
6640         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
6641         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
6642         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
6643         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
6644 };
6645
6646 static int parse_reg_rule(struct nlattr *tb[],
6647         struct ieee80211_reg_rule *reg_rule)
6648 {
6649         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
6650         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
6651
6652         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
6653                 return -EINVAL;
6654         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
6655                 return -EINVAL;
6656         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
6657                 return -EINVAL;
6658         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
6659                 return -EINVAL;
6660         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
6661                 return -EINVAL;
6662
6663         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
6664
6665         freq_range->start_freq_khz =
6666                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
6667         freq_range->end_freq_khz =
6668                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
6669         freq_range->max_bandwidth_khz =
6670                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
6671
6672         power_rule->max_eirp =
6673                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
6674
6675         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
6676                 power_rule->max_antenna_gain =
6677                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
6678
6679         if (tb[NL80211_ATTR_DFS_CAC_TIME])
6680                 reg_rule->dfs_cac_ms =
6681                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
6682
6683         return 0;
6684 }
6685
6686 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
6687 {
6688         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
6689         struct nlattr *nl_reg_rule;
6690         char *alpha2;
6691         int rem_reg_rules, r;
6692         u32 num_rules = 0, rule_idx = 0, size_of_regd;
6693         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
6694         struct ieee80211_regdomain *rd;
6695
6696         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6697                 return -EINVAL;
6698
6699         if (!info->attrs[NL80211_ATTR_REG_RULES])
6700                 return -EINVAL;
6701
6702         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6703
6704         if (info->attrs[NL80211_ATTR_DFS_REGION])
6705                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
6706
6707         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6708                             rem_reg_rules) {
6709                 num_rules++;
6710                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
6711                         return -EINVAL;
6712         }
6713
6714         if (!reg_is_valid_request(alpha2))
6715                 return -EINVAL;
6716
6717         size_of_regd = sizeof(struct ieee80211_regdomain) +
6718                        num_rules * sizeof(struct ieee80211_reg_rule);
6719
6720         rd = kzalloc(size_of_regd, GFP_KERNEL);
6721         if (!rd)
6722                 return -ENOMEM;
6723
6724         rd->n_reg_rules = num_rules;
6725         rd->alpha2[0] = alpha2[0];
6726         rd->alpha2[1] = alpha2[1];
6727
6728         /*
6729          * Disable DFS master mode if the DFS region was
6730          * not supported or known on this kernel.
6731          */
6732         if (reg_supported_dfs_region(dfs_region))
6733                 rd->dfs_region = dfs_region;
6734
6735         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6736                             rem_reg_rules) {
6737                 r = nla_parse_nested(tb, NL80211_REG_RULE_ATTR_MAX,
6738                                      nl_reg_rule, reg_rule_policy,
6739                                      info->extack);
6740                 if (r)
6741                         goto bad_reg;
6742                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
6743                 if (r)
6744                         goto bad_reg;
6745
6746                 rule_idx++;
6747
6748                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
6749                         r = -EINVAL;
6750                         goto bad_reg;
6751                 }
6752         }
6753
6754         /* set_regdom takes ownership of rd */
6755         return set_regdom(rd, REGD_SOURCE_CRDA);
6756  bad_reg:
6757         kfree(rd);
6758         return r;
6759 }
6760 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
6761
6762 static int validate_scan_freqs(struct nlattr *freqs)
6763 {
6764         struct nlattr *attr1, *attr2;
6765         int n_channels = 0, tmp1, tmp2;
6766
6767         nla_for_each_nested(attr1, freqs, tmp1)
6768                 if (nla_len(attr1) != sizeof(u32))
6769                         return 0;
6770
6771         nla_for_each_nested(attr1, freqs, tmp1) {
6772                 n_channels++;
6773                 /*
6774                  * Some hardware has a limited channel list for
6775                  * scanning, and it is pretty much nonsensical
6776                  * to scan for a channel twice, so disallow that
6777                  * and don't require drivers to check that the
6778                  * channel list they get isn't longer than what
6779                  * they can scan, as long as they can scan all
6780                  * the channels they registered at once.
6781                  */
6782                 nla_for_each_nested(attr2, freqs, tmp2)
6783                         if (attr1 != attr2 &&
6784                             nla_get_u32(attr1) == nla_get_u32(attr2))
6785                                 return 0;
6786         }
6787
6788         return n_channels;
6789 }
6790
6791 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
6792 {
6793         return b < NUM_NL80211_BANDS && wiphy->bands[b];
6794 }
6795
6796 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
6797                             struct cfg80211_bss_selection *bss_select)
6798 {
6799         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
6800         struct nlattr *nest;
6801         int err;
6802         bool found = false;
6803         int i;
6804
6805         /* only process one nested attribute */
6806         nest = nla_data(nla);
6807         if (!nla_ok(nest, nla_len(nest)))
6808                 return -EINVAL;
6809
6810         err = nla_parse_nested(attr, NL80211_BSS_SELECT_ATTR_MAX, nest,
6811                                nl80211_bss_select_policy, NULL);
6812         if (err)
6813                 return err;
6814
6815         /* only one attribute may be given */
6816         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
6817                 if (attr[i]) {
6818                         if (found)
6819                                 return -EINVAL;
6820                         found = true;
6821                 }
6822         }
6823
6824         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
6825
6826         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
6827                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
6828
6829         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
6830                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
6831                 bss_select->param.band_pref =
6832                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
6833                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
6834                         return -EINVAL;
6835         }
6836
6837         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
6838                 struct nl80211_bss_select_rssi_adjust *adj_param;
6839
6840                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
6841                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
6842                 bss_select->param.adjust.band = adj_param->band;
6843                 bss_select->param.adjust.delta = adj_param->delta;
6844                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
6845                         return -EINVAL;
6846         }
6847
6848         /* user-space did not provide behaviour attribute */
6849         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
6850                 return -EINVAL;
6851
6852         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
6853                 return -EINVAL;
6854
6855         return 0;
6856 }
6857
6858 static int nl80211_parse_random_mac(struct nlattr **attrs,
6859                                     u8 *mac_addr, u8 *mac_addr_mask)
6860 {
6861         int i;
6862
6863         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
6864                 eth_zero_addr(mac_addr);
6865                 eth_zero_addr(mac_addr_mask);
6866                 mac_addr[0] = 0x2;
6867                 mac_addr_mask[0] = 0x3;
6868
6869                 return 0;
6870         }
6871
6872         /* need both or none */
6873         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
6874                 return -EINVAL;
6875
6876         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
6877         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
6878
6879         /* don't allow or configure an mcast address */
6880         if (!is_multicast_ether_addr(mac_addr_mask) ||
6881             is_multicast_ether_addr(mac_addr))
6882                 return -EINVAL;
6883
6884         /*
6885          * allow users to pass a MAC address that has bits set outside
6886          * of the mask, but don't bother drivers with having to deal
6887          * with such bits
6888          */
6889         for (i = 0; i < ETH_ALEN; i++)
6890                 mac_addr[i] &= mac_addr_mask[i];
6891
6892         return 0;
6893 }
6894
6895 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev)
6896 {
6897         ASSERT_WDEV_LOCK(wdev);
6898
6899         if (!cfg80211_beaconing_iface_active(wdev))
6900                 return true;
6901
6902         if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR))
6903                 return true;
6904
6905         return regulatory_pre_cac_allowed(wdev->wiphy);
6906 }
6907
6908 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
6909                                     enum nl80211_ext_feature_index feat)
6910 {
6911         if (!(flags & flag))
6912                 return true;
6913         if (wiphy_ext_feature_isset(wiphy, feat))
6914                 return true;
6915         return false;
6916 }
6917
6918 static int
6919 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
6920                          void *request, struct nlattr **attrs,
6921                          bool is_sched_scan)
6922 {
6923         u8 *mac_addr, *mac_addr_mask;
6924         u32 *flags;
6925         enum nl80211_feature_flags randomness_flag;
6926
6927         if (!attrs[NL80211_ATTR_SCAN_FLAGS])
6928                 return 0;
6929
6930         if (is_sched_scan) {
6931                 struct cfg80211_sched_scan_request *req = request;
6932
6933                 randomness_flag = wdev ?
6934                                   NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
6935                                   NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
6936                 flags = &req->flags;
6937                 mac_addr = req->mac_addr;
6938                 mac_addr_mask = req->mac_addr_mask;
6939         } else {
6940                 struct cfg80211_scan_request *req = request;
6941
6942                 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
6943                 flags = &req->flags;
6944                 mac_addr = req->mac_addr;
6945                 mac_addr_mask = req->mac_addr_mask;
6946         }
6947
6948         *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
6949
6950         if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
6951              !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
6952             !nl80211_check_scan_feat(wiphy, *flags,
6953                                      NL80211_SCAN_FLAG_LOW_SPAN,
6954                                      NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
6955             !nl80211_check_scan_feat(wiphy, *flags,
6956                                      NL80211_SCAN_FLAG_LOW_POWER,
6957                                      NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
6958             !nl80211_check_scan_feat(wiphy, *flags,
6959                                      NL80211_SCAN_FLAG_HIGH_ACCURACY,
6960                                      NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
6961             !nl80211_check_scan_feat(wiphy, *flags,
6962                                      NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
6963                                      NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
6964             !nl80211_check_scan_feat(wiphy, *flags,
6965                                      NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
6966                                      NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
6967             !nl80211_check_scan_feat(wiphy, *flags,
6968                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
6969                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
6970             !nl80211_check_scan_feat(wiphy, *flags,
6971                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
6972                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
6973             !nl80211_check_scan_feat(wiphy, *flags,
6974                                      NL80211_SCAN_FLAG_RANDOM_SN,
6975                                      NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
6976             !nl80211_check_scan_feat(wiphy, *flags,
6977                                      NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
6978                                      NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
6979                 return -EOPNOTSUPP;
6980
6981         if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
6982                 int err;
6983
6984                 if (!(wiphy->features & randomness_flag) ||
6985                     (wdev && wdev->current_bss))
6986                         return -EOPNOTSUPP;
6987
6988                 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
6989                 if (err)
6990                         return err;
6991         }
6992
6993         return 0;
6994 }
6995
6996 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
6997 {
6998         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6999         struct wireless_dev *wdev = info->user_ptr[1];
7000         struct cfg80211_scan_request *request;
7001         struct nlattr *attr;
7002         struct wiphy *wiphy;
7003         int err, tmp, n_ssids = 0, n_channels, i;
7004         size_t ie_len;
7005
7006         wiphy = &rdev->wiphy;
7007
7008         if (wdev->iftype == NL80211_IFTYPE_NAN)
7009                 return -EOPNOTSUPP;
7010
7011         if (!rdev->ops->scan)
7012                 return -EOPNOTSUPP;
7013
7014         if (rdev->scan_req || rdev->scan_msg) {
7015                 err = -EBUSY;
7016                 goto unlock;
7017         }
7018
7019         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7020                 n_channels = validate_scan_freqs(
7021                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7022                 if (!n_channels) {
7023                         err = -EINVAL;
7024                         goto unlock;
7025                 }
7026         } else {
7027                 n_channels = ieee80211_get_num_supported_channels(wiphy);
7028         }
7029
7030         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
7031                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
7032                         n_ssids++;
7033
7034         if (n_ssids > wiphy->max_scan_ssids) {
7035                 err = -EINVAL;
7036                 goto unlock;
7037         }
7038
7039         if (info->attrs[NL80211_ATTR_IE])
7040                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7041         else
7042                 ie_len = 0;
7043
7044         if (ie_len > wiphy->max_scan_ie_len) {
7045                 err = -EINVAL;
7046                 goto unlock;
7047         }
7048
7049         request = kzalloc(sizeof(*request)
7050                         + sizeof(*request->ssids) * n_ssids
7051                         + sizeof(*request->channels) * n_channels
7052                         + ie_len, GFP_KERNEL);
7053         if (!request) {
7054                 err = -ENOMEM;
7055                 goto unlock;
7056         }
7057
7058         if (n_ssids)
7059                 request->ssids = (void *)&request->channels[n_channels];
7060         request->n_ssids = n_ssids;
7061         if (ie_len) {
7062                 if (n_ssids)
7063                         request->ie = (void *)(request->ssids + n_ssids);
7064                 else
7065                         request->ie = (void *)(request->channels + n_channels);
7066         }
7067
7068         i = 0;
7069         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7070                 /* user specified, bail out if channel not found */
7071                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
7072                         struct ieee80211_channel *chan;
7073
7074                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7075
7076                         if (!chan) {
7077                                 err = -EINVAL;
7078                                 goto out_free;
7079                         }
7080
7081                         /* ignore disabled channels */
7082                         if (chan->flags & IEEE80211_CHAN_DISABLED)
7083                                 continue;
7084
7085                         request->channels[i] = chan;
7086                         i++;
7087                 }
7088         } else {
7089                 enum nl80211_band band;
7090
7091                 /* all channels */
7092                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7093                         int j;
7094
7095                         if (!wiphy->bands[band])
7096                                 continue;
7097                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7098                                 struct ieee80211_channel *chan;
7099
7100                                 chan = &wiphy->bands[band]->channels[j];
7101
7102                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
7103                                         continue;
7104
7105                                 request->channels[i] = chan;
7106                                 i++;
7107                         }
7108                 }
7109         }
7110
7111         if (!i) {
7112                 err = -EINVAL;
7113                 goto out_free;
7114         }
7115
7116         request->n_channels = i;
7117
7118         wdev_lock(wdev);
7119         if (!cfg80211_off_channel_oper_allowed(wdev)) {
7120                 struct ieee80211_channel *chan;
7121
7122                 if (request->n_channels != 1) {
7123                         wdev_unlock(wdev);
7124                         err = -EBUSY;
7125                         goto out_free;
7126                 }
7127
7128                 chan = request->channels[0];
7129                 if (chan->center_freq != wdev->chandef.chan->center_freq) {
7130                         wdev_unlock(wdev);
7131                         err = -EBUSY;
7132                         goto out_free;
7133                 }
7134         }
7135         wdev_unlock(wdev);
7136
7137         i = 0;
7138         if (n_ssids) {
7139                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
7140                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7141                                 err = -EINVAL;
7142                                 goto out_free;
7143                         }
7144                         request->ssids[i].ssid_len = nla_len(attr);
7145                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
7146                         i++;
7147                 }
7148         }
7149
7150         if (info->attrs[NL80211_ATTR_IE]) {
7151                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7152                 memcpy((void *)request->ie,
7153                        nla_data(info->attrs[NL80211_ATTR_IE]),
7154                        request->ie_len);
7155         }
7156
7157         for (i = 0; i < NUM_NL80211_BANDS; i++)
7158                 if (wiphy->bands[i])
7159                         request->rates[i] =
7160                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
7161
7162         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
7163                 nla_for_each_nested(attr,
7164                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
7165                                     tmp) {
7166                         enum nl80211_band band = nla_type(attr);
7167
7168                         if (band < 0 || band >= NUM_NL80211_BANDS) {
7169                                 err = -EINVAL;
7170                                 goto out_free;
7171                         }
7172
7173                         if (!wiphy->bands[band])
7174                                 continue;
7175
7176                         err = ieee80211_get_ratemask(wiphy->bands[band],
7177                                                      nla_data(attr),
7178                                                      nla_len(attr),
7179                                                      &request->rates[band]);
7180                         if (err)
7181                                 goto out_free;
7182                 }
7183         }
7184
7185         if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
7186                 if (!wiphy_ext_feature_isset(wiphy,
7187                                         NL80211_EXT_FEATURE_SET_SCAN_DWELL)) {
7188                         err = -EOPNOTSUPP;
7189                         goto out_free;
7190                 }
7191
7192                 request->duration =
7193                         nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
7194                 request->duration_mandatory =
7195                         nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
7196         }
7197
7198         err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
7199                                        false);
7200         if (err)
7201                 goto out_free;
7202
7203         request->no_cck =
7204                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7205
7206         /* Initial implementation used NL80211_ATTR_MAC to set the specific
7207          * BSSID to scan for. This was problematic because that same attribute
7208          * was already used for another purpose (local random MAC address). The
7209          * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
7210          * compatibility with older userspace components, also use the
7211          * NL80211_ATTR_MAC value here if it can be determined to be used for
7212          * the specific BSSID use case instead of the random MAC address
7213          * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
7214          */
7215         if (info->attrs[NL80211_ATTR_BSSID])
7216                 memcpy(request->bssid,
7217                        nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
7218         else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
7219                  info->attrs[NL80211_ATTR_MAC])
7220                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
7221                        ETH_ALEN);
7222         else
7223                 eth_broadcast_addr(request->bssid);
7224
7225         request->wdev = wdev;
7226         request->wiphy = &rdev->wiphy;
7227         request->scan_start = jiffies;
7228
7229         rdev->scan_req = request;
7230         err = rdev_scan(rdev, request);
7231
7232         if (!err) {
7233                 nl80211_send_scan_start(rdev, wdev);
7234                 if (wdev->netdev)
7235                         dev_hold(wdev->netdev);
7236         } else {
7237  out_free:
7238                 rdev->scan_req = NULL;
7239                 kfree(request);
7240         }
7241
7242  unlock:
7243         return err;
7244 }
7245
7246 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
7247 {
7248         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7249         struct wireless_dev *wdev = info->user_ptr[1];
7250
7251         if (!rdev->ops->abort_scan)
7252                 return -EOPNOTSUPP;
7253
7254         if (rdev->scan_msg)
7255                 return 0;
7256
7257         if (!rdev->scan_req)
7258                 return -ENOENT;
7259
7260         rdev_abort_scan(rdev, wdev);
7261         return 0;
7262 }
7263
7264 static int
7265 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
7266                                struct cfg80211_sched_scan_request *request,
7267                                struct nlattr **attrs)
7268 {
7269         int tmp, err, i = 0;
7270         struct nlattr *attr;
7271
7272         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7273                 u32 interval;
7274
7275                 /*
7276                  * If scan plans are not specified,
7277                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
7278                  * case one scan plan will be set with the specified scan
7279                  * interval and infinite number of iterations.
7280                  */
7281                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
7282                 if (!interval)
7283                         return -EINVAL;
7284
7285                 request->scan_plans[0].interval =
7286                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
7287                 if (!request->scan_plans[0].interval)
7288                         return -EINVAL;
7289
7290                 if (request->scan_plans[0].interval >
7291                     wiphy->max_sched_scan_plan_interval)
7292                         request->scan_plans[0].interval =
7293                                 wiphy->max_sched_scan_plan_interval;
7294
7295                 return 0;
7296         }
7297
7298         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
7299                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
7300
7301                 if (WARN_ON(i >= n_plans))
7302                         return -EINVAL;
7303
7304                 err = nla_parse_nested(plan, NL80211_SCHED_SCAN_PLAN_MAX,
7305                                        attr, nl80211_plan_policy, NULL);
7306                 if (err)
7307                         return err;
7308
7309                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
7310                         return -EINVAL;
7311
7312                 request->scan_plans[i].interval =
7313                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
7314                 if (!request->scan_plans[i].interval ||
7315                     request->scan_plans[i].interval >
7316                     wiphy->max_sched_scan_plan_interval)
7317                         return -EINVAL;
7318
7319                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
7320                         request->scan_plans[i].iterations =
7321                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
7322                         if (!request->scan_plans[i].iterations ||
7323                             (request->scan_plans[i].iterations >
7324                              wiphy->max_sched_scan_plan_iterations))
7325                                 return -EINVAL;
7326                 } else if (i < n_plans - 1) {
7327                         /*
7328                          * All scan plans but the last one must specify
7329                          * a finite number of iterations
7330                          */
7331                         return -EINVAL;
7332                 }
7333
7334                 i++;
7335         }
7336
7337         /*
7338          * The last scan plan must not specify the number of
7339          * iterations, it is supposed to run infinitely
7340          */
7341         if (request->scan_plans[n_plans - 1].iterations)
7342                 return  -EINVAL;
7343
7344         return 0;
7345 }
7346
7347 static struct cfg80211_sched_scan_request *
7348 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
7349                          struct nlattr **attrs, int max_match_sets)
7350 {
7351         struct cfg80211_sched_scan_request *request;
7352         struct nlattr *attr;
7353         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
7354         enum nl80211_band band;
7355         size_t ie_len;
7356         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
7357         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
7358
7359         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7360                 n_channels = validate_scan_freqs(
7361                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7362                 if (!n_channels)
7363                         return ERR_PTR(-EINVAL);
7364         } else {
7365                 n_channels = ieee80211_get_num_supported_channels(wiphy);
7366         }
7367
7368         if (attrs[NL80211_ATTR_SCAN_SSIDS])
7369                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7370                                     tmp)
7371                         n_ssids++;
7372
7373         if (n_ssids > wiphy->max_sched_scan_ssids)
7374                 return ERR_PTR(-EINVAL);
7375
7376         /*
7377          * First, count the number of 'real' matchsets. Due to an issue with
7378          * the old implementation, matchsets containing only the RSSI attribute
7379          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
7380          * RSSI for all matchsets, rather than their own matchset for reporting
7381          * all APs with a strong RSSI. This is needed to be compatible with
7382          * older userspace that treated a matchset with only the RSSI as the
7383          * global RSSI for all other matchsets - if there are other matchsets.
7384          */
7385         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7386                 nla_for_each_nested(attr,
7387                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7388                                     tmp) {
7389                         struct nlattr *rssi;
7390
7391                         err = nla_parse_nested(tb,
7392                                                NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7393                                                attr, nl80211_match_policy,
7394                                                NULL);
7395                         if (err)
7396                                 return ERR_PTR(err);
7397
7398                         /* SSID and BSSID are mutually exclusive */
7399                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
7400                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
7401                                 return ERR_PTR(-EINVAL);
7402
7403                         /* add other standalone attributes here */
7404                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
7405                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
7406                                 n_match_sets++;
7407                                 continue;
7408                         }
7409                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7410                         if (rssi)
7411                                 default_match_rssi = nla_get_s32(rssi);
7412                 }
7413         }
7414
7415         /* However, if there's no other matchset, add the RSSI one */
7416         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
7417                 n_match_sets = 1;
7418
7419         if (n_match_sets > max_match_sets)
7420                 return ERR_PTR(-EINVAL);
7421
7422         if (attrs[NL80211_ATTR_IE])
7423                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
7424         else
7425                 ie_len = 0;
7426
7427         if (ie_len > wiphy->max_sched_scan_ie_len)
7428                 return ERR_PTR(-EINVAL);
7429
7430         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7431                 /*
7432                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
7433                  * each scan plan already specifies its own interval
7434                  */
7435                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7436                         return ERR_PTR(-EINVAL);
7437
7438                 nla_for_each_nested(attr,
7439                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
7440                         n_plans++;
7441         } else {
7442                 /*
7443                  * The scan interval attribute is kept for backward
7444                  * compatibility. If no scan plans are specified and sched scan
7445                  * interval is specified, one scan plan will be set with this
7446                  * scan interval and infinite number of iterations.
7447                  */
7448                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7449                         return ERR_PTR(-EINVAL);
7450
7451                 n_plans = 1;
7452         }
7453
7454         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
7455                 return ERR_PTR(-EINVAL);
7456
7457         if (!wiphy_ext_feature_isset(
7458                     wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
7459             (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
7460              attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
7461                 return ERR_PTR(-EINVAL);
7462
7463         request = kzalloc(sizeof(*request)
7464                         + sizeof(*request->ssids) * n_ssids
7465                         + sizeof(*request->match_sets) * n_match_sets
7466                         + sizeof(*request->scan_plans) * n_plans
7467                         + sizeof(*request->channels) * n_channels
7468                         + ie_len, GFP_KERNEL);
7469         if (!request)
7470                 return ERR_PTR(-ENOMEM);
7471
7472         if (n_ssids)
7473                 request->ssids = (void *)&request->channels[n_channels];
7474         request->n_ssids = n_ssids;
7475         if (ie_len) {
7476                 if (n_ssids)
7477                         request->ie = (void *)(request->ssids + n_ssids);
7478                 else
7479                         request->ie = (void *)(request->channels + n_channels);
7480         }
7481
7482         if (n_match_sets) {
7483                 if (request->ie)
7484                         request->match_sets = (void *)(request->ie + ie_len);
7485                 else if (n_ssids)
7486                         request->match_sets =
7487                                 (void *)(request->ssids + n_ssids);
7488                 else
7489                         request->match_sets =
7490                                 (void *)(request->channels + n_channels);
7491         }
7492         request->n_match_sets = n_match_sets;
7493
7494         if (n_match_sets)
7495                 request->scan_plans = (void *)(request->match_sets +
7496                                                n_match_sets);
7497         else if (request->ie)
7498                 request->scan_plans = (void *)(request->ie + ie_len);
7499         else if (n_ssids)
7500                 request->scan_plans = (void *)(request->ssids + n_ssids);
7501         else
7502                 request->scan_plans = (void *)(request->channels + n_channels);
7503
7504         request->n_scan_plans = n_plans;
7505
7506         i = 0;
7507         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7508                 /* user specified, bail out if channel not found */
7509                 nla_for_each_nested(attr,
7510                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
7511                                     tmp) {
7512                         struct ieee80211_channel *chan;
7513
7514                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7515
7516                         if (!chan) {
7517                                 err = -EINVAL;
7518                                 goto out_free;
7519                         }
7520
7521                         /* ignore disabled channels */
7522                         if (chan->flags & IEEE80211_CHAN_DISABLED)
7523                                 continue;
7524
7525                         request->channels[i] = chan;
7526                         i++;
7527                 }
7528         } else {
7529                 /* all channels */
7530                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7531                         int j;
7532
7533                         if (!wiphy->bands[band])
7534                                 continue;
7535                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7536                                 struct ieee80211_channel *chan;
7537
7538                                 chan = &wiphy->bands[band]->channels[j];
7539
7540                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
7541                                         continue;
7542
7543                                 request->channels[i] = chan;
7544                                 i++;
7545                         }
7546                 }
7547         }
7548
7549         if (!i) {
7550                 err = -EINVAL;
7551                 goto out_free;
7552         }
7553
7554         request->n_channels = i;
7555
7556         i = 0;
7557         if (n_ssids) {
7558                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7559                                     tmp) {
7560                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7561                                 err = -EINVAL;
7562                                 goto out_free;
7563                         }
7564                         request->ssids[i].ssid_len = nla_len(attr);
7565                         memcpy(request->ssids[i].ssid, nla_data(attr),
7566                                nla_len(attr));
7567                         i++;
7568                 }
7569         }
7570
7571         i = 0;
7572         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7573                 nla_for_each_nested(attr,
7574                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7575                                     tmp) {
7576                         struct nlattr *ssid, *bssid, *rssi;
7577
7578                         err = nla_parse_nested(tb,
7579                                                NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7580                                                attr, nl80211_match_policy,
7581                                                NULL);
7582                         if (err)
7583                                 goto out_free;
7584                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
7585                         bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
7586                         if (ssid || bssid) {
7587                                 if (WARN_ON(i >= n_match_sets)) {
7588                                         /* this indicates a programming error,
7589                                          * the loop above should have verified
7590                                          * things properly
7591                                          */
7592                                         err = -EINVAL;
7593                                         goto out_free;
7594                                 }
7595
7596                                 if (ssid) {
7597                                         if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
7598                                                 err = -EINVAL;
7599                                                 goto out_free;
7600                                         }
7601                                         memcpy(request->match_sets[i].ssid.ssid,
7602                                                nla_data(ssid), nla_len(ssid));
7603                                         request->match_sets[i].ssid.ssid_len =
7604                                                 nla_len(ssid);
7605                                 }
7606                                 if (bssid) {
7607                                         if (nla_len(bssid) != ETH_ALEN) {
7608                                                 err = -EINVAL;
7609                                                 goto out_free;
7610                                         }
7611                                         memcpy(request->match_sets[i].bssid,
7612                                                nla_data(bssid), ETH_ALEN);
7613                                 }
7614
7615                                 /* special attribute - old implementation w/a */
7616                                 request->match_sets[i].rssi_thold =
7617                                         default_match_rssi;
7618                                 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7619                                 if (rssi)
7620                                         request->match_sets[i].rssi_thold =
7621                                                 nla_get_s32(rssi);
7622                         }
7623                         i++;
7624                 }
7625
7626                 /* there was no other matchset, so the RSSI one is alone */
7627                 if (i == 0 && n_match_sets)
7628                         request->match_sets[0].rssi_thold = default_match_rssi;
7629
7630                 request->min_rssi_thold = INT_MAX;
7631                 for (i = 0; i < n_match_sets; i++)
7632                         request->min_rssi_thold =
7633                                 min(request->match_sets[i].rssi_thold,
7634                                     request->min_rssi_thold);
7635         } else {
7636                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
7637         }
7638
7639         if (ie_len) {
7640                 request->ie_len = ie_len;
7641                 memcpy((void *)request->ie,
7642                        nla_data(attrs[NL80211_ATTR_IE]),
7643                        request->ie_len);
7644         }
7645
7646         err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
7647         if (err)
7648                 goto out_free;
7649
7650         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
7651                 request->delay =
7652                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
7653
7654         if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
7655                 request->relative_rssi = nla_get_s8(
7656                         attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
7657                 request->relative_rssi_set = true;
7658         }
7659
7660         if (request->relative_rssi_set &&
7661             attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
7662                 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
7663
7664                 rssi_adjust = nla_data(
7665                         attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
7666                 request->rssi_adjust.band = rssi_adjust->band;
7667                 request->rssi_adjust.delta = rssi_adjust->delta;
7668                 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
7669                         err = -EINVAL;
7670                         goto out_free;
7671                 }
7672         }
7673
7674         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
7675         if (err)
7676                 goto out_free;
7677
7678         request->scan_start = jiffies;
7679
7680         return request;
7681
7682 out_free:
7683         kfree(request);
7684         return ERR_PTR(err);
7685 }
7686
7687 static int nl80211_start_sched_scan(struct sk_buff *skb,
7688                                     struct genl_info *info)
7689 {
7690         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7691         struct net_device *dev = info->user_ptr[1];
7692         struct wireless_dev *wdev = dev->ieee80211_ptr;
7693         struct cfg80211_sched_scan_request *sched_scan_req;
7694         bool want_multi;
7695         int err;
7696
7697         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
7698                 return -EOPNOTSUPP;
7699
7700         want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
7701         err = cfg80211_sched_scan_req_possible(rdev, want_multi);
7702         if (err)
7703                 return err;
7704
7705         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
7706                                                   info->attrs,
7707                                                   rdev->wiphy.max_match_sets);
7708
7709         err = PTR_ERR_OR_ZERO(sched_scan_req);
7710         if (err)
7711                 goto out_err;
7712
7713         /* leave request id zero for legacy request
7714          * or if driver does not support multi-scheduled scan
7715          */
7716         if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1) {
7717                 while (!sched_scan_req->reqid)
7718                         sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
7719         }
7720
7721         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
7722         if (err)
7723                 goto out_free;
7724
7725         sched_scan_req->dev = dev;
7726         sched_scan_req->wiphy = &rdev->wiphy;
7727
7728         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
7729                 sched_scan_req->owner_nlportid = info->snd_portid;
7730
7731         cfg80211_add_sched_scan_req(rdev, sched_scan_req);
7732
7733         nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
7734         return 0;
7735
7736 out_free:
7737         kfree(sched_scan_req);
7738 out_err:
7739         return err;
7740 }
7741
7742 static int nl80211_stop_sched_scan(struct sk_buff *skb,
7743                                    struct genl_info *info)
7744 {
7745         struct cfg80211_sched_scan_request *req;
7746         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7747         u64 cookie;
7748
7749         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
7750                 return -EOPNOTSUPP;
7751
7752         if (info->attrs[NL80211_ATTR_COOKIE]) {
7753                 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7754                 return __cfg80211_stop_sched_scan(rdev, cookie, false);
7755         }
7756
7757         req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
7758                                      struct cfg80211_sched_scan_request,
7759                                      list);
7760         if (!req || req->reqid ||
7761             (req->owner_nlportid &&
7762              req->owner_nlportid != info->snd_portid))
7763                 return -ENOENT;
7764
7765         return cfg80211_stop_sched_scan_req(rdev, req, false);
7766 }
7767
7768 static int nl80211_start_radar_detection(struct sk_buff *skb,
7769                                          struct genl_info *info)
7770 {
7771         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7772         struct net_device *dev = info->user_ptr[1];
7773         struct wireless_dev *wdev = dev->ieee80211_ptr;
7774         struct wiphy *wiphy = wdev->wiphy;
7775         struct cfg80211_chan_def chandef;
7776         enum nl80211_dfs_regions dfs_region;
7777         unsigned int cac_time_ms;
7778         int err;
7779
7780         dfs_region = reg_get_dfs_region(wiphy);
7781         if (dfs_region == NL80211_DFS_UNSET)
7782                 return -EINVAL;
7783
7784         err = nl80211_parse_chandef(rdev, info, &chandef);
7785         if (err)
7786                 return err;
7787
7788         if (netif_carrier_ok(dev))
7789                 return -EBUSY;
7790
7791         if (wdev->cac_started)
7792                 return -EBUSY;
7793
7794         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
7795         if (err < 0)
7796                 return err;
7797
7798         if (err == 0)
7799                 return -EINVAL;
7800
7801         if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
7802                 return -EINVAL;
7803
7804         /* CAC start is offloaded to HW and can't be started manually */
7805         if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
7806                 return -EOPNOTSUPP;
7807
7808         if (!rdev->ops->start_radar_detection)
7809                 return -EOPNOTSUPP;
7810
7811         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
7812         if (WARN_ON(!cac_time_ms))
7813                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
7814
7815         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
7816         if (!err) {
7817                 wdev->chandef = chandef;
7818                 wdev->cac_started = true;
7819                 wdev->cac_start_time = jiffies;
7820                 wdev->cac_time_ms = cac_time_ms;
7821         }
7822         return err;
7823 }
7824
7825 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
7826 {
7827         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7828         struct net_device *dev = info->user_ptr[1];
7829         struct wireless_dev *wdev = dev->ieee80211_ptr;
7830         struct cfg80211_csa_settings params;
7831         /* csa_attrs is defined static to avoid waste of stack size - this
7832          * function is called under RTNL lock, so this should not be a problem.
7833          */
7834         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
7835         int err;
7836         bool need_new_beacon = false;
7837         bool need_handle_dfs_flag = true;
7838         int len, i;
7839         u32 cs_count;
7840
7841         if (!rdev->ops->channel_switch ||
7842             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
7843                 return -EOPNOTSUPP;
7844
7845         switch (dev->ieee80211_ptr->iftype) {
7846         case NL80211_IFTYPE_AP:
7847         case NL80211_IFTYPE_P2P_GO:
7848                 need_new_beacon = true;
7849                 /* For all modes except AP the handle_dfs flag needs to be
7850                  * supplied to tell the kernel that userspace will handle radar
7851                  * events when they happen. Otherwise a switch to a channel
7852                  * requiring DFS will be rejected.
7853                  */
7854                 need_handle_dfs_flag = false;
7855
7856                 /* useless if AP is not running */
7857                 if (!wdev->beacon_interval)
7858                         return -ENOTCONN;
7859                 break;
7860         case NL80211_IFTYPE_ADHOC:
7861                 if (!wdev->ssid_len)
7862                         return -ENOTCONN;
7863                 break;
7864         case NL80211_IFTYPE_MESH_POINT:
7865                 if (!wdev->mesh_id_len)
7866                         return -ENOTCONN;
7867                 break;
7868         default:
7869                 return -EOPNOTSUPP;
7870         }
7871
7872         memset(&params, 0, sizeof(params));
7873
7874         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7875             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
7876                 return -EINVAL;
7877
7878         /* only important for AP, IBSS and mesh create IEs internally */
7879         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
7880                 return -EINVAL;
7881
7882         /* Even though the attribute is u32, the specification says
7883          * u8, so let's make sure we don't overflow.
7884          */
7885         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
7886         if (cs_count > 255)
7887                 return -EINVAL;
7888
7889         params.count = cs_count;
7890
7891         if (!need_new_beacon)
7892                 goto skip_beacons;
7893
7894         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_after);
7895         if (err)
7896                 return err;
7897
7898         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
7899                                info->attrs[NL80211_ATTR_CSA_IES],
7900                                nl80211_policy, info->extack);
7901         if (err)
7902                 return err;
7903
7904         err = nl80211_parse_beacon(rdev, csa_attrs, &params.beacon_csa);
7905         if (err)
7906                 return err;
7907
7908         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
7909                 return -EINVAL;
7910
7911         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7912         if (!len || (len % sizeof(u16)))
7913                 return -EINVAL;
7914
7915         params.n_counter_offsets_beacon = len / sizeof(u16);
7916         if (rdev->wiphy.max_num_csa_counters &&
7917             (params.n_counter_offsets_beacon >
7918              rdev->wiphy.max_num_csa_counters))
7919                 return -EINVAL;
7920
7921         params.counter_offsets_beacon =
7922                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7923
7924         /* sanity checks - counters should fit and be the same */
7925         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
7926                 u16 offset = params.counter_offsets_beacon[i];
7927
7928                 if (offset >= params.beacon_csa.tail_len)
7929                         return -EINVAL;
7930
7931                 if (params.beacon_csa.tail[offset] != params.count)
7932                         return -EINVAL;
7933         }
7934
7935         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
7936                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7937                 if (!len || (len % sizeof(u16)))
7938                         return -EINVAL;
7939
7940                 params.n_counter_offsets_presp = len / sizeof(u16);
7941                 if (rdev->wiphy.max_num_csa_counters &&
7942                     (params.n_counter_offsets_presp >
7943                      rdev->wiphy.max_num_csa_counters))
7944                         return -EINVAL;
7945
7946                 params.counter_offsets_presp =
7947                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7948
7949                 /* sanity checks - counters should fit and be the same */
7950                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
7951                         u16 offset = params.counter_offsets_presp[i];
7952
7953                         if (offset >= params.beacon_csa.probe_resp_len)
7954                                 return -EINVAL;
7955
7956                         if (params.beacon_csa.probe_resp[offset] !=
7957                             params.count)
7958                                 return -EINVAL;
7959                 }
7960         }
7961
7962 skip_beacons:
7963         err = nl80211_parse_chandef(rdev, info, &params.chandef);
7964         if (err)
7965                 return err;
7966
7967         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
7968                                            wdev->iftype))
7969                 return -EINVAL;
7970
7971         err = cfg80211_chandef_dfs_required(wdev->wiphy,
7972                                             &params.chandef,
7973                                             wdev->iftype);
7974         if (err < 0)
7975                 return err;
7976
7977         if (err > 0) {
7978                 params.radar_required = true;
7979                 if (need_handle_dfs_flag &&
7980                     !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
7981                         return -EINVAL;
7982                 }
7983         }
7984
7985         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
7986                 params.block_tx = true;
7987
7988         wdev_lock(wdev);
7989         err = rdev_channel_switch(rdev, dev, &params);
7990         wdev_unlock(wdev);
7991
7992         return err;
7993 }
7994
7995 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
7996                             u32 seq, int flags,
7997                             struct cfg80211_registered_device *rdev,
7998                             struct wireless_dev *wdev,
7999                             struct cfg80211_internal_bss *intbss)
8000 {
8001         struct cfg80211_bss *res = &intbss->pub;
8002         const struct cfg80211_bss_ies *ies;
8003         void *hdr;
8004         struct nlattr *bss;
8005
8006         ASSERT_WDEV_LOCK(wdev);
8007
8008         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
8009                              NL80211_CMD_NEW_SCAN_RESULTS);
8010         if (!hdr)
8011                 return -1;
8012
8013         genl_dump_check_consistent(cb, hdr);
8014
8015         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
8016                 goto nla_put_failure;
8017         if (wdev->netdev &&
8018             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
8019                 goto nla_put_failure;
8020         if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
8021                               NL80211_ATTR_PAD))
8022                 goto nla_put_failure;
8023
8024         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
8025         if (!bss)
8026                 goto nla_put_failure;
8027         if ((!is_zero_ether_addr(res->bssid) &&
8028              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
8029                 goto nla_put_failure;
8030
8031         rcu_read_lock();
8032         /* indicate whether we have probe response data or not */
8033         if (rcu_access_pointer(res->proberesp_ies) &&
8034             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
8035                 goto fail_unlock_rcu;
8036
8037         /* this pointer prefers to be pointed to probe response data
8038          * but is always valid
8039          */
8040         ies = rcu_dereference(res->ies);
8041         if (ies) {
8042                 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
8043                                       NL80211_BSS_PAD))
8044                         goto fail_unlock_rcu;
8045                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
8046                                         ies->len, ies->data))
8047                         goto fail_unlock_rcu;
8048         }
8049
8050         /* and this pointer is always (unless driver didn't know) beacon data */
8051         ies = rcu_dereference(res->beacon_ies);
8052         if (ies && ies->from_beacon) {
8053                 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
8054                                       NL80211_BSS_PAD))
8055                         goto fail_unlock_rcu;
8056                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
8057                                         ies->len, ies->data))
8058                         goto fail_unlock_rcu;
8059         }
8060         rcu_read_unlock();
8061
8062         if (res->beacon_interval &&
8063             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
8064                 goto nla_put_failure;
8065         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
8066             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
8067             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
8068             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
8069                         jiffies_to_msecs(jiffies - intbss->ts)))
8070                 goto nla_put_failure;
8071
8072         if (intbss->parent_tsf &&
8073             (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
8074                                intbss->parent_tsf, NL80211_BSS_PAD) ||
8075              nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
8076                      intbss->parent_bssid)))
8077                 goto nla_put_failure;
8078
8079         if (intbss->ts_boottime &&
8080             nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
8081                               intbss->ts_boottime, NL80211_BSS_PAD))
8082                 goto nla_put_failure;
8083
8084         if (!nl80211_put_signal(msg, intbss->pub.chains,
8085                                 intbss->pub.chain_signal,
8086                                 NL80211_BSS_CHAIN_SIGNAL))
8087                 goto nla_put_failure;
8088
8089         switch (rdev->wiphy.signal_type) {
8090         case CFG80211_SIGNAL_TYPE_MBM:
8091                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
8092                         goto nla_put_failure;
8093                 break;
8094         case CFG80211_SIGNAL_TYPE_UNSPEC:
8095                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
8096                         goto nla_put_failure;
8097                 break;
8098         default:
8099                 break;
8100         }
8101
8102         switch (wdev->iftype) {
8103         case NL80211_IFTYPE_P2P_CLIENT:
8104         case NL80211_IFTYPE_STATION:
8105                 if (intbss == wdev->current_bss &&
8106                     nla_put_u32(msg, NL80211_BSS_STATUS,
8107                                 NL80211_BSS_STATUS_ASSOCIATED))
8108                         goto nla_put_failure;
8109                 break;
8110         case NL80211_IFTYPE_ADHOC:
8111                 if (intbss == wdev->current_bss &&
8112                     nla_put_u32(msg, NL80211_BSS_STATUS,
8113                                 NL80211_BSS_STATUS_IBSS_JOINED))
8114                         goto nla_put_failure;
8115                 break;
8116         default:
8117                 break;
8118         }
8119
8120         nla_nest_end(msg, bss);
8121
8122         genlmsg_end(msg, hdr);
8123         return 0;
8124
8125  fail_unlock_rcu:
8126         rcu_read_unlock();
8127  nla_put_failure:
8128         genlmsg_cancel(msg, hdr);
8129         return -EMSGSIZE;
8130 }
8131
8132 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
8133 {
8134         struct cfg80211_registered_device *rdev;
8135         struct cfg80211_internal_bss *scan;
8136         struct wireless_dev *wdev;
8137         int start = cb->args[2], idx = 0;
8138         int err;
8139
8140         rtnl_lock();
8141         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
8142         if (err) {
8143                 rtnl_unlock();
8144                 return err;
8145         }
8146
8147         wdev_lock(wdev);
8148         spin_lock_bh(&rdev->bss_lock);
8149
8150         /*
8151          * dump_scan will be called multiple times to break up the scan results
8152          * into multiple messages.  It is unlikely that any more bss-es will be
8153          * expired after the first call, so only call only call this on the
8154          * first dump_scan invocation.
8155          */
8156         if (start == 0)
8157                 cfg80211_bss_expire(rdev);
8158
8159         cb->seq = rdev->bss_generation;
8160
8161         list_for_each_entry(scan, &rdev->bss_list, list) {
8162                 if (++idx <= start)
8163                         continue;
8164                 if (nl80211_send_bss(skb, cb,
8165                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8166                                 rdev, wdev, scan) < 0) {
8167                         idx--;
8168                         break;
8169                 }
8170         }
8171
8172         spin_unlock_bh(&rdev->bss_lock);
8173         wdev_unlock(wdev);
8174
8175         cb->args[2] = idx;
8176         rtnl_unlock();
8177
8178         return skb->len;
8179 }
8180
8181 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
8182                                int flags, struct net_device *dev,
8183                                bool allow_radio_stats,
8184                                struct survey_info *survey)
8185 {
8186         void *hdr;
8187         struct nlattr *infoattr;
8188
8189         /* skip radio stats if userspace didn't request them */
8190         if (!survey->channel && !allow_radio_stats)
8191                 return 0;
8192
8193         hdr = nl80211hdr_put(msg, portid, seq, flags,
8194                              NL80211_CMD_NEW_SURVEY_RESULTS);
8195         if (!hdr)
8196                 return -ENOMEM;
8197
8198         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
8199                 goto nla_put_failure;
8200
8201         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
8202         if (!infoattr)
8203                 goto nla_put_failure;
8204
8205         if (survey->channel &&
8206             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
8207                         survey->channel->center_freq))
8208                 goto nla_put_failure;
8209
8210         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
8211             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
8212                 goto nla_put_failure;
8213         if ((survey->filled & SURVEY_INFO_IN_USE) &&
8214             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
8215                 goto nla_put_failure;
8216         if ((survey->filled & SURVEY_INFO_TIME) &&
8217             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
8218                         survey->time, NL80211_SURVEY_INFO_PAD))
8219                 goto nla_put_failure;
8220         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
8221             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
8222                               survey->time_busy, NL80211_SURVEY_INFO_PAD))
8223                 goto nla_put_failure;
8224         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
8225             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
8226                               survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
8227                 goto nla_put_failure;
8228         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
8229             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
8230                               survey->time_rx, NL80211_SURVEY_INFO_PAD))
8231                 goto nla_put_failure;
8232         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
8233             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
8234                               survey->time_tx, NL80211_SURVEY_INFO_PAD))
8235                 goto nla_put_failure;
8236         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
8237             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
8238                               survey->time_scan, NL80211_SURVEY_INFO_PAD))
8239                 goto nla_put_failure;
8240
8241         nla_nest_end(msg, infoattr);
8242
8243         genlmsg_end(msg, hdr);
8244         return 0;
8245
8246  nla_put_failure:
8247         genlmsg_cancel(msg, hdr);
8248         return -EMSGSIZE;
8249 }
8250
8251 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
8252 {
8253         struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
8254         struct survey_info survey;
8255         struct cfg80211_registered_device *rdev;
8256         struct wireless_dev *wdev;
8257         int survey_idx = cb->args[2];
8258         int res;
8259         bool radio_stats;
8260
8261         rtnl_lock();
8262         res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
8263         if (res)
8264                 goto out_err;
8265
8266         /* prepare_wdev_dump parsed the attributes */
8267         radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
8268
8269         if (!wdev->netdev) {
8270                 res = -EINVAL;
8271                 goto out_err;
8272         }
8273
8274         if (!rdev->ops->dump_survey) {
8275                 res = -EOPNOTSUPP;
8276                 goto out_err;
8277         }
8278
8279         while (1) {
8280                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
8281                 if (res == -ENOENT)
8282                         break;
8283                 if (res)
8284                         goto out_err;
8285
8286                 /* don't send disabled channels, but do send non-channel data */
8287                 if (survey.channel &&
8288                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
8289                         survey_idx++;
8290                         continue;
8291                 }
8292
8293                 if (nl80211_send_survey(skb,
8294                                 NETLINK_CB(cb->skb).portid,
8295                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8296                                 wdev->netdev, radio_stats, &survey) < 0)
8297                         goto out;
8298                 survey_idx++;
8299         }
8300
8301  out:
8302         cb->args[2] = survey_idx;
8303         res = skb->len;
8304  out_err:
8305         rtnl_unlock();
8306         return res;
8307 }
8308
8309 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
8310 {
8311         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
8312                                   NL80211_WPA_VERSION_2));
8313 }
8314
8315 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
8316 {
8317         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8318         struct net_device *dev = info->user_ptr[1];
8319         struct ieee80211_channel *chan;
8320         const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL;
8321         int err, ssid_len, ie_len = 0, auth_data_len = 0;
8322         enum nl80211_auth_type auth_type;
8323         struct key_parse key;
8324         bool local_state_change;
8325
8326         if (!info->attrs[NL80211_ATTR_MAC])
8327                 return -EINVAL;
8328
8329         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
8330                 return -EINVAL;
8331
8332         if (!info->attrs[NL80211_ATTR_SSID])
8333                 return -EINVAL;
8334
8335         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
8336                 return -EINVAL;
8337
8338         err = nl80211_parse_key(info, &key);
8339         if (err)
8340                 return err;
8341
8342         if (key.idx >= 0) {
8343                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
8344                         return -EINVAL;
8345                 if (!key.p.key || !key.p.key_len)
8346                         return -EINVAL;
8347                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
8348                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
8349                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
8350                      key.p.key_len != WLAN_KEY_LEN_WEP104))
8351                         return -EINVAL;
8352                 if (key.idx > 3)
8353                         return -EINVAL;
8354         } else {
8355                 key.p.key_len = 0;
8356                 key.p.key = NULL;
8357         }
8358
8359         if (key.idx >= 0) {
8360                 int i;
8361                 bool ok = false;
8362
8363                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
8364                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
8365                                 ok = true;
8366                                 break;
8367                         }
8368                 }
8369                 if (!ok)
8370                         return -EINVAL;
8371         }
8372
8373         if (!rdev->ops->auth)
8374                 return -EOPNOTSUPP;
8375
8376         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8377             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8378                 return -EOPNOTSUPP;
8379
8380         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8381         chan = nl80211_get_valid_chan(&rdev->wiphy,
8382                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8383         if (!chan)
8384                 return -EINVAL;
8385
8386         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8387         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8388
8389         if (info->attrs[NL80211_ATTR_IE]) {
8390                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8391                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8392         }
8393
8394         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8395         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
8396                 return -EINVAL;
8397
8398         if ((auth_type == NL80211_AUTHTYPE_SAE ||
8399              auth_type == NL80211_AUTHTYPE_FILS_SK ||
8400              auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
8401              auth_type == NL80211_AUTHTYPE_FILS_PK) &&
8402             !info->attrs[NL80211_ATTR_AUTH_DATA])
8403                 return -EINVAL;
8404
8405         if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
8406                 if (auth_type != NL80211_AUTHTYPE_SAE &&
8407                     auth_type != NL80211_AUTHTYPE_FILS_SK &&
8408                     auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
8409                     auth_type != NL80211_AUTHTYPE_FILS_PK)
8410                         return -EINVAL;
8411                 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
8412                 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
8413                 /* need to include at least Auth Transaction and Status Code */
8414                 if (auth_data_len < 4)
8415                         return -EINVAL;
8416         }
8417
8418         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8419
8420         /*
8421          * Since we no longer track auth state, ignore
8422          * requests to only change local state.
8423          */
8424         if (local_state_change)
8425                 return 0;
8426
8427         wdev_lock(dev->ieee80211_ptr);
8428         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
8429                                  ssid, ssid_len, ie, ie_len,
8430                                  key.p.key, key.p.key_len, key.idx,
8431                                  auth_data, auth_data_len);
8432         wdev_unlock(dev->ieee80211_ptr);
8433         return err;
8434 }
8435
8436 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
8437                                      struct genl_info *info)
8438 {
8439         if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8440                 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
8441                 return -EINVAL;
8442         }
8443
8444         if (!rdev->ops->tx_control_port ||
8445             !wiphy_ext_feature_isset(&rdev->wiphy,
8446                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
8447                 return -EOPNOTSUPP;
8448
8449         return 0;
8450 }
8451
8452 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
8453                                    struct genl_info *info,
8454                                    struct cfg80211_crypto_settings *settings,
8455                                    int cipher_limit)
8456 {
8457         memset(settings, 0, sizeof(*settings));
8458
8459         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
8460
8461         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
8462                 u16 proto;
8463
8464                 proto = nla_get_u16(
8465                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
8466                 settings->control_port_ethertype = cpu_to_be16(proto);
8467                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
8468                     proto != ETH_P_PAE)
8469                         return -EINVAL;
8470                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
8471                         settings->control_port_no_encrypt = true;
8472         } else
8473                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
8474
8475         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
8476                 int r = validate_pae_over_nl80211(rdev, info);
8477
8478                 if (r < 0)
8479                         return r;
8480
8481                 settings->control_port_over_nl80211 = true;
8482         }
8483
8484         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
8485                 void *data;
8486                 int len, i;
8487
8488                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8489                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8490                 settings->n_ciphers_pairwise = len / sizeof(u32);
8491
8492                 if (len % sizeof(u32))
8493                         return -EINVAL;
8494
8495                 if (settings->n_ciphers_pairwise > cipher_limit)
8496                         return -EINVAL;
8497
8498                 memcpy(settings->ciphers_pairwise, data, len);
8499
8500                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
8501                         if (!cfg80211_supported_cipher_suite(
8502                                         &rdev->wiphy,
8503                                         settings->ciphers_pairwise[i]))
8504                                 return -EINVAL;
8505         }
8506
8507         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
8508                 settings->cipher_group =
8509                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
8510                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
8511                                                      settings->cipher_group))
8512                         return -EINVAL;
8513         }
8514
8515         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
8516                 settings->wpa_versions =
8517                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
8518                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
8519                         return -EINVAL;
8520         }
8521
8522         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
8523                 void *data;
8524                 int len;
8525
8526                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
8527                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
8528                 settings->n_akm_suites = len / sizeof(u32);
8529
8530                 if (len % sizeof(u32))
8531                         return -EINVAL;
8532
8533                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
8534                         return -EINVAL;
8535
8536                 memcpy(settings->akm_suites, data, len);
8537         }
8538
8539         if (info->attrs[NL80211_ATTR_PMK]) {
8540                 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
8541                         return -EINVAL;
8542                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8543                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK))
8544                         return -EINVAL;
8545                 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
8546         }
8547
8548         return 0;
8549 }
8550
8551 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
8552 {
8553         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8554         struct net_device *dev = info->user_ptr[1];
8555         struct ieee80211_channel *chan;
8556         struct cfg80211_assoc_request req = {};
8557         const u8 *bssid, *ssid;
8558         int err, ssid_len = 0;
8559
8560         if (dev->ieee80211_ptr->conn_owner_nlportid &&
8561             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
8562                 return -EPERM;
8563
8564         if (!info->attrs[NL80211_ATTR_MAC] ||
8565             !info->attrs[NL80211_ATTR_SSID] ||
8566             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
8567                 return -EINVAL;
8568
8569         if (!rdev->ops->assoc)
8570                 return -EOPNOTSUPP;
8571
8572         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8573             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8574                 return -EOPNOTSUPP;
8575
8576         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8577
8578         chan = nl80211_get_valid_chan(&rdev->wiphy,
8579                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8580         if (!chan)
8581                 return -EINVAL;
8582
8583         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8584         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8585
8586         if (info->attrs[NL80211_ATTR_IE]) {
8587                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8588                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8589         }
8590
8591         if (info->attrs[NL80211_ATTR_USE_MFP]) {
8592                 enum nl80211_mfp mfp =
8593                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
8594                 if (mfp == NL80211_MFP_REQUIRED)
8595                         req.use_mfp = true;
8596                 else if (mfp != NL80211_MFP_NO)
8597                         return -EINVAL;
8598         }
8599
8600         if (info->attrs[NL80211_ATTR_PREV_BSSID])
8601                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
8602
8603         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
8604                 req.flags |= ASSOC_REQ_DISABLE_HT;
8605
8606         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8607                 memcpy(&req.ht_capa_mask,
8608                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8609                        sizeof(req.ht_capa_mask));
8610
8611         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8612                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8613                         return -EINVAL;
8614                 memcpy(&req.ht_capa,
8615                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8616                        sizeof(req.ht_capa));
8617         }
8618
8619         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
8620                 req.flags |= ASSOC_REQ_DISABLE_VHT;
8621
8622         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8623                 memcpy(&req.vht_capa_mask,
8624                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
8625                        sizeof(req.vht_capa_mask));
8626
8627         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
8628                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8629                         return -EINVAL;
8630                 memcpy(&req.vht_capa,
8631                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
8632                        sizeof(req.vht_capa));
8633         }
8634
8635         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
8636                 if (!((rdev->wiphy.features &
8637                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
8638                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
8639                     !wiphy_ext_feature_isset(&rdev->wiphy,
8640                                              NL80211_EXT_FEATURE_RRM))
8641                         return -EINVAL;
8642                 req.flags |= ASSOC_REQ_USE_RRM;
8643         }
8644
8645         if (info->attrs[NL80211_ATTR_FILS_KEK]) {
8646                 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
8647                 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
8648                 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
8649                         return -EINVAL;
8650                 req.fils_nonces =
8651                         nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
8652         }
8653
8654         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
8655         if (!err) {
8656                 wdev_lock(dev->ieee80211_ptr);
8657
8658                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
8659                                           ssid, ssid_len, &req);
8660
8661                 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8662                         dev->ieee80211_ptr->conn_owner_nlportid =
8663                                 info->snd_portid;
8664                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
8665                                bssid, ETH_ALEN);
8666                 }
8667
8668                 wdev_unlock(dev->ieee80211_ptr);
8669         }
8670
8671         return err;
8672 }
8673
8674 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
8675 {
8676         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8677         struct net_device *dev = info->user_ptr[1];
8678         const u8 *ie = NULL, *bssid;
8679         int ie_len = 0, err;
8680         u16 reason_code;
8681         bool local_state_change;
8682
8683         if (dev->ieee80211_ptr->conn_owner_nlportid &&
8684             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
8685                 return -EPERM;
8686
8687         if (!info->attrs[NL80211_ATTR_MAC])
8688                 return -EINVAL;
8689
8690         if (!info->attrs[NL80211_ATTR_REASON_CODE])
8691                 return -EINVAL;
8692
8693         if (!rdev->ops->deauth)
8694                 return -EOPNOTSUPP;
8695
8696         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8697             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8698                 return -EOPNOTSUPP;
8699
8700         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8701
8702         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8703         if (reason_code == 0) {
8704                 /* Reason Code 0 is reserved */
8705                 return -EINVAL;
8706         }
8707
8708         if (info->attrs[NL80211_ATTR_IE]) {
8709                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8710                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8711         }
8712
8713         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8714
8715         wdev_lock(dev->ieee80211_ptr);
8716         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
8717                                    local_state_change);
8718         wdev_unlock(dev->ieee80211_ptr);
8719         return err;
8720 }
8721
8722 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
8723 {
8724         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8725         struct net_device *dev = info->user_ptr[1];
8726         const u8 *ie = NULL, *bssid;
8727         int ie_len = 0, err;
8728         u16 reason_code;
8729         bool local_state_change;
8730
8731         if (dev->ieee80211_ptr->conn_owner_nlportid &&
8732             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
8733                 return -EPERM;
8734
8735         if (!info->attrs[NL80211_ATTR_MAC])
8736                 return -EINVAL;
8737
8738         if (!info->attrs[NL80211_ATTR_REASON_CODE])
8739                 return -EINVAL;
8740
8741         if (!rdev->ops->disassoc)
8742                 return -EOPNOTSUPP;
8743
8744         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8745             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8746                 return -EOPNOTSUPP;
8747
8748         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8749
8750         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8751         if (reason_code == 0) {
8752                 /* Reason Code 0 is reserved */
8753                 return -EINVAL;
8754         }
8755
8756         if (info->attrs[NL80211_ATTR_IE]) {
8757                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8758                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8759         }
8760
8761         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8762
8763         wdev_lock(dev->ieee80211_ptr);
8764         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
8765                                      local_state_change);
8766         wdev_unlock(dev->ieee80211_ptr);
8767         return err;
8768 }
8769
8770 static bool
8771 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
8772                          int mcast_rate[NUM_NL80211_BANDS],
8773                          int rateval)
8774 {
8775         struct wiphy *wiphy = &rdev->wiphy;
8776         bool found = false;
8777         int band, i;
8778
8779         for (band = 0; band < NUM_NL80211_BANDS; band++) {
8780                 struct ieee80211_supported_band *sband;
8781
8782                 sband = wiphy->bands[band];
8783                 if (!sband)
8784                         continue;
8785
8786                 for (i = 0; i < sband->n_bitrates; i++) {
8787                         if (sband->bitrates[i].bitrate == rateval) {
8788                                 mcast_rate[band] = i + 1;
8789                                 found = true;
8790                                 break;
8791                         }
8792                 }
8793         }
8794
8795         return found;
8796 }
8797
8798 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
8799 {
8800         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8801         struct net_device *dev = info->user_ptr[1];
8802         struct cfg80211_ibss_params ibss;
8803         struct wiphy *wiphy;
8804         struct cfg80211_cached_keys *connkeys = NULL;
8805         int err;
8806
8807         memset(&ibss, 0, sizeof(ibss));
8808
8809         if (!info->attrs[NL80211_ATTR_SSID] ||
8810             !nla_len(info->attrs[NL80211_ATTR_SSID]))
8811                 return -EINVAL;
8812
8813         ibss.beacon_interval = 100;
8814
8815         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
8816                 ibss.beacon_interval =
8817                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8818
8819         err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
8820                                            ibss.beacon_interval);
8821         if (err)
8822                 return err;
8823
8824         if (!rdev->ops->join_ibss)
8825                 return -EOPNOTSUPP;
8826
8827         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
8828                 return -EOPNOTSUPP;
8829
8830         wiphy = &rdev->wiphy;
8831
8832         if (info->attrs[NL80211_ATTR_MAC]) {
8833                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8834
8835                 if (!is_valid_ether_addr(ibss.bssid))
8836                         return -EINVAL;
8837         }
8838         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8839         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8840
8841         if (info->attrs[NL80211_ATTR_IE]) {
8842                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8843                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8844         }
8845
8846         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
8847         if (err)
8848                 return err;
8849
8850         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
8851                                      NL80211_IFTYPE_ADHOC))
8852                 return -EINVAL;
8853
8854         switch (ibss.chandef.width) {
8855         case NL80211_CHAN_WIDTH_5:
8856         case NL80211_CHAN_WIDTH_10:
8857         case NL80211_CHAN_WIDTH_20_NOHT:
8858                 break;
8859         case NL80211_CHAN_WIDTH_20:
8860         case NL80211_CHAN_WIDTH_40:
8861                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8862                         return -EINVAL;
8863                 break;
8864         case NL80211_CHAN_WIDTH_80:
8865         case NL80211_CHAN_WIDTH_80P80:
8866         case NL80211_CHAN_WIDTH_160:
8867                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8868                         return -EINVAL;
8869                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8870                                              NL80211_EXT_FEATURE_VHT_IBSS))
8871                         return -EINVAL;
8872                 break;
8873         default:
8874                 return -EINVAL;
8875         }
8876
8877         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
8878         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
8879
8880         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8881                 u8 *rates =
8882                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8883                 int n_rates =
8884                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8885                 struct ieee80211_supported_band *sband =
8886                         wiphy->bands[ibss.chandef.chan->band];
8887
8888                 err = ieee80211_get_ratemask(sband, rates, n_rates,
8889                                              &ibss.basic_rates);
8890                 if (err)
8891                         return err;
8892         }
8893
8894         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8895                 memcpy(&ibss.ht_capa_mask,
8896                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8897                        sizeof(ibss.ht_capa_mask));
8898
8899         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8900                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8901                         return -EINVAL;
8902                 memcpy(&ibss.ht_capa,
8903                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8904                        sizeof(ibss.ht_capa));
8905         }
8906
8907         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
8908             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
8909                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
8910                 return -EINVAL;
8911
8912         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
8913                 bool no_ht = false;
8914
8915                 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
8916                 if (IS_ERR(connkeys))
8917                         return PTR_ERR(connkeys);
8918
8919                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
8920                     no_ht) {
8921                         kzfree(connkeys);
8922                         return -EINVAL;
8923                 }
8924         }
8925
8926         ibss.control_port =
8927                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
8928
8929         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
8930                 int r = validate_pae_over_nl80211(rdev, info);
8931
8932                 if (r < 0)
8933                         return r;
8934
8935                 ibss.control_port_over_nl80211 = true;
8936         }
8937
8938         ibss.userspace_handles_dfs =
8939                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
8940
8941         wdev_lock(dev->ieee80211_ptr);
8942         err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
8943         if (err)
8944                 kzfree(connkeys);
8945         else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
8946                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
8947         wdev_unlock(dev->ieee80211_ptr);
8948
8949         return err;
8950 }
8951
8952 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
8953 {
8954         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8955         struct net_device *dev = info->user_ptr[1];
8956
8957         if (!rdev->ops->leave_ibss)
8958                 return -EOPNOTSUPP;
8959
8960         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
8961                 return -EOPNOTSUPP;
8962
8963         return cfg80211_leave_ibss(rdev, dev, false);
8964 }
8965
8966 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
8967 {
8968         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8969         struct net_device *dev = info->user_ptr[1];
8970         int mcast_rate[NUM_NL80211_BANDS];
8971         u32 nla_rate;
8972         int err;
8973
8974         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
8975             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
8976             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
8977                 return -EOPNOTSUPP;
8978
8979         if (!rdev->ops->set_mcast_rate)
8980                 return -EOPNOTSUPP;
8981
8982         memset(mcast_rate, 0, sizeof(mcast_rate));
8983
8984         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
8985                 return -EINVAL;
8986
8987         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
8988         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
8989                 return -EINVAL;
8990
8991         err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
8992
8993         return err;
8994 }
8995
8996 static struct sk_buff *
8997 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
8998                             struct wireless_dev *wdev, int approxlen,
8999                             u32 portid, u32 seq, enum nl80211_commands cmd,
9000                             enum nl80211_attrs attr,
9001                             const struct nl80211_vendor_cmd_info *info,
9002                             gfp_t gfp)
9003 {
9004         struct sk_buff *skb;
9005         void *hdr;
9006         struct nlattr *data;
9007
9008         skb = nlmsg_new(approxlen + 100, gfp);
9009         if (!skb)
9010                 return NULL;
9011
9012         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
9013         if (!hdr) {
9014                 kfree_skb(skb);
9015                 return NULL;
9016         }
9017
9018         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
9019                 goto nla_put_failure;
9020
9021         if (info) {
9022                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
9023                                 info->vendor_id))
9024                         goto nla_put_failure;
9025                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
9026                                 info->subcmd))
9027                         goto nla_put_failure;
9028         }
9029
9030         if (wdev) {
9031                 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
9032                                       wdev_id(wdev), NL80211_ATTR_PAD))
9033                         goto nla_put_failure;
9034                 if (wdev->netdev &&
9035                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
9036                                 wdev->netdev->ifindex))
9037                         goto nla_put_failure;
9038         }
9039
9040         data = nla_nest_start(skb, attr);
9041         if (!data)
9042                 goto nla_put_failure;
9043
9044         ((void **)skb->cb)[0] = rdev;
9045         ((void **)skb->cb)[1] = hdr;
9046         ((void **)skb->cb)[2] = data;
9047
9048         return skb;
9049
9050  nla_put_failure:
9051         kfree_skb(skb);
9052         return NULL;
9053 }
9054
9055 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
9056                                            struct wireless_dev *wdev,
9057                                            enum nl80211_commands cmd,
9058                                            enum nl80211_attrs attr,
9059                                            int vendor_event_idx,
9060                                            int approxlen, gfp_t gfp)
9061 {
9062         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
9063         const struct nl80211_vendor_cmd_info *info;
9064
9065         switch (cmd) {
9066         case NL80211_CMD_TESTMODE:
9067                 if (WARN_ON(vendor_event_idx != -1))
9068                         return NULL;
9069                 info = NULL;
9070                 break;
9071         case NL80211_CMD_VENDOR:
9072                 if (WARN_ON(vendor_event_idx < 0 ||
9073                             vendor_event_idx >= wiphy->n_vendor_events))
9074                         return NULL;
9075                 info = &wiphy->vendor_events[vendor_event_idx];
9076                 break;
9077         default:
9078                 WARN_ON(1);
9079                 return NULL;
9080         }
9081
9082         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, 0, 0,
9083                                            cmd, attr, info, gfp);
9084 }
9085 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
9086
9087 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
9088 {
9089         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
9090         void *hdr = ((void **)skb->cb)[1];
9091         struct nlattr *data = ((void **)skb->cb)[2];
9092         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
9093
9094         /* clear CB data for netlink core to own from now on */
9095         memset(skb->cb, 0, sizeof(skb->cb));
9096
9097         nla_nest_end(skb, data);
9098         genlmsg_end(skb, hdr);
9099
9100         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
9101                 mcgrp = NL80211_MCGRP_VENDOR;
9102
9103         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
9104                                 mcgrp, gfp);
9105 }
9106 EXPORT_SYMBOL(__cfg80211_send_event_skb);
9107
9108 #ifdef CONFIG_NL80211_TESTMODE
9109 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
9110 {
9111         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9112         struct wireless_dev *wdev =
9113                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
9114         int err;
9115
9116         if (!rdev->ops->testmode_cmd)
9117                 return -EOPNOTSUPP;
9118
9119         if (IS_ERR(wdev)) {
9120                 err = PTR_ERR(wdev);
9121                 if (err != -EINVAL)
9122                         return err;
9123                 wdev = NULL;
9124         } else if (wdev->wiphy != &rdev->wiphy) {
9125                 return -EINVAL;
9126         }
9127
9128         if (!info->attrs[NL80211_ATTR_TESTDATA])
9129                 return -EINVAL;
9130
9131         rdev->cur_cmd_info = info;
9132         err = rdev_testmode_cmd(rdev, wdev,
9133                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
9134                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
9135         rdev->cur_cmd_info = NULL;
9136
9137         return err;
9138 }
9139
9140 static int nl80211_testmode_dump(struct sk_buff *skb,
9141                                  struct netlink_callback *cb)
9142 {
9143         struct cfg80211_registered_device *rdev;
9144         int err;
9145         long phy_idx;
9146         void *data = NULL;
9147         int data_len = 0;
9148
9149         rtnl_lock();
9150
9151         if (cb->args[0]) {
9152                 /*
9153                  * 0 is a valid index, but not valid for args[0],
9154                  * so we need to offset by 1.
9155                  */
9156                 phy_idx = cb->args[0] - 1;
9157
9158                 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
9159                 if (!rdev) {
9160                         err = -ENOENT;
9161                         goto out_err;
9162                 }
9163         } else {
9164                 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
9165
9166                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
9167                                   attrbuf, nl80211_fam.maxattr,
9168                                   nl80211_policy, NULL);
9169                 if (err)
9170                         goto out_err;
9171
9172                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
9173                 if (IS_ERR(rdev)) {
9174                         err = PTR_ERR(rdev);
9175                         goto out_err;
9176                 }
9177                 phy_idx = rdev->wiphy_idx;
9178
9179                 if (attrbuf[NL80211_ATTR_TESTDATA])
9180                         cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
9181         }
9182
9183         if (cb->args[1]) {
9184                 data = nla_data((void *)cb->args[1]);
9185                 data_len = nla_len((void *)cb->args[1]);
9186         }
9187
9188         if (!rdev->ops->testmode_dump) {
9189                 err = -EOPNOTSUPP;
9190                 goto out_err;
9191         }
9192
9193         while (1) {
9194                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
9195                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
9196                                            NL80211_CMD_TESTMODE);
9197                 struct nlattr *tmdata;
9198
9199                 if (!hdr)
9200                         break;
9201
9202                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
9203                         genlmsg_cancel(skb, hdr);
9204                         break;
9205                 }
9206
9207                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
9208                 if (!tmdata) {
9209                         genlmsg_cancel(skb, hdr);
9210                         break;
9211                 }
9212                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
9213                 nla_nest_end(skb, tmdata);
9214
9215                 if (err == -ENOBUFS || err == -ENOENT) {
9216                         genlmsg_cancel(skb, hdr);
9217                         break;
9218                 } else if (err) {
9219                         genlmsg_cancel(skb, hdr);
9220                         goto out_err;
9221                 }
9222
9223                 genlmsg_end(skb, hdr);
9224         }
9225
9226         err = skb->len;
9227         /* see above */
9228         cb->args[0] = phy_idx + 1;
9229  out_err:
9230         rtnl_unlock();
9231         return err;
9232 }
9233 #endif
9234
9235 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
9236 {
9237         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9238         struct net_device *dev = info->user_ptr[1];
9239         struct cfg80211_connect_params connect;
9240         struct wiphy *wiphy;
9241         struct cfg80211_cached_keys *connkeys = NULL;
9242         int err;
9243
9244         memset(&connect, 0, sizeof(connect));
9245
9246         if (!info->attrs[NL80211_ATTR_SSID] ||
9247             !nla_len(info->attrs[NL80211_ATTR_SSID]))
9248                 return -EINVAL;
9249
9250         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
9251                 connect.auth_type =
9252                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9253                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
9254                                              NL80211_CMD_CONNECT))
9255                         return -EINVAL;
9256         } else
9257                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
9258
9259         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
9260
9261         if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
9262             !wiphy_ext_feature_isset(&rdev->wiphy,
9263                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
9264                 return -EINVAL;
9265         connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
9266
9267         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
9268                                       NL80211_MAX_NR_CIPHER_SUITES);
9269         if (err)
9270                 return err;
9271
9272         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9273             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9274                 return -EOPNOTSUPP;
9275
9276         wiphy = &rdev->wiphy;
9277
9278         connect.bg_scan_period = -1;
9279         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
9280                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
9281                 connect.bg_scan_period =
9282                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
9283         }
9284
9285         if (info->attrs[NL80211_ATTR_MAC])
9286                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9287         else if (info->attrs[NL80211_ATTR_MAC_HINT])
9288                 connect.bssid_hint =
9289                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
9290         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9291         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9292
9293         if (info->attrs[NL80211_ATTR_IE]) {
9294                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9295                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9296         }
9297
9298         if (info->attrs[NL80211_ATTR_USE_MFP]) {
9299                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
9300                 if (connect.mfp == NL80211_MFP_OPTIONAL &&
9301                     !wiphy_ext_feature_isset(&rdev->wiphy,
9302                                              NL80211_EXT_FEATURE_MFP_OPTIONAL))
9303                         return -EOPNOTSUPP;
9304         } else {
9305                 connect.mfp = NL80211_MFP_NO;
9306         }
9307
9308         if (info->attrs[NL80211_ATTR_PREV_BSSID])
9309                 connect.prev_bssid =
9310                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
9311
9312         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9313                 connect.channel = nl80211_get_valid_chan(
9314                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
9315                 if (!connect.channel)
9316                         return -EINVAL;
9317         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
9318                 connect.channel_hint = nl80211_get_valid_chan(
9319                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
9320                 if (!connect.channel_hint)
9321                         return -EINVAL;
9322         }
9323
9324         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
9325                 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
9326                 if (IS_ERR(connkeys))
9327                         return PTR_ERR(connkeys);
9328         }
9329
9330         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
9331                 connect.flags |= ASSOC_REQ_DISABLE_HT;
9332
9333         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9334                 memcpy(&connect.ht_capa_mask,
9335                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
9336                        sizeof(connect.ht_capa_mask));
9337
9338         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9339                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
9340                         kzfree(connkeys);
9341                         return -EINVAL;
9342                 }
9343                 memcpy(&connect.ht_capa,
9344                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9345                        sizeof(connect.ht_capa));
9346         }
9347
9348         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
9349                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
9350
9351         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
9352                 memcpy(&connect.vht_capa_mask,
9353                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
9354                        sizeof(connect.vht_capa_mask));
9355
9356         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
9357                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
9358                         kzfree(connkeys);
9359                         return -EINVAL;
9360                 }
9361                 memcpy(&connect.vht_capa,
9362                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
9363                        sizeof(connect.vht_capa));
9364         }
9365
9366         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
9367                 if (!((rdev->wiphy.features &
9368                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
9369                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
9370                     !wiphy_ext_feature_isset(&rdev->wiphy,
9371                                              NL80211_EXT_FEATURE_RRM)) {
9372                         kzfree(connkeys);
9373                         return -EINVAL;
9374                 }
9375                 connect.flags |= ASSOC_REQ_USE_RRM;
9376         }
9377
9378         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
9379         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
9380                 kzfree(connkeys);
9381                 return -EOPNOTSUPP;
9382         }
9383
9384         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
9385                 /* bss selection makes no sense if bssid is set */
9386                 if (connect.bssid) {
9387                         kzfree(connkeys);
9388                         return -EINVAL;
9389                 }
9390
9391                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
9392                                        wiphy, &connect.bss_select);
9393                 if (err) {
9394                         kzfree(connkeys);
9395                         return err;
9396                 }
9397         }
9398
9399         if (wiphy_ext_feature_isset(&rdev->wiphy,
9400                                     NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
9401             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
9402             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
9403             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
9404             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9405                 connect.fils_erp_username =
9406                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9407                 connect.fils_erp_username_len =
9408                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9409                 connect.fils_erp_realm =
9410                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9411                 connect.fils_erp_realm_len =
9412                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9413                 connect.fils_erp_next_seq_num =
9414                         nla_get_u16(
9415                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
9416                 connect.fils_erp_rrk =
9417                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9418                 connect.fils_erp_rrk_len =
9419                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9420         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
9421                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
9422                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
9423                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9424                 kzfree(connkeys);
9425                 return -EINVAL;
9426         }
9427
9428         if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
9429                 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9430                         kzfree(connkeys);
9431                         GENL_SET_ERR_MSG(info,
9432                                          "external auth requires connection ownership");
9433                         return -EINVAL;
9434                 }
9435                 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
9436         }
9437
9438         wdev_lock(dev->ieee80211_ptr);
9439
9440         err = cfg80211_connect(rdev, dev, &connect, connkeys,
9441                                connect.prev_bssid);
9442         if (err)
9443                 kzfree(connkeys);
9444
9445         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9446                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
9447                 if (connect.bssid)
9448                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
9449                                connect.bssid, ETH_ALEN);
9450                 else
9451                         memset(dev->ieee80211_ptr->disconnect_bssid,
9452                                0, ETH_ALEN);
9453         }
9454
9455         wdev_unlock(dev->ieee80211_ptr);
9456
9457         return err;
9458 }
9459
9460 static int nl80211_update_connect_params(struct sk_buff *skb,
9461                                          struct genl_info *info)
9462 {
9463         struct cfg80211_connect_params connect = {};
9464         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9465         struct net_device *dev = info->user_ptr[1];
9466         struct wireless_dev *wdev = dev->ieee80211_ptr;
9467         bool fils_sk_offload;
9468         u32 auth_type;
9469         u32 changed = 0;
9470         int ret;
9471
9472         if (!rdev->ops->update_connect_params)
9473                 return -EOPNOTSUPP;
9474
9475         if (info->attrs[NL80211_ATTR_IE]) {
9476                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9477                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9478                 changed |= UPDATE_ASSOC_IES;
9479         }
9480
9481         fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
9482                                                   NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
9483
9484         /*
9485          * when driver supports fils-sk offload all attributes must be
9486          * provided. So the else covers "fils-sk-not-all" and
9487          * "no-fils-sk-any".
9488          */
9489         if (fils_sk_offload &&
9490             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
9491             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
9492             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
9493             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9494                 connect.fils_erp_username =
9495                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9496                 connect.fils_erp_username_len =
9497                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9498                 connect.fils_erp_realm =
9499                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9500                 connect.fils_erp_realm_len =
9501                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9502                 connect.fils_erp_next_seq_num =
9503                         nla_get_u16(
9504                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
9505                 connect.fils_erp_rrk =
9506                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9507                 connect.fils_erp_rrk_len =
9508                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9509                 changed |= UPDATE_FILS_ERP_INFO;
9510         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
9511                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
9512                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
9513                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9514                 return -EINVAL;
9515         }
9516
9517         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
9518                 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9519                 if (!nl80211_valid_auth_type(rdev, auth_type,
9520                                              NL80211_CMD_CONNECT))
9521                         return -EINVAL;
9522
9523                 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
9524                     fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
9525                         return -EINVAL;
9526
9527                 connect.auth_type = auth_type;
9528                 changed |= UPDATE_AUTH_TYPE;
9529         }
9530
9531         wdev_lock(dev->ieee80211_ptr);
9532         if (!wdev->current_bss)
9533                 ret = -ENOLINK;
9534         else
9535                 ret = rdev_update_connect_params(rdev, dev, &connect, changed);
9536         wdev_unlock(dev->ieee80211_ptr);
9537
9538         return ret;
9539 }
9540
9541 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
9542 {
9543         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9544         struct net_device *dev = info->user_ptr[1];
9545         u16 reason;
9546         int ret;
9547
9548         if (dev->ieee80211_ptr->conn_owner_nlportid &&
9549             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9550                 return -EPERM;
9551
9552         if (!info->attrs[NL80211_ATTR_REASON_CODE])
9553                 reason = WLAN_REASON_DEAUTH_LEAVING;
9554         else
9555                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9556
9557         if (reason == 0)
9558                 return -EINVAL;
9559
9560         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9561             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9562                 return -EOPNOTSUPP;
9563
9564         wdev_lock(dev->ieee80211_ptr);
9565         ret = cfg80211_disconnect(rdev, dev, reason, true);
9566         wdev_unlock(dev->ieee80211_ptr);
9567         return ret;
9568 }
9569
9570 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
9571 {
9572         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9573         struct net *net;
9574         int err;
9575
9576         if (info->attrs[NL80211_ATTR_PID]) {
9577                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
9578
9579                 net = get_net_ns_by_pid(pid);
9580         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
9581                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
9582
9583                 net = get_net_ns_by_fd(fd);
9584         } else {
9585                 return -EINVAL;
9586         }
9587
9588         if (IS_ERR(net))
9589                 return PTR_ERR(net);
9590
9591         err = 0;
9592
9593         /* check if anything to do */
9594         if (!net_eq(wiphy_net(&rdev->wiphy), net))
9595                 err = cfg80211_switch_netns(rdev, net);
9596
9597         put_net(net);
9598         return err;
9599 }
9600
9601 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
9602 {
9603         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9604         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
9605                         struct cfg80211_pmksa *pmksa) = NULL;
9606         struct net_device *dev = info->user_ptr[1];
9607         struct cfg80211_pmksa pmksa;
9608
9609         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
9610
9611         if (!info->attrs[NL80211_ATTR_PMKID])
9612                 return -EINVAL;
9613
9614         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
9615
9616         if (info->attrs[NL80211_ATTR_MAC]) {
9617                 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9618         } else if (info->attrs[NL80211_ATTR_SSID] &&
9619                    info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
9620                    (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
9621                     info->attrs[NL80211_ATTR_PMK])) {
9622                 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9623                 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9624                 pmksa.cache_id =
9625                         nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
9626         } else {
9627                 return -EINVAL;
9628         }
9629         if (info->attrs[NL80211_ATTR_PMK]) {
9630                 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
9631                 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
9632         }
9633
9634         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9635             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9636                 return -EOPNOTSUPP;
9637
9638         switch (info->genlhdr->cmd) {
9639         case NL80211_CMD_SET_PMKSA:
9640                 rdev_ops = rdev->ops->set_pmksa;
9641                 break;
9642         case NL80211_CMD_DEL_PMKSA:
9643                 rdev_ops = rdev->ops->del_pmksa;
9644                 break;
9645         default:
9646                 WARN_ON(1);
9647                 break;
9648         }
9649
9650         if (!rdev_ops)
9651                 return -EOPNOTSUPP;
9652
9653         return rdev_ops(&rdev->wiphy, dev, &pmksa);
9654 }
9655
9656 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
9657 {
9658         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9659         struct net_device *dev = info->user_ptr[1];
9660
9661         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9662             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9663                 return -EOPNOTSUPP;
9664
9665         if (!rdev->ops->flush_pmksa)
9666                 return -EOPNOTSUPP;
9667
9668         return rdev_flush_pmksa(rdev, dev);
9669 }
9670
9671 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
9672 {
9673         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9674         struct net_device *dev = info->user_ptr[1];
9675         u8 action_code, dialog_token;
9676         u32 peer_capability = 0;
9677         u16 status_code;
9678         u8 *peer;
9679         bool initiator;
9680
9681         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
9682             !rdev->ops->tdls_mgmt)
9683                 return -EOPNOTSUPP;
9684
9685         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
9686             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
9687             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
9688             !info->attrs[NL80211_ATTR_IE] ||
9689             !info->attrs[NL80211_ATTR_MAC])
9690                 return -EINVAL;
9691
9692         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9693         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
9694         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
9695         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
9696         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
9697         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
9698                 peer_capability =
9699                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
9700
9701         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
9702                               dialog_token, status_code, peer_capability,
9703                               initiator,
9704                               nla_data(info->attrs[NL80211_ATTR_IE]),
9705                               nla_len(info->attrs[NL80211_ATTR_IE]));
9706 }
9707
9708 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
9709 {
9710         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9711         struct net_device *dev = info->user_ptr[1];
9712         enum nl80211_tdls_operation operation;
9713         u8 *peer;
9714
9715         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
9716             !rdev->ops->tdls_oper)
9717                 return -EOPNOTSUPP;
9718
9719         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
9720             !info->attrs[NL80211_ATTR_MAC])
9721                 return -EINVAL;
9722
9723         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
9724         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9725
9726         return rdev_tdls_oper(rdev, dev, peer, operation);
9727 }
9728
9729 static int nl80211_remain_on_channel(struct sk_buff *skb,
9730                                      struct genl_info *info)
9731 {
9732         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9733         struct wireless_dev *wdev = info->user_ptr[1];
9734         struct cfg80211_chan_def chandef;
9735         const struct cfg80211_chan_def *compat_chandef;
9736         struct sk_buff *msg;
9737         void *hdr;
9738         u64 cookie;
9739         u32 duration;
9740         int err;
9741
9742         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
9743             !info->attrs[NL80211_ATTR_DURATION])
9744                 return -EINVAL;
9745
9746         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
9747
9748         if (!rdev->ops->remain_on_channel ||
9749             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
9750                 return -EOPNOTSUPP;
9751
9752         /*
9753          * We should be on that channel for at least a minimum amount of
9754          * time (10ms) but no longer than the driver supports.
9755          */
9756         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
9757             duration > rdev->wiphy.max_remain_on_channel_duration)
9758                 return -EINVAL;
9759
9760         err = nl80211_parse_chandef(rdev, info, &chandef);
9761         if (err)
9762                 return err;
9763
9764         wdev_lock(wdev);
9765         if (!cfg80211_off_channel_oper_allowed(wdev) &&
9766             !cfg80211_chandef_identical(&wdev->chandef, &chandef)) {
9767                 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef,
9768                                                              &chandef);
9769                 if (compat_chandef != &chandef) {
9770                         wdev_unlock(wdev);
9771                         return -EBUSY;
9772                 }
9773         }
9774         wdev_unlock(wdev);
9775
9776         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9777         if (!msg)
9778                 return -ENOMEM;
9779
9780         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9781                              NL80211_CMD_REMAIN_ON_CHANNEL);
9782         if (!hdr) {
9783                 err = -ENOBUFS;
9784                 goto free_msg;
9785         }
9786
9787         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
9788                                      duration, &cookie);
9789
9790         if (err)
9791                 goto free_msg;
9792
9793         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
9794                               NL80211_ATTR_PAD))
9795                 goto nla_put_failure;
9796
9797         genlmsg_end(msg, hdr);
9798
9799         return genlmsg_reply(msg, info);
9800
9801  nla_put_failure:
9802         err = -ENOBUFS;
9803  free_msg:
9804         nlmsg_free(msg);
9805         return err;
9806 }
9807
9808 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
9809                                             struct genl_info *info)
9810 {
9811         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9812         struct wireless_dev *wdev = info->user_ptr[1];
9813         u64 cookie;
9814
9815         if (!info->attrs[NL80211_ATTR_COOKIE])
9816                 return -EINVAL;
9817
9818         if (!rdev->ops->cancel_remain_on_channel)
9819                 return -EOPNOTSUPP;
9820
9821         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9822
9823         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
9824 }
9825
9826 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
9827                                        struct genl_info *info)
9828 {
9829         struct cfg80211_bitrate_mask mask;
9830         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9831         struct net_device *dev = info->user_ptr[1];
9832         int err;
9833
9834         if (!rdev->ops->set_bitrate_mask)
9835                 return -EOPNOTSUPP;
9836
9837         err = nl80211_parse_tx_bitrate_mask(info, &mask);
9838         if (err)
9839                 return err;
9840
9841         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
9842 }
9843
9844 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
9845 {
9846         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9847         struct wireless_dev *wdev = info->user_ptr[1];
9848         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
9849
9850         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
9851                 return -EINVAL;
9852
9853         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
9854                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
9855
9856         switch (wdev->iftype) {
9857         case NL80211_IFTYPE_STATION:
9858         case NL80211_IFTYPE_ADHOC:
9859         case NL80211_IFTYPE_P2P_CLIENT:
9860         case NL80211_IFTYPE_AP:
9861         case NL80211_IFTYPE_AP_VLAN:
9862         case NL80211_IFTYPE_MESH_POINT:
9863         case NL80211_IFTYPE_P2P_GO:
9864         case NL80211_IFTYPE_P2P_DEVICE:
9865                 break;
9866         case NL80211_IFTYPE_NAN:
9867         default:
9868                 return -EOPNOTSUPP;
9869         }
9870
9871         /* not much point in registering if we can't reply */
9872         if (!rdev->ops->mgmt_tx)
9873                 return -EOPNOTSUPP;
9874
9875         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
9876                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
9877                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
9878 }
9879
9880 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
9881 {
9882         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9883         struct wireless_dev *wdev = info->user_ptr[1];
9884         struct cfg80211_chan_def chandef;
9885         int err;
9886         void *hdr = NULL;
9887         u64 cookie;
9888         struct sk_buff *msg = NULL;
9889         struct cfg80211_mgmt_tx_params params = {
9890                 .dont_wait_for_ack =
9891                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
9892         };
9893
9894         if (!info->attrs[NL80211_ATTR_FRAME])
9895                 return -EINVAL;
9896
9897         if (!rdev->ops->mgmt_tx)
9898                 return -EOPNOTSUPP;
9899
9900         switch (wdev->iftype) {
9901         case NL80211_IFTYPE_P2P_DEVICE:
9902                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
9903                         return -EINVAL;
9904         case NL80211_IFTYPE_STATION:
9905         case NL80211_IFTYPE_ADHOC:
9906         case NL80211_IFTYPE_P2P_CLIENT:
9907         case NL80211_IFTYPE_AP:
9908         case NL80211_IFTYPE_AP_VLAN:
9909         case NL80211_IFTYPE_MESH_POINT:
9910         case NL80211_IFTYPE_P2P_GO:
9911                 break;
9912         case NL80211_IFTYPE_NAN:
9913         default:
9914                 return -EOPNOTSUPP;
9915         }
9916
9917         if (info->attrs[NL80211_ATTR_DURATION]) {
9918                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
9919                         return -EINVAL;
9920                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
9921
9922                 /*
9923                  * We should wait on the channel for at least a minimum amount
9924                  * of time (10ms) but no longer than the driver supports.
9925                  */
9926                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
9927                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
9928                         return -EINVAL;
9929         }
9930
9931         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
9932
9933         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
9934                 return -EINVAL;
9935
9936         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
9937
9938         /* get the channel if any has been specified, otherwise pass NULL to
9939          * the driver. The latter will use the current one
9940          */
9941         chandef.chan = NULL;
9942         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9943                 err = nl80211_parse_chandef(rdev, info, &chandef);
9944                 if (err)
9945                         return err;
9946         }
9947
9948         if (!chandef.chan && params.offchan)
9949                 return -EINVAL;
9950
9951         wdev_lock(wdev);
9952         if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) {
9953                 wdev_unlock(wdev);
9954                 return -EBUSY;
9955         }
9956         wdev_unlock(wdev);
9957
9958         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
9959         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
9960
9961         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
9962                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
9963                 int i;
9964
9965                 if (len % sizeof(u16))
9966                         return -EINVAL;
9967
9968                 params.n_csa_offsets = len / sizeof(u16);
9969                 params.csa_offsets =
9970                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
9971
9972                 /* check that all the offsets fit the frame */
9973                 for (i = 0; i < params.n_csa_offsets; i++) {
9974                         if (params.csa_offsets[i] >= params.len)
9975                                 return -EINVAL;
9976                 }
9977         }
9978
9979         if (!params.dont_wait_for_ack) {
9980                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9981                 if (!msg)
9982                         return -ENOMEM;
9983
9984                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9985                                      NL80211_CMD_FRAME);
9986                 if (!hdr) {
9987                         err = -ENOBUFS;
9988                         goto free_msg;
9989                 }
9990         }
9991
9992         params.chan = chandef.chan;
9993         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
9994         if (err)
9995                 goto free_msg;
9996
9997         if (msg) {
9998                 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
9999                                       NL80211_ATTR_PAD))
10000                         goto nla_put_failure;
10001
10002                 genlmsg_end(msg, hdr);
10003                 return genlmsg_reply(msg, info);
10004         }
10005
10006         return 0;
10007
10008  nla_put_failure:
10009         err = -ENOBUFS;
10010  free_msg:
10011         nlmsg_free(msg);
10012         return err;
10013 }
10014
10015 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
10016 {
10017         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10018         struct wireless_dev *wdev = info->user_ptr[1];
10019         u64 cookie;
10020
10021         if (!info->attrs[NL80211_ATTR_COOKIE])
10022                 return -EINVAL;
10023
10024         if (!rdev->ops->mgmt_tx_cancel_wait)
10025                 return -EOPNOTSUPP;
10026
10027         switch (wdev->iftype) {
10028         case NL80211_IFTYPE_STATION:
10029         case NL80211_IFTYPE_ADHOC:
10030         case NL80211_IFTYPE_P2P_CLIENT:
10031         case NL80211_IFTYPE_AP:
10032         case NL80211_IFTYPE_AP_VLAN:
10033         case NL80211_IFTYPE_P2P_GO:
10034         case NL80211_IFTYPE_P2P_DEVICE:
10035                 break;
10036         case NL80211_IFTYPE_NAN:
10037         default:
10038                 return -EOPNOTSUPP;
10039         }
10040
10041         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
10042
10043         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
10044 }
10045
10046 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
10047 {
10048         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10049         struct wireless_dev *wdev;
10050         struct net_device *dev = info->user_ptr[1];
10051         u8 ps_state;
10052         bool state;
10053         int err;
10054
10055         if (!info->attrs[NL80211_ATTR_PS_STATE])
10056                 return -EINVAL;
10057
10058         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
10059
10060         wdev = dev->ieee80211_ptr;
10061
10062         if (!rdev->ops->set_power_mgmt)
10063                 return -EOPNOTSUPP;
10064
10065         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
10066
10067         if (state == wdev->ps)
10068                 return 0;
10069
10070         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
10071         if (!err)
10072                 wdev->ps = state;
10073         return err;
10074 }
10075
10076 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
10077 {
10078         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10079         enum nl80211_ps_state ps_state;
10080         struct wireless_dev *wdev;
10081         struct net_device *dev = info->user_ptr[1];
10082         struct sk_buff *msg;
10083         void *hdr;
10084         int err;
10085
10086         wdev = dev->ieee80211_ptr;
10087
10088         if (!rdev->ops->set_power_mgmt)
10089                 return -EOPNOTSUPP;
10090
10091         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10092         if (!msg)
10093                 return -ENOMEM;
10094
10095         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10096                              NL80211_CMD_GET_POWER_SAVE);
10097         if (!hdr) {
10098                 err = -ENOBUFS;
10099                 goto free_msg;
10100         }
10101
10102         if (wdev->ps)
10103                 ps_state = NL80211_PS_ENABLED;
10104         else
10105                 ps_state = NL80211_PS_DISABLED;
10106
10107         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
10108                 goto nla_put_failure;
10109
10110         genlmsg_end(msg, hdr);
10111         return genlmsg_reply(msg, info);
10112
10113  nla_put_failure:
10114         err = -ENOBUFS;
10115  free_msg:
10116         nlmsg_free(msg);
10117         return err;
10118 }
10119
10120 static const struct nla_policy
10121 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
10122         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
10123         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
10124         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
10125         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
10126         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
10127         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
10128         [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
10129 };
10130
10131 static int nl80211_set_cqm_txe(struct genl_info *info,
10132                                u32 rate, u32 pkts, u32 intvl)
10133 {
10134         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10135         struct net_device *dev = info->user_ptr[1];
10136         struct wireless_dev *wdev = dev->ieee80211_ptr;
10137
10138         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
10139                 return -EINVAL;
10140
10141         if (!rdev->ops->set_cqm_txe_config)
10142                 return -EOPNOTSUPP;
10143
10144         if (wdev->iftype != NL80211_IFTYPE_STATION &&
10145             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
10146                 return -EOPNOTSUPP;
10147
10148         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
10149 }
10150
10151 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
10152                                     struct net_device *dev)
10153 {
10154         struct wireless_dev *wdev = dev->ieee80211_ptr;
10155         s32 last, low, high;
10156         u32 hyst;
10157         int i, n, low_index;
10158         int err;
10159
10160         /* RSSI reporting disabled? */
10161         if (!wdev->cqm_config)
10162                 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
10163
10164         /*
10165          * Obtain current RSSI value if possible, if not and no RSSI threshold
10166          * event has been received yet, we should receive an event after a
10167          * connection is established and enough beacons received to calculate
10168          * the average.
10169          */
10170         if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss &&
10171             rdev->ops->get_station) {
10172                 struct station_info sinfo = {};
10173                 u8 *mac_addr;
10174
10175                 mac_addr = wdev->current_bss->pub.bssid;
10176
10177                 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
10178                 if (err)
10179                         return err;
10180
10181                 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
10182                         wdev->cqm_config->last_rssi_event_value =
10183                                 (s8) sinfo.rx_beacon_signal_avg;
10184         }
10185
10186         last = wdev->cqm_config->last_rssi_event_value;
10187         hyst = wdev->cqm_config->rssi_hyst;
10188         n = wdev->cqm_config->n_rssi_thresholds;
10189
10190         for (i = 0; i < n; i++)
10191                 if (last < wdev->cqm_config->rssi_thresholds[i])
10192                         break;
10193
10194         low_index = i - 1;
10195         if (low_index >= 0) {
10196                 low_index = array_index_nospec(low_index, n);
10197                 low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;
10198         } else {
10199                 low = S32_MIN;
10200         }
10201         if (i < n) {
10202                 i = array_index_nospec(i, n);
10203                 high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;
10204         } else {
10205                 high = S32_MAX;
10206         }
10207
10208         return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
10209 }
10210
10211 static int nl80211_set_cqm_rssi(struct genl_info *info,
10212                                 const s32 *thresholds, int n_thresholds,
10213                                 u32 hysteresis)
10214 {
10215         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10216         struct net_device *dev = info->user_ptr[1];
10217         struct wireless_dev *wdev = dev->ieee80211_ptr;
10218         int i, err;
10219         s32 prev = S32_MIN;
10220
10221         /* Check all values negative and sorted */
10222         for (i = 0; i < n_thresholds; i++) {
10223                 if (thresholds[i] > 0 || thresholds[i] <= prev)
10224                         return -EINVAL;
10225
10226                 prev = thresholds[i];
10227         }
10228
10229         if (wdev->iftype != NL80211_IFTYPE_STATION &&
10230             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
10231                 return -EOPNOTSUPP;
10232
10233         wdev_lock(wdev);
10234         cfg80211_cqm_config_free(wdev);
10235         wdev_unlock(wdev);
10236
10237         if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
10238                 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
10239                         return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
10240
10241                 return rdev_set_cqm_rssi_config(rdev, dev,
10242                                                 thresholds[0], hysteresis);
10243         }
10244
10245         if (!wiphy_ext_feature_isset(&rdev->wiphy,
10246                                      NL80211_EXT_FEATURE_CQM_RSSI_LIST))
10247                 return -EOPNOTSUPP;
10248
10249         if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
10250                 n_thresholds = 0;
10251
10252         wdev_lock(wdev);
10253         if (n_thresholds) {
10254                 struct cfg80211_cqm_config *cqm_config;
10255
10256                 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) +
10257                                      n_thresholds * sizeof(s32), GFP_KERNEL);
10258                 if (!cqm_config) {
10259                         err = -ENOMEM;
10260                         goto unlock;
10261                 }
10262
10263                 cqm_config->rssi_hyst = hysteresis;
10264                 cqm_config->n_rssi_thresholds = n_thresholds;
10265                 memcpy(cqm_config->rssi_thresholds, thresholds,
10266                        n_thresholds * sizeof(s32));
10267
10268                 wdev->cqm_config = cqm_config;
10269         }
10270
10271         err = cfg80211_cqm_rssi_update(rdev, dev);
10272
10273 unlock:
10274         wdev_unlock(wdev);
10275
10276         return err;
10277 }
10278
10279 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
10280 {
10281         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
10282         struct nlattr *cqm;
10283         int err;
10284
10285         cqm = info->attrs[NL80211_ATTR_CQM];
10286         if (!cqm)
10287                 return -EINVAL;
10288
10289         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
10290                                nl80211_attr_cqm_policy, info->extack);
10291         if (err)
10292                 return err;
10293
10294         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
10295             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
10296                 const s32 *thresholds =
10297                         nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
10298                 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
10299                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
10300
10301                 if (len % 4)
10302                         return -EINVAL;
10303
10304                 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
10305                                             hysteresis);
10306         }
10307
10308         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
10309             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
10310             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
10311                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
10312                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
10313                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
10314
10315                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
10316         }
10317
10318         return -EINVAL;
10319 }
10320
10321 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
10322 {
10323         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10324         struct net_device *dev = info->user_ptr[1];
10325         struct ocb_setup setup = {};
10326         int err;
10327
10328         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
10329         if (err)
10330                 return err;
10331
10332         return cfg80211_join_ocb(rdev, dev, &setup);
10333 }
10334
10335 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
10336 {
10337         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10338         struct net_device *dev = info->user_ptr[1];
10339
10340         return cfg80211_leave_ocb(rdev, dev);
10341 }
10342
10343 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
10344 {
10345         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10346         struct net_device *dev = info->user_ptr[1];
10347         struct mesh_config cfg;
10348         struct mesh_setup setup;
10349         int err;
10350
10351         /* start with default */
10352         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
10353         memcpy(&setup, &default_mesh_setup, sizeof(setup));
10354
10355         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
10356                 /* and parse parameters if given */
10357                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
10358                 if (err)
10359                         return err;
10360         }
10361
10362         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
10363             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
10364                 return -EINVAL;
10365
10366         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
10367         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
10368
10369         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
10370             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
10371                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
10372                         return -EINVAL;
10373
10374         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
10375                 setup.beacon_interval =
10376                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
10377
10378                 err = cfg80211_validate_beacon_int(rdev,
10379                                                    NL80211_IFTYPE_MESH_POINT,
10380                                                    setup.beacon_interval);
10381                 if (err)
10382                         return err;
10383         }
10384
10385         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
10386                 setup.dtim_period =
10387                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
10388                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
10389                         return -EINVAL;
10390         }
10391
10392         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
10393                 /* parse additional setup parameters if given */
10394                 err = nl80211_parse_mesh_setup(info, &setup);
10395                 if (err)
10396                         return err;
10397         }
10398
10399         if (setup.user_mpm)
10400                 cfg.auto_open_plinks = false;
10401
10402         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
10403                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
10404                 if (err)
10405                         return err;
10406         } else {
10407                 /* __cfg80211_join_mesh() will sort it out */
10408                 setup.chandef.chan = NULL;
10409         }
10410
10411         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
10412                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10413                 int n_rates =
10414                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10415                 struct ieee80211_supported_band *sband;
10416
10417                 if (!setup.chandef.chan)
10418                         return -EINVAL;
10419
10420                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
10421
10422                 err = ieee80211_get_ratemask(sband, rates, n_rates,
10423                                              &setup.basic_rates);
10424                 if (err)
10425                         return err;
10426         }
10427
10428         if (info->attrs[NL80211_ATTR_TX_RATES]) {
10429                 err = nl80211_parse_tx_bitrate_mask(info, &setup.beacon_rate);
10430                 if (err)
10431                         return err;
10432
10433                 if (!setup.chandef.chan)
10434                         return -EINVAL;
10435
10436                 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
10437                                               &setup.beacon_rate);
10438                 if (err)
10439                         return err;
10440         }
10441
10442         setup.userspace_handles_dfs =
10443                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
10444
10445         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
10446                 int r = validate_pae_over_nl80211(rdev, info);
10447
10448                 if (r < 0)
10449                         return r;
10450
10451                 setup.control_port_over_nl80211 = true;
10452         }
10453
10454         wdev_lock(dev->ieee80211_ptr);
10455         err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
10456         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
10457                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
10458         wdev_unlock(dev->ieee80211_ptr);
10459
10460         return err;
10461 }
10462
10463 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
10464 {
10465         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10466         struct net_device *dev = info->user_ptr[1];
10467
10468         return cfg80211_leave_mesh(rdev, dev);
10469 }
10470
10471 #ifdef CONFIG_PM
10472 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
10473                                         struct cfg80211_registered_device *rdev)
10474 {
10475         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
10476         struct nlattr *nl_pats, *nl_pat;
10477         int i, pat_len;
10478
10479         if (!wowlan->n_patterns)
10480                 return 0;
10481
10482         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
10483         if (!nl_pats)
10484                 return -ENOBUFS;
10485
10486         for (i = 0; i < wowlan->n_patterns; i++) {
10487                 nl_pat = nla_nest_start(msg, i + 1);
10488                 if (!nl_pat)
10489                         return -ENOBUFS;
10490                 pat_len = wowlan->patterns[i].pattern_len;
10491                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
10492                             wowlan->patterns[i].mask) ||
10493                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
10494                             wowlan->patterns[i].pattern) ||
10495                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
10496                                 wowlan->patterns[i].pkt_offset))
10497                         return -ENOBUFS;
10498                 nla_nest_end(msg, nl_pat);
10499         }
10500         nla_nest_end(msg, nl_pats);
10501
10502         return 0;
10503 }
10504
10505 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
10506                                    struct cfg80211_wowlan_tcp *tcp)
10507 {
10508         struct nlattr *nl_tcp;
10509
10510         if (!tcp)
10511                 return 0;
10512
10513         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
10514         if (!nl_tcp)
10515                 return -ENOBUFS;
10516
10517         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
10518             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
10519             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
10520             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
10521             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
10522             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
10523                     tcp->payload_len, tcp->payload) ||
10524             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
10525                         tcp->data_interval) ||
10526             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
10527                     tcp->wake_len, tcp->wake_data) ||
10528             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
10529                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
10530                 return -ENOBUFS;
10531
10532         if (tcp->payload_seq.len &&
10533             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
10534                     sizeof(tcp->payload_seq), &tcp->payload_seq))
10535                 return -ENOBUFS;
10536
10537         if (tcp->payload_tok.len &&
10538             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
10539                     sizeof(tcp->payload_tok) + tcp->tokens_size,
10540                     &tcp->payload_tok))
10541                 return -ENOBUFS;
10542
10543         nla_nest_end(msg, nl_tcp);
10544
10545         return 0;
10546 }
10547
10548 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
10549                                   struct cfg80211_sched_scan_request *req)
10550 {
10551         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
10552         int i;
10553
10554         if (!req)
10555                 return 0;
10556
10557         nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
10558         if (!nd)
10559                 return -ENOBUFS;
10560
10561         if (req->n_scan_plans == 1 &&
10562             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
10563                         req->scan_plans[0].interval * 1000))
10564                 return -ENOBUFS;
10565
10566         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
10567                 return -ENOBUFS;
10568
10569         if (req->relative_rssi_set) {
10570                 struct nl80211_bss_select_rssi_adjust rssi_adjust;
10571
10572                 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
10573                                req->relative_rssi))
10574                         return -ENOBUFS;
10575
10576                 rssi_adjust.band = req->rssi_adjust.band;
10577                 rssi_adjust.delta = req->rssi_adjust.delta;
10578                 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
10579                             sizeof(rssi_adjust), &rssi_adjust))
10580                         return -ENOBUFS;
10581         }
10582
10583         freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
10584         if (!freqs)
10585                 return -ENOBUFS;
10586
10587         for (i = 0; i < req->n_channels; i++) {
10588                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
10589                         return -ENOBUFS;
10590         }
10591
10592         nla_nest_end(msg, freqs);
10593
10594         if (req->n_match_sets) {
10595                 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
10596                 if (!matches)
10597                         return -ENOBUFS;
10598
10599                 for (i = 0; i < req->n_match_sets; i++) {
10600                         match = nla_nest_start(msg, i);
10601                         if (!match)
10602                                 return -ENOBUFS;
10603
10604                         if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
10605                                     req->match_sets[i].ssid.ssid_len,
10606                                     req->match_sets[i].ssid.ssid))
10607                                 return -ENOBUFS;
10608                         nla_nest_end(msg, match);
10609                 }
10610                 nla_nest_end(msg, matches);
10611         }
10612
10613         scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
10614         if (!scan_plans)
10615                 return -ENOBUFS;
10616
10617         for (i = 0; i < req->n_scan_plans; i++) {
10618                 scan_plan = nla_nest_start(msg, i + 1);
10619                 if (!scan_plan)
10620                         return -ENOBUFS;
10621
10622                 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
10623                                 req->scan_plans[i].interval) ||
10624                     (req->scan_plans[i].iterations &&
10625                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
10626                                  req->scan_plans[i].iterations)))
10627                         return -ENOBUFS;
10628                 nla_nest_end(msg, scan_plan);
10629         }
10630         nla_nest_end(msg, scan_plans);
10631
10632         nla_nest_end(msg, nd);
10633
10634         return 0;
10635 }
10636
10637 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
10638 {
10639         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10640         struct sk_buff *msg;
10641         void *hdr;
10642         u32 size = NLMSG_DEFAULT_SIZE;
10643
10644         if (!rdev->wiphy.wowlan)
10645                 return -EOPNOTSUPP;
10646
10647         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
10648                 /* adjust size to have room for all the data */
10649                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
10650                         rdev->wiphy.wowlan_config->tcp->payload_len +
10651                         rdev->wiphy.wowlan_config->tcp->wake_len +
10652                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
10653         }
10654
10655         msg = nlmsg_new(size, GFP_KERNEL);
10656         if (!msg)
10657                 return -ENOMEM;
10658
10659         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10660                              NL80211_CMD_GET_WOWLAN);
10661         if (!hdr)
10662                 goto nla_put_failure;
10663
10664         if (rdev->wiphy.wowlan_config) {
10665                 struct nlattr *nl_wowlan;
10666
10667                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
10668                 if (!nl_wowlan)
10669                         goto nla_put_failure;
10670
10671                 if ((rdev->wiphy.wowlan_config->any &&
10672                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
10673                     (rdev->wiphy.wowlan_config->disconnect &&
10674                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
10675                     (rdev->wiphy.wowlan_config->magic_pkt &&
10676                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
10677                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
10678                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
10679                     (rdev->wiphy.wowlan_config->eap_identity_req &&
10680                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
10681                     (rdev->wiphy.wowlan_config->four_way_handshake &&
10682                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
10683                     (rdev->wiphy.wowlan_config->rfkill_release &&
10684                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
10685                         goto nla_put_failure;
10686
10687                 if (nl80211_send_wowlan_patterns(msg, rdev))
10688                         goto nla_put_failure;
10689
10690                 if (nl80211_send_wowlan_tcp(msg,
10691                                             rdev->wiphy.wowlan_config->tcp))
10692                         goto nla_put_failure;
10693
10694                 if (nl80211_send_wowlan_nd(
10695                             msg,
10696                             rdev->wiphy.wowlan_config->nd_config))
10697                         goto nla_put_failure;
10698
10699                 nla_nest_end(msg, nl_wowlan);
10700         }
10701
10702         genlmsg_end(msg, hdr);
10703         return genlmsg_reply(msg, info);
10704
10705 nla_put_failure:
10706         nlmsg_free(msg);
10707         return -ENOBUFS;
10708 }
10709
10710 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
10711                                     struct nlattr *attr,
10712                                     struct cfg80211_wowlan *trig)
10713 {
10714         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
10715         struct cfg80211_wowlan_tcp *cfg;
10716         struct nl80211_wowlan_tcp_data_token *tok = NULL;
10717         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
10718         u32 size;
10719         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
10720         int err, port;
10721
10722         if (!rdev->wiphy.wowlan->tcp)
10723                 return -EINVAL;
10724
10725         err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TCP, attr,
10726                                nl80211_wowlan_tcp_policy, NULL);
10727         if (err)
10728                 return err;
10729
10730         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
10731             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
10732             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
10733             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
10734             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
10735             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
10736             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
10737             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
10738                 return -EINVAL;
10739
10740         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
10741         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
10742                 return -EINVAL;
10743
10744         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
10745                         rdev->wiphy.wowlan->tcp->data_interval_max ||
10746             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
10747                 return -EINVAL;
10748
10749         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
10750         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
10751                 return -EINVAL;
10752
10753         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
10754         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
10755                 return -EINVAL;
10756
10757         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
10758                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
10759
10760                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
10761                 tokens_size = tokln - sizeof(*tok);
10762
10763                 if (!tok->len || tokens_size % tok->len)
10764                         return -EINVAL;
10765                 if (!rdev->wiphy.wowlan->tcp->tok)
10766                         return -EINVAL;
10767                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
10768                         return -EINVAL;
10769                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
10770                         return -EINVAL;
10771                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
10772                         return -EINVAL;
10773                 if (tok->offset + tok->len > data_size)
10774                         return -EINVAL;
10775         }
10776
10777         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
10778                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
10779                 if (!rdev->wiphy.wowlan->tcp->seq)
10780                         return -EINVAL;
10781                 if (seq->len == 0 || seq->len > 4)
10782                         return -EINVAL;
10783                 if (seq->len + seq->offset > data_size)
10784                         return -EINVAL;
10785         }
10786
10787         size = sizeof(*cfg);
10788         size += data_size;
10789         size += wake_size + wake_mask_size;
10790         size += tokens_size;
10791
10792         cfg = kzalloc(size, GFP_KERNEL);
10793         if (!cfg)
10794                 return -ENOMEM;
10795         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
10796         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
10797         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
10798                ETH_ALEN);
10799         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
10800                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
10801         else
10802                 port = 0;
10803 #ifdef CONFIG_INET
10804         /* allocate a socket and port for it and use it */
10805         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
10806                             IPPROTO_TCP, &cfg->sock, 1);
10807         if (err) {
10808                 kfree(cfg);
10809                 return err;
10810         }
10811         if (inet_csk_get_port(cfg->sock->sk, port)) {
10812                 sock_release(cfg->sock);
10813                 kfree(cfg);
10814                 return -EADDRINUSE;
10815         }
10816         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
10817 #else
10818         if (!port) {
10819                 kfree(cfg);
10820                 return -EINVAL;
10821         }
10822         cfg->src_port = port;
10823 #endif
10824
10825         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
10826         cfg->payload_len = data_size;
10827         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
10828         memcpy((void *)cfg->payload,
10829                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
10830                data_size);
10831         if (seq)
10832                 cfg->payload_seq = *seq;
10833         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
10834         cfg->wake_len = wake_size;
10835         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
10836         memcpy((void *)cfg->wake_data,
10837                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
10838                wake_size);
10839         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
10840                          data_size + wake_size;
10841         memcpy((void *)cfg->wake_mask,
10842                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
10843                wake_mask_size);
10844         if (tok) {
10845                 cfg->tokens_size = tokens_size;
10846                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
10847         }
10848
10849         trig->tcp = cfg;
10850
10851         return 0;
10852 }
10853
10854 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
10855                                    const struct wiphy_wowlan_support *wowlan,
10856                                    struct nlattr *attr,
10857                                    struct cfg80211_wowlan *trig)
10858 {
10859         struct nlattr **tb;
10860         int err;
10861
10862         tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
10863         if (!tb)
10864                 return -ENOMEM;
10865
10866         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
10867                 err = -EOPNOTSUPP;
10868                 goto out;
10869         }
10870
10871         err = nla_parse_nested(tb, NL80211_ATTR_MAX, attr, nl80211_policy,
10872                                NULL);
10873         if (err)
10874                 goto out;
10875
10876         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
10877                                                    wowlan->max_nd_match_sets);
10878         err = PTR_ERR_OR_ZERO(trig->nd_config);
10879         if (err)
10880                 trig->nd_config = NULL;
10881
10882 out:
10883         kfree(tb);
10884         return err;
10885 }
10886
10887 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
10888 {
10889         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10890         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
10891         struct cfg80211_wowlan new_triggers = {};
10892         struct cfg80211_wowlan *ntrig;
10893         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
10894         int err, i;
10895         bool prev_enabled = rdev->wiphy.wowlan_config;
10896         bool regular = false;
10897
10898         if (!wowlan)
10899                 return -EOPNOTSUPP;
10900
10901         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
10902                 cfg80211_rdev_free_wowlan(rdev);
10903                 rdev->wiphy.wowlan_config = NULL;
10904                 goto set_wakeup;
10905         }
10906
10907         err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TRIG,
10908                                info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
10909                                nl80211_wowlan_policy, info->extack);
10910         if (err)
10911                 return err;
10912
10913         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
10914                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
10915                         return -EINVAL;
10916                 new_triggers.any = true;
10917         }
10918
10919         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
10920                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
10921                         return -EINVAL;
10922                 new_triggers.disconnect = true;
10923                 regular = true;
10924         }
10925
10926         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
10927                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
10928                         return -EINVAL;
10929                 new_triggers.magic_pkt = true;
10930                 regular = true;
10931         }
10932
10933         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
10934                 return -EINVAL;
10935
10936         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
10937                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
10938                         return -EINVAL;
10939                 new_triggers.gtk_rekey_failure = true;
10940                 regular = true;
10941         }
10942
10943         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
10944                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
10945                         return -EINVAL;
10946                 new_triggers.eap_identity_req = true;
10947                 regular = true;
10948         }
10949
10950         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
10951                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
10952                         return -EINVAL;
10953                 new_triggers.four_way_handshake = true;
10954                 regular = true;
10955         }
10956
10957         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
10958                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
10959                         return -EINVAL;
10960                 new_triggers.rfkill_release = true;
10961                 regular = true;
10962         }
10963
10964         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
10965                 struct nlattr *pat;
10966                 int n_patterns = 0;
10967                 int rem, pat_len, mask_len, pkt_offset;
10968                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
10969
10970                 regular = true;
10971
10972                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
10973                                     rem)
10974                         n_patterns++;
10975                 if (n_patterns > wowlan->n_patterns)
10976                         return -EINVAL;
10977
10978                 new_triggers.patterns = kcalloc(n_patterns,
10979                                                 sizeof(new_triggers.patterns[0]),
10980                                                 GFP_KERNEL);
10981                 if (!new_triggers.patterns)
10982                         return -ENOMEM;
10983
10984                 new_triggers.n_patterns = n_patterns;
10985                 i = 0;
10986
10987                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
10988                                     rem) {
10989                         u8 *mask_pat;
10990
10991                         err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
10992                                                nl80211_packet_pattern_policy,
10993                                                info->extack);
10994                         if (err)
10995                                 goto error;
10996
10997                         err = -EINVAL;
10998                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
10999                             !pat_tb[NL80211_PKTPAT_PATTERN])
11000                                 goto error;
11001                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
11002                         mask_len = DIV_ROUND_UP(pat_len, 8);
11003                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
11004                                 goto error;
11005                         if (pat_len > wowlan->pattern_max_len ||
11006                             pat_len < wowlan->pattern_min_len)
11007                                 goto error;
11008
11009                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
11010                                 pkt_offset = 0;
11011                         else
11012                                 pkt_offset = nla_get_u32(
11013                                         pat_tb[NL80211_PKTPAT_OFFSET]);
11014                         if (pkt_offset > wowlan->max_pkt_offset)
11015                                 goto error;
11016                         new_triggers.patterns[i].pkt_offset = pkt_offset;
11017
11018                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
11019                         if (!mask_pat) {
11020                                 err = -ENOMEM;
11021                                 goto error;
11022                         }
11023                         new_triggers.patterns[i].mask = mask_pat;
11024                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
11025                                mask_len);
11026                         mask_pat += mask_len;
11027                         new_triggers.patterns[i].pattern = mask_pat;
11028                         new_triggers.patterns[i].pattern_len = pat_len;
11029                         memcpy(mask_pat,
11030                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
11031                                pat_len);
11032                         i++;
11033                 }
11034         }
11035
11036         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
11037                 regular = true;
11038                 err = nl80211_parse_wowlan_tcp(
11039                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
11040                         &new_triggers);
11041                 if (err)
11042                         goto error;
11043         }
11044
11045         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
11046                 regular = true;
11047                 err = nl80211_parse_wowlan_nd(
11048                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
11049                         &new_triggers);
11050                 if (err)
11051                         goto error;
11052         }
11053
11054         /* The 'any' trigger means the device continues operating more or less
11055          * as in its normal operation mode and wakes up the host on most of the
11056          * normal interrupts (like packet RX, ...)
11057          * It therefore makes little sense to combine with the more constrained
11058          * wakeup trigger modes.
11059          */
11060         if (new_triggers.any && regular) {
11061                 err = -EINVAL;
11062                 goto error;
11063         }
11064
11065         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
11066         if (!ntrig) {
11067                 err = -ENOMEM;
11068                 goto error;
11069         }
11070         cfg80211_rdev_free_wowlan(rdev);
11071         rdev->wiphy.wowlan_config = ntrig;
11072
11073  set_wakeup:
11074         if (rdev->ops->set_wakeup &&
11075             prev_enabled != !!rdev->wiphy.wowlan_config)
11076                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
11077
11078         return 0;
11079  error:
11080         for (i = 0; i < new_triggers.n_patterns; i++)
11081                 kfree(new_triggers.patterns[i].mask);
11082         kfree(new_triggers.patterns);
11083         if (new_triggers.tcp && new_triggers.tcp->sock)
11084                 sock_release(new_triggers.tcp->sock);
11085         kfree(new_triggers.tcp);
11086         kfree(new_triggers.nd_config);
11087         return err;
11088 }
11089 #endif
11090
11091 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
11092                                        struct cfg80211_registered_device *rdev)
11093 {
11094         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
11095         int i, j, pat_len;
11096         struct cfg80211_coalesce_rules *rule;
11097
11098         if (!rdev->coalesce->n_rules)
11099                 return 0;
11100
11101         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
11102         if (!nl_rules)
11103                 return -ENOBUFS;
11104
11105         for (i = 0; i < rdev->coalesce->n_rules; i++) {
11106                 nl_rule = nla_nest_start(msg, i + 1);
11107                 if (!nl_rule)
11108                         return -ENOBUFS;
11109
11110                 rule = &rdev->coalesce->rules[i];
11111                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
11112                                 rule->delay))
11113                         return -ENOBUFS;
11114
11115                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
11116                                 rule->condition))
11117                         return -ENOBUFS;
11118
11119                 nl_pats = nla_nest_start(msg,
11120                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
11121                 if (!nl_pats)
11122                         return -ENOBUFS;
11123
11124                 for (j = 0; j < rule->n_patterns; j++) {
11125                         nl_pat = nla_nest_start(msg, j + 1);
11126                         if (!nl_pat)
11127                                 return -ENOBUFS;
11128                         pat_len = rule->patterns[j].pattern_len;
11129                         if (nla_put(msg, NL80211_PKTPAT_MASK,
11130                                     DIV_ROUND_UP(pat_len, 8),
11131                                     rule->patterns[j].mask) ||
11132                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
11133                                     rule->patterns[j].pattern) ||
11134                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
11135                                         rule->patterns[j].pkt_offset))
11136                                 return -ENOBUFS;
11137                         nla_nest_end(msg, nl_pat);
11138                 }
11139                 nla_nest_end(msg, nl_pats);
11140                 nla_nest_end(msg, nl_rule);
11141         }
11142         nla_nest_end(msg, nl_rules);
11143
11144         return 0;
11145 }
11146
11147 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
11148 {
11149         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11150         struct sk_buff *msg;
11151         void *hdr;
11152
11153         if (!rdev->wiphy.coalesce)
11154                 return -EOPNOTSUPP;
11155
11156         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11157         if (!msg)
11158                 return -ENOMEM;
11159
11160         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11161                              NL80211_CMD_GET_COALESCE);
11162         if (!hdr)
11163                 goto nla_put_failure;
11164
11165         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
11166                 goto nla_put_failure;
11167
11168         genlmsg_end(msg, hdr);
11169         return genlmsg_reply(msg, info);
11170
11171 nla_put_failure:
11172         nlmsg_free(msg);
11173         return -ENOBUFS;
11174 }
11175
11176 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
11177 {
11178         struct cfg80211_coalesce *coalesce = rdev->coalesce;
11179         int i, j;
11180         struct cfg80211_coalesce_rules *rule;
11181
11182         if (!coalesce)
11183                 return;
11184
11185         for (i = 0; i < coalesce->n_rules; i++) {
11186                 rule = &coalesce->rules[i];
11187                 for (j = 0; j < rule->n_patterns; j++)
11188                         kfree(rule->patterns[j].mask);
11189                 kfree(rule->patterns);
11190         }
11191         kfree(coalesce->rules);
11192         kfree(coalesce);
11193         rdev->coalesce = NULL;
11194 }
11195
11196 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
11197                                        struct nlattr *rule,
11198                                        struct cfg80211_coalesce_rules *new_rule)
11199 {
11200         int err, i;
11201         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
11202         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
11203         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
11204         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
11205
11206         err = nla_parse_nested(tb, NL80211_ATTR_COALESCE_RULE_MAX, rule,
11207                                nl80211_coalesce_policy, NULL);
11208         if (err)
11209                 return err;
11210
11211         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
11212                 new_rule->delay =
11213                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
11214         if (new_rule->delay > coalesce->max_delay)
11215                 return -EINVAL;
11216
11217         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
11218                 new_rule->condition =
11219                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
11220
11221         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
11222                 return -EINVAL;
11223
11224         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
11225                             rem)
11226                 n_patterns++;
11227         if (n_patterns > coalesce->n_patterns)
11228                 return -EINVAL;
11229
11230         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
11231                                      GFP_KERNEL);
11232         if (!new_rule->patterns)
11233                 return -ENOMEM;
11234
11235         new_rule->n_patterns = n_patterns;
11236         i = 0;
11237
11238         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
11239                             rem) {
11240                 u8 *mask_pat;
11241
11242                 err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
11243                                        nl80211_packet_pattern_policy, NULL);
11244                 if (err)
11245                         return err;
11246
11247                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
11248                     !pat_tb[NL80211_PKTPAT_PATTERN])
11249                         return -EINVAL;
11250                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
11251                 mask_len = DIV_ROUND_UP(pat_len, 8);
11252                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
11253                         return -EINVAL;
11254                 if (pat_len > coalesce->pattern_max_len ||
11255                     pat_len < coalesce->pattern_min_len)
11256                         return -EINVAL;
11257
11258                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
11259                         pkt_offset = 0;
11260                 else
11261                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
11262                 if (pkt_offset > coalesce->max_pkt_offset)
11263                         return -EINVAL;
11264                 new_rule->patterns[i].pkt_offset = pkt_offset;
11265
11266                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
11267                 if (!mask_pat)
11268                         return -ENOMEM;
11269
11270                 new_rule->patterns[i].mask = mask_pat;
11271                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
11272                        mask_len);
11273
11274                 mask_pat += mask_len;
11275                 new_rule->patterns[i].pattern = mask_pat;
11276                 new_rule->patterns[i].pattern_len = pat_len;
11277                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
11278                        pat_len);
11279                 i++;
11280         }
11281
11282         return 0;
11283 }
11284
11285 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
11286 {
11287         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11288         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
11289         struct cfg80211_coalesce new_coalesce = {};
11290         struct cfg80211_coalesce *n_coalesce;
11291         int err, rem_rule, n_rules = 0, i, j;
11292         struct nlattr *rule;
11293         struct cfg80211_coalesce_rules *tmp_rule;
11294
11295         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
11296                 return -EOPNOTSUPP;
11297
11298         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
11299                 cfg80211_rdev_free_coalesce(rdev);
11300                 rdev_set_coalesce(rdev, NULL);
11301                 return 0;
11302         }
11303
11304         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
11305                             rem_rule)
11306                 n_rules++;
11307         if (n_rules > coalesce->n_rules)
11308                 return -EINVAL;
11309
11310         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
11311                                      GFP_KERNEL);
11312         if (!new_coalesce.rules)
11313                 return -ENOMEM;
11314
11315         new_coalesce.n_rules = n_rules;
11316         i = 0;
11317
11318         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
11319                             rem_rule) {
11320                 err = nl80211_parse_coalesce_rule(rdev, rule,
11321                                                   &new_coalesce.rules[i]);
11322                 if (err)
11323                         goto error;
11324
11325                 i++;
11326         }
11327
11328         err = rdev_set_coalesce(rdev, &new_coalesce);
11329         if (err)
11330                 goto error;
11331
11332         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
11333         if (!n_coalesce) {
11334                 err = -ENOMEM;
11335                 goto error;
11336         }
11337         cfg80211_rdev_free_coalesce(rdev);
11338         rdev->coalesce = n_coalesce;
11339
11340         return 0;
11341 error:
11342         for (i = 0; i < new_coalesce.n_rules; i++) {
11343                 tmp_rule = &new_coalesce.rules[i];
11344                 for (j = 0; j < tmp_rule->n_patterns; j++)
11345                         kfree(tmp_rule->patterns[j].mask);
11346                 kfree(tmp_rule->patterns);
11347         }
11348         kfree(new_coalesce.rules);
11349
11350         return err;
11351 }
11352
11353 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
11354 {
11355         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11356         struct net_device *dev = info->user_ptr[1];
11357         struct wireless_dev *wdev = dev->ieee80211_ptr;
11358         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
11359         struct cfg80211_gtk_rekey_data rekey_data;
11360         int err;
11361
11362         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
11363                 return -EINVAL;
11364
11365         err = nla_parse_nested(tb, MAX_NL80211_REKEY_DATA,
11366                                info->attrs[NL80211_ATTR_REKEY_DATA],
11367                                nl80211_rekey_policy, info->extack);
11368         if (err)
11369                 return err;
11370
11371         if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
11372             !tb[NL80211_REKEY_DATA_KCK])
11373                 return -EINVAL;
11374         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
11375                 return -ERANGE;
11376         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
11377                 return -ERANGE;
11378         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
11379                 return -ERANGE;
11380
11381         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
11382         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
11383         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
11384
11385         wdev_lock(wdev);
11386         if (!wdev->current_bss) {
11387                 err = -ENOTCONN;
11388                 goto out;
11389         }
11390
11391         if (!rdev->ops->set_rekey_data) {
11392                 err = -EOPNOTSUPP;
11393                 goto out;
11394         }
11395
11396         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
11397  out:
11398         wdev_unlock(wdev);
11399         return err;
11400 }
11401
11402 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
11403                                              struct genl_info *info)
11404 {
11405         struct net_device *dev = info->user_ptr[1];
11406         struct wireless_dev *wdev = dev->ieee80211_ptr;
11407
11408         if (wdev->iftype != NL80211_IFTYPE_AP &&
11409             wdev->iftype != NL80211_IFTYPE_P2P_GO)
11410                 return -EINVAL;
11411
11412         if (wdev->ap_unexpected_nlportid)
11413                 return -EBUSY;
11414
11415         wdev->ap_unexpected_nlportid = info->snd_portid;
11416         return 0;
11417 }
11418
11419 static int nl80211_probe_client(struct sk_buff *skb,
11420                                 struct genl_info *info)
11421 {
11422         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11423         struct net_device *dev = info->user_ptr[1];
11424         struct wireless_dev *wdev = dev->ieee80211_ptr;
11425         struct sk_buff *msg;
11426         void *hdr;
11427         const u8 *addr;
11428         u64 cookie;
11429         int err;
11430
11431         if (wdev->iftype != NL80211_IFTYPE_AP &&
11432             wdev->iftype != NL80211_IFTYPE_P2P_GO)
11433                 return -EOPNOTSUPP;
11434
11435         if (!info->attrs[NL80211_ATTR_MAC])
11436                 return -EINVAL;
11437
11438         if (!rdev->ops->probe_client)
11439                 return -EOPNOTSUPP;
11440
11441         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11442         if (!msg)
11443                 return -ENOMEM;
11444
11445         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11446                              NL80211_CMD_PROBE_CLIENT);
11447         if (!hdr) {
11448                 err = -ENOBUFS;
11449                 goto free_msg;
11450         }
11451
11452         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
11453
11454         err = rdev_probe_client(rdev, dev, addr, &cookie);
11455         if (err)
11456                 goto free_msg;
11457
11458         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11459                               NL80211_ATTR_PAD))
11460                 goto nla_put_failure;
11461
11462         genlmsg_end(msg, hdr);
11463
11464         return genlmsg_reply(msg, info);
11465
11466  nla_put_failure:
11467         err = -ENOBUFS;
11468  free_msg:
11469         nlmsg_free(msg);
11470         return err;
11471 }
11472
11473 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
11474 {
11475         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11476         struct cfg80211_beacon_registration *reg, *nreg;
11477         int rv;
11478
11479         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
11480                 return -EOPNOTSUPP;
11481
11482         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
11483         if (!nreg)
11484                 return -ENOMEM;
11485
11486         /* First, check if already registered. */
11487         spin_lock_bh(&rdev->beacon_registrations_lock);
11488         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
11489                 if (reg->nlportid == info->snd_portid) {
11490                         rv = -EALREADY;
11491                         goto out_err;
11492                 }
11493         }
11494         /* Add it to the list */
11495         nreg->nlportid = info->snd_portid;
11496         list_add(&nreg->list, &rdev->beacon_registrations);
11497
11498         spin_unlock_bh(&rdev->beacon_registrations_lock);
11499
11500         return 0;
11501 out_err:
11502         spin_unlock_bh(&rdev->beacon_registrations_lock);
11503         kfree(nreg);
11504         return rv;
11505 }
11506
11507 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
11508 {
11509         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11510         struct wireless_dev *wdev = info->user_ptr[1];
11511         int err;
11512
11513         if (!rdev->ops->start_p2p_device)
11514                 return -EOPNOTSUPP;
11515
11516         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11517                 return -EOPNOTSUPP;
11518
11519         if (wdev_running(wdev))
11520                 return 0;
11521
11522         if (rfkill_blocked(rdev->rfkill))
11523                 return -ERFKILL;
11524
11525         err = rdev_start_p2p_device(rdev, wdev);
11526         if (err)
11527                 return err;
11528
11529         wdev->is_running = true;
11530         rdev->opencount++;
11531
11532         return 0;
11533 }
11534
11535 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
11536 {
11537         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11538         struct wireless_dev *wdev = info->user_ptr[1];
11539
11540         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11541                 return -EOPNOTSUPP;
11542
11543         if (!rdev->ops->stop_p2p_device)
11544                 return -EOPNOTSUPP;
11545
11546         cfg80211_stop_p2p_device(rdev, wdev);
11547
11548         return 0;
11549 }
11550
11551 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
11552 {
11553         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11554         struct wireless_dev *wdev = info->user_ptr[1];
11555         struct cfg80211_nan_conf conf = {};
11556         int err;
11557
11558         if (wdev->iftype != NL80211_IFTYPE_NAN)
11559                 return -EOPNOTSUPP;
11560
11561         if (wdev_running(wdev))
11562                 return -EEXIST;
11563
11564         if (rfkill_blocked(rdev->rfkill))
11565                 return -ERFKILL;
11566
11567         if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
11568                 return -EINVAL;
11569
11570         conf.master_pref =
11571                 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
11572
11573         if (info->attrs[NL80211_ATTR_BANDS]) {
11574                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
11575
11576                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
11577                         return -EOPNOTSUPP;
11578
11579                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
11580                         return -EINVAL;
11581
11582                 conf.bands = bands;
11583         }
11584
11585         err = rdev_start_nan(rdev, wdev, &conf);
11586         if (err)
11587                 return err;
11588
11589         wdev->is_running = true;
11590         rdev->opencount++;
11591
11592         return 0;
11593 }
11594
11595 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
11596 {
11597         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11598         struct wireless_dev *wdev = info->user_ptr[1];
11599
11600         if (wdev->iftype != NL80211_IFTYPE_NAN)
11601                 return -EOPNOTSUPP;
11602
11603         cfg80211_stop_nan(rdev, wdev);
11604
11605         return 0;
11606 }
11607
11608 static int validate_nan_filter(struct nlattr *filter_attr)
11609 {
11610         struct nlattr *attr;
11611         int len = 0, n_entries = 0, rem;
11612
11613         nla_for_each_nested(attr, filter_attr, rem) {
11614                 len += nla_len(attr);
11615                 n_entries++;
11616         }
11617
11618         if (len >= U8_MAX)
11619                 return -EINVAL;
11620
11621         return n_entries;
11622 }
11623
11624 static int handle_nan_filter(struct nlattr *attr_filter,
11625                              struct cfg80211_nan_func *func,
11626                              bool tx)
11627 {
11628         struct nlattr *attr;
11629         int n_entries, rem, i;
11630         struct cfg80211_nan_func_filter *filter;
11631
11632         n_entries = validate_nan_filter(attr_filter);
11633         if (n_entries < 0)
11634                 return n_entries;
11635
11636         BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
11637
11638         filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
11639         if (!filter)
11640                 return -ENOMEM;
11641
11642         i = 0;
11643         nla_for_each_nested(attr, attr_filter, rem) {
11644                 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
11645                 filter[i].len = nla_len(attr);
11646                 i++;
11647         }
11648         if (tx) {
11649                 func->num_tx_filters = n_entries;
11650                 func->tx_filters = filter;
11651         } else {
11652                 func->num_rx_filters = n_entries;
11653                 func->rx_filters = filter;
11654         }
11655
11656         return 0;
11657 }
11658
11659 static int nl80211_nan_add_func(struct sk_buff *skb,
11660                                 struct genl_info *info)
11661 {
11662         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11663         struct wireless_dev *wdev = info->user_ptr[1];
11664         struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
11665         struct cfg80211_nan_func *func;
11666         struct sk_buff *msg = NULL;
11667         void *hdr = NULL;
11668         int err = 0;
11669
11670         if (wdev->iftype != NL80211_IFTYPE_NAN)
11671                 return -EOPNOTSUPP;
11672
11673         if (!wdev_running(wdev))
11674                 return -ENOTCONN;
11675
11676         if (!info->attrs[NL80211_ATTR_NAN_FUNC])
11677                 return -EINVAL;
11678
11679         err = nla_parse_nested(tb, NL80211_NAN_FUNC_ATTR_MAX,
11680                                info->attrs[NL80211_ATTR_NAN_FUNC],
11681                                nl80211_nan_func_policy, info->extack);
11682         if (err)
11683                 return err;
11684
11685         func = kzalloc(sizeof(*func), GFP_KERNEL);
11686         if (!func)
11687                 return -ENOMEM;
11688
11689         func->cookie = cfg80211_assign_cookie(rdev);
11690
11691         if (!tb[NL80211_NAN_FUNC_TYPE] ||
11692             nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]) > NL80211_NAN_FUNC_MAX_TYPE) {
11693                 err = -EINVAL;
11694                 goto out;
11695         }
11696
11697
11698         func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
11699
11700         if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
11701                 err = -EINVAL;
11702                 goto out;
11703         }
11704
11705         memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
11706                sizeof(func->service_id));
11707
11708         func->close_range =
11709                 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
11710
11711         if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
11712                 func->serv_spec_info_len =
11713                         nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
11714                 func->serv_spec_info =
11715                         kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
11716                                 func->serv_spec_info_len,
11717                                 GFP_KERNEL);
11718                 if (!func->serv_spec_info) {
11719                         err = -ENOMEM;
11720                         goto out;
11721                 }
11722         }
11723
11724         if (tb[NL80211_NAN_FUNC_TTL])
11725                 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
11726
11727         switch (func->type) {
11728         case NL80211_NAN_FUNC_PUBLISH:
11729                 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
11730                         err = -EINVAL;
11731                         goto out;
11732                 }
11733
11734                 func->publish_type =
11735                         nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
11736                 func->publish_bcast =
11737                         nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
11738
11739                 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
11740                         func->publish_bcast) {
11741                         err = -EINVAL;
11742                         goto out;
11743                 }
11744                 break;
11745         case NL80211_NAN_FUNC_SUBSCRIBE:
11746                 func->subscribe_active =
11747                         nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
11748                 break;
11749         case NL80211_NAN_FUNC_FOLLOW_UP:
11750                 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
11751                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
11752                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
11753                         err = -EINVAL;
11754                         goto out;
11755                 }
11756
11757                 func->followup_id =
11758                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
11759                 func->followup_reqid =
11760                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
11761                 memcpy(func->followup_dest.addr,
11762                        nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
11763                        sizeof(func->followup_dest.addr));
11764                 if (func->ttl) {
11765                         err = -EINVAL;
11766                         goto out;
11767                 }
11768                 break;
11769         default:
11770                 err = -EINVAL;
11771                 goto out;
11772         }
11773
11774         if (tb[NL80211_NAN_FUNC_SRF]) {
11775                 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
11776
11777                 err = nla_parse_nested(srf_tb, NL80211_NAN_SRF_ATTR_MAX,
11778                                        tb[NL80211_NAN_FUNC_SRF],
11779                                        nl80211_nan_srf_policy, info->extack);
11780                 if (err)
11781                         goto out;
11782
11783                 func->srf_include =
11784                         nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
11785
11786                 if (srf_tb[NL80211_NAN_SRF_BF]) {
11787                         if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
11788                             !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
11789                                 err = -EINVAL;
11790                                 goto out;
11791                         }
11792
11793                         func->srf_bf_len =
11794                                 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
11795                         func->srf_bf =
11796                                 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
11797                                         func->srf_bf_len, GFP_KERNEL);
11798                         if (!func->srf_bf) {
11799                                 err = -ENOMEM;
11800                                 goto out;
11801                         }
11802
11803                         func->srf_bf_idx =
11804                                 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
11805                 } else {
11806                         struct nlattr *attr, *mac_attr =
11807                                 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
11808                         int n_entries, rem, i = 0;
11809
11810                         if (!mac_attr) {
11811                                 err = -EINVAL;
11812                                 goto out;
11813                         }
11814
11815                         n_entries = validate_acl_mac_addrs(mac_attr);
11816                         if (n_entries <= 0) {
11817                                 err = -EINVAL;
11818                                 goto out;
11819                         }
11820
11821                         func->srf_num_macs = n_entries;
11822                         func->srf_macs =
11823                                 kcalloc(n_entries, sizeof(*func->srf_macs),
11824                                         GFP_KERNEL);
11825                         if (!func->srf_macs) {
11826                                 err = -ENOMEM;
11827                                 goto out;
11828                         }
11829
11830                         nla_for_each_nested(attr, mac_attr, rem)
11831                                 memcpy(func->srf_macs[i++].addr, nla_data(attr),
11832                                        sizeof(*func->srf_macs));
11833                 }
11834         }
11835
11836         if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
11837                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
11838                                         func, true);
11839                 if (err)
11840                         goto out;
11841         }
11842
11843         if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
11844                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
11845                                         func, false);
11846                 if (err)
11847                         goto out;
11848         }
11849
11850         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11851         if (!msg) {
11852                 err = -ENOMEM;
11853                 goto out;
11854         }
11855
11856         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11857                              NL80211_CMD_ADD_NAN_FUNCTION);
11858         /* This can't really happen - we just allocated 4KB */
11859         if (WARN_ON(!hdr)) {
11860                 err = -ENOMEM;
11861                 goto out;
11862         }
11863
11864         err = rdev_add_nan_func(rdev, wdev, func);
11865 out:
11866         if (err < 0) {
11867                 cfg80211_free_nan_func(func);
11868                 nlmsg_free(msg);
11869                 return err;
11870         }
11871
11872         /* propagate the instance id and cookie to userspace  */
11873         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
11874                               NL80211_ATTR_PAD))
11875                 goto nla_put_failure;
11876
11877         func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
11878         if (!func_attr)
11879                 goto nla_put_failure;
11880
11881         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
11882                        func->instance_id))
11883                 goto nla_put_failure;
11884
11885         nla_nest_end(msg, func_attr);
11886
11887         genlmsg_end(msg, hdr);
11888         return genlmsg_reply(msg, info);
11889
11890 nla_put_failure:
11891         nlmsg_free(msg);
11892         return -ENOBUFS;
11893 }
11894
11895 static int nl80211_nan_del_func(struct sk_buff *skb,
11896                                struct genl_info *info)
11897 {
11898         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11899         struct wireless_dev *wdev = info->user_ptr[1];
11900         u64 cookie;
11901
11902         if (wdev->iftype != NL80211_IFTYPE_NAN)
11903                 return -EOPNOTSUPP;
11904
11905         if (!wdev_running(wdev))
11906                 return -ENOTCONN;
11907
11908         if (!info->attrs[NL80211_ATTR_COOKIE])
11909                 return -EINVAL;
11910
11911         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
11912
11913         rdev_del_nan_func(rdev, wdev, cookie);
11914
11915         return 0;
11916 }
11917
11918 static int nl80211_nan_change_config(struct sk_buff *skb,
11919                                      struct genl_info *info)
11920 {
11921         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11922         struct wireless_dev *wdev = info->user_ptr[1];
11923         struct cfg80211_nan_conf conf = {};
11924         u32 changed = 0;
11925
11926         if (wdev->iftype != NL80211_IFTYPE_NAN)
11927                 return -EOPNOTSUPP;
11928
11929         if (!wdev_running(wdev))
11930                 return -ENOTCONN;
11931
11932         if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
11933                 conf.master_pref =
11934                         nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
11935                 if (conf.master_pref <= 1 || conf.master_pref == 255)
11936                         return -EINVAL;
11937
11938                 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
11939         }
11940
11941         if (info->attrs[NL80211_ATTR_BANDS]) {
11942                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
11943
11944                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
11945                         return -EOPNOTSUPP;
11946
11947                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
11948                         return -EINVAL;
11949
11950                 conf.bands = bands;
11951                 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
11952         }
11953
11954         if (!changed)
11955                 return -EINVAL;
11956
11957         return rdev_nan_change_conf(rdev, wdev, &conf, changed);
11958 }
11959
11960 void cfg80211_nan_match(struct wireless_dev *wdev,
11961                         struct cfg80211_nan_match_params *match, gfp_t gfp)
11962 {
11963         struct wiphy *wiphy = wdev->wiphy;
11964         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11965         struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
11966         struct sk_buff *msg;
11967         void *hdr;
11968
11969         if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
11970                 return;
11971
11972         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11973         if (!msg)
11974                 return;
11975
11976         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
11977         if (!hdr) {
11978                 nlmsg_free(msg);
11979                 return;
11980         }
11981
11982         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11983             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11984                                          wdev->netdev->ifindex)) ||
11985             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
11986                               NL80211_ATTR_PAD))
11987                 goto nla_put_failure;
11988
11989         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
11990                               NL80211_ATTR_PAD) ||
11991             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
11992                 goto nla_put_failure;
11993
11994         match_attr = nla_nest_start(msg, NL80211_ATTR_NAN_MATCH);
11995         if (!match_attr)
11996                 goto nla_put_failure;
11997
11998         local_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_LOCAL);
11999         if (!local_func_attr)
12000                 goto nla_put_failure;
12001
12002         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
12003                 goto nla_put_failure;
12004
12005         nla_nest_end(msg, local_func_attr);
12006
12007         peer_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_PEER);
12008         if (!peer_func_attr)
12009                 goto nla_put_failure;
12010
12011         if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
12012             nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
12013                 goto nla_put_failure;
12014
12015         if (match->info && match->info_len &&
12016             nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
12017                     match->info))
12018                 goto nla_put_failure;
12019
12020         nla_nest_end(msg, peer_func_attr);
12021         nla_nest_end(msg, match_attr);
12022         genlmsg_end(msg, hdr);
12023
12024         if (!wdev->owner_nlportid)
12025                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12026                                         msg, 0, NL80211_MCGRP_NAN, gfp);
12027         else
12028                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
12029                                 wdev->owner_nlportid);
12030
12031         return;
12032
12033 nla_put_failure:
12034         nlmsg_free(msg);
12035 }
12036 EXPORT_SYMBOL(cfg80211_nan_match);
12037
12038 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
12039                                   u8 inst_id,
12040                                   enum nl80211_nan_func_term_reason reason,
12041                                   u64 cookie, gfp_t gfp)
12042 {
12043         struct wiphy *wiphy = wdev->wiphy;
12044         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12045         struct sk_buff *msg;
12046         struct nlattr *func_attr;
12047         void *hdr;
12048
12049         if (WARN_ON(!inst_id))
12050                 return;
12051
12052         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12053         if (!msg)
12054                 return;
12055
12056         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
12057         if (!hdr) {
12058                 nlmsg_free(msg);
12059                 return;
12060         }
12061
12062         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12063             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12064                                          wdev->netdev->ifindex)) ||
12065             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12066                               NL80211_ATTR_PAD))
12067                 goto nla_put_failure;
12068
12069         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12070                               NL80211_ATTR_PAD))
12071                 goto nla_put_failure;
12072
12073         func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
12074         if (!func_attr)
12075                 goto nla_put_failure;
12076
12077         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
12078             nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
12079                 goto nla_put_failure;
12080
12081         nla_nest_end(msg, func_attr);
12082         genlmsg_end(msg, hdr);
12083
12084         if (!wdev->owner_nlportid)
12085                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12086                                         msg, 0, NL80211_MCGRP_NAN, gfp);
12087         else
12088                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
12089                                 wdev->owner_nlportid);
12090
12091         return;
12092
12093 nla_put_failure:
12094         nlmsg_free(msg);
12095 }
12096 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
12097
12098 static int nl80211_get_protocol_features(struct sk_buff *skb,
12099                                          struct genl_info *info)
12100 {
12101         void *hdr;
12102         struct sk_buff *msg;
12103
12104         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12105         if (!msg)
12106                 return -ENOMEM;
12107
12108         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12109                              NL80211_CMD_GET_PROTOCOL_FEATURES);
12110         if (!hdr)
12111                 goto nla_put_failure;
12112
12113         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
12114                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
12115                 goto nla_put_failure;
12116
12117         genlmsg_end(msg, hdr);
12118         return genlmsg_reply(msg, info);
12119
12120  nla_put_failure:
12121         kfree_skb(msg);
12122         return -ENOBUFS;
12123 }
12124
12125 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
12126 {
12127         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12128         struct cfg80211_update_ft_ies_params ft_params;
12129         struct net_device *dev = info->user_ptr[1];
12130
12131         if (!rdev->ops->update_ft_ies)
12132                 return -EOPNOTSUPP;
12133
12134         if (!info->attrs[NL80211_ATTR_MDID] ||
12135             !info->attrs[NL80211_ATTR_IE])
12136                 return -EINVAL;
12137
12138         memset(&ft_params, 0, sizeof(ft_params));
12139         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
12140         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12141         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12142
12143         return rdev_update_ft_ies(rdev, dev, &ft_params);
12144 }
12145
12146 static int nl80211_crit_protocol_start(struct sk_buff *skb,
12147                                        struct genl_info *info)
12148 {
12149         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12150         struct wireless_dev *wdev = info->user_ptr[1];
12151         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
12152         u16 duration;
12153         int ret;
12154
12155         if (!rdev->ops->crit_proto_start)
12156                 return -EOPNOTSUPP;
12157
12158         if (WARN_ON(!rdev->ops->crit_proto_stop))
12159                 return -EINVAL;
12160
12161         if (rdev->crit_proto_nlportid)
12162                 return -EBUSY;
12163
12164         /* determine protocol if provided */
12165         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
12166                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
12167
12168         if (proto >= NUM_NL80211_CRIT_PROTO)
12169                 return -EINVAL;
12170
12171         /* timeout must be provided */
12172         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
12173                 return -EINVAL;
12174
12175         duration =
12176                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
12177
12178         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
12179                 return -ERANGE;
12180
12181         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
12182         if (!ret)
12183                 rdev->crit_proto_nlportid = info->snd_portid;
12184
12185         return ret;
12186 }
12187
12188 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
12189                                       struct genl_info *info)
12190 {
12191         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12192         struct wireless_dev *wdev = info->user_ptr[1];
12193
12194         if (!rdev->ops->crit_proto_stop)
12195                 return -EOPNOTSUPP;
12196
12197         if (rdev->crit_proto_nlportid) {
12198                 rdev->crit_proto_nlportid = 0;
12199                 rdev_crit_proto_stop(rdev, wdev);
12200         }
12201         return 0;
12202 }
12203
12204 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
12205 {
12206         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12207         struct wireless_dev *wdev =
12208                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
12209         int i, err;
12210         u32 vid, subcmd;
12211
12212         if (!rdev->wiphy.vendor_commands)
12213                 return -EOPNOTSUPP;
12214
12215         if (IS_ERR(wdev)) {
12216                 err = PTR_ERR(wdev);
12217                 if (err != -EINVAL)
12218                         return err;
12219                 wdev = NULL;
12220         } else if (wdev->wiphy != &rdev->wiphy) {
12221                 return -EINVAL;
12222         }
12223
12224         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
12225             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
12226                 return -EINVAL;
12227
12228         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
12229         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
12230         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
12231                 const struct wiphy_vendor_command *vcmd;
12232                 void *data = NULL;
12233                 int len = 0;
12234
12235                 vcmd = &rdev->wiphy.vendor_commands[i];
12236
12237                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
12238                         continue;
12239
12240                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
12241                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
12242                         if (!wdev)
12243                                 return -EINVAL;
12244                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
12245                             !wdev->netdev)
12246                                 return -EINVAL;
12247
12248                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
12249                                 if (!wdev_running(wdev))
12250                                         return -ENETDOWN;
12251                         }
12252
12253                         if (!vcmd->doit)
12254                                 return -EOPNOTSUPP;
12255                 } else {
12256                         wdev = NULL;
12257                 }
12258
12259                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
12260                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
12261                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
12262                 }
12263
12264                 rdev->cur_cmd_info = info;
12265                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
12266                                                           data, len);
12267                 rdev->cur_cmd_info = NULL;
12268                 return err;
12269         }
12270
12271         return -EOPNOTSUPP;
12272 }
12273
12274 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
12275                                        struct netlink_callback *cb,
12276                                        struct cfg80211_registered_device **rdev,
12277                                        struct wireless_dev **wdev)
12278 {
12279         struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
12280         u32 vid, subcmd;
12281         unsigned int i;
12282         int vcmd_idx = -1;
12283         int err;
12284         void *data = NULL;
12285         unsigned int data_len = 0;
12286
12287         if (cb->args[0]) {
12288                 /* subtract the 1 again here */
12289                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
12290                 struct wireless_dev *tmp;
12291
12292                 if (!wiphy)
12293                         return -ENODEV;
12294                 *rdev = wiphy_to_rdev(wiphy);
12295                 *wdev = NULL;
12296
12297                 if (cb->args[1]) {
12298                         list_for_each_entry(tmp, &wiphy->wdev_list, list) {
12299                                 if (tmp->identifier == cb->args[1] - 1) {
12300                                         *wdev = tmp;
12301                                         break;
12302                                 }
12303                         }
12304                 }
12305
12306                 /* keep rtnl locked in successful case */
12307                 return 0;
12308         }
12309
12310         err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, attrbuf,
12311                           nl80211_fam.maxattr, nl80211_policy, NULL);
12312         if (err)
12313                 return err;
12314
12315         if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
12316             !attrbuf[NL80211_ATTR_VENDOR_SUBCMD])
12317                 return -EINVAL;
12318
12319         *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf);
12320         if (IS_ERR(*wdev))
12321                 *wdev = NULL;
12322
12323         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
12324         if (IS_ERR(*rdev))
12325                 return PTR_ERR(*rdev);
12326
12327         vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
12328         subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
12329
12330         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
12331                 const struct wiphy_vendor_command *vcmd;
12332
12333                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
12334
12335                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
12336                         continue;
12337
12338                 if (!vcmd->dumpit)
12339                         return -EOPNOTSUPP;
12340
12341                 vcmd_idx = i;
12342                 break;
12343         }
12344
12345         if (vcmd_idx < 0)
12346                 return -EOPNOTSUPP;
12347
12348         if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
12349                 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
12350                 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
12351         }
12352
12353         /* 0 is the first index - add 1 to parse only once */
12354         cb->args[0] = (*rdev)->wiphy_idx + 1;
12355         /* add 1 to know if it was NULL */
12356         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
12357         cb->args[2] = vcmd_idx;
12358         cb->args[3] = (unsigned long)data;
12359         cb->args[4] = data_len;
12360
12361         /* keep rtnl locked in successful case */
12362         return 0;
12363 }
12364
12365 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
12366                                    struct netlink_callback *cb)
12367 {
12368         struct cfg80211_registered_device *rdev;
12369         struct wireless_dev *wdev;
12370         unsigned int vcmd_idx;
12371         const struct wiphy_vendor_command *vcmd;
12372         void *data;
12373         int data_len;
12374         int err;
12375         struct nlattr *vendor_data;
12376
12377         rtnl_lock();
12378         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
12379         if (err)
12380                 goto out;
12381
12382         vcmd_idx = cb->args[2];
12383         data = (void *)cb->args[3];
12384         data_len = cb->args[4];
12385         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
12386
12387         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
12388                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
12389                 if (!wdev) {
12390                         err = -EINVAL;
12391                         goto out;
12392                 }
12393                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
12394                     !wdev->netdev) {
12395                         err = -EINVAL;
12396                         goto out;
12397                 }
12398
12399                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
12400                         if (!wdev_running(wdev)) {
12401                                 err = -ENETDOWN;
12402                                 goto out;
12403                         }
12404                 }
12405         }
12406
12407         while (1) {
12408                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
12409                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
12410                                            NL80211_CMD_VENDOR);
12411                 if (!hdr)
12412                         break;
12413
12414                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12415                     (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
12416                                                wdev_id(wdev),
12417                                                NL80211_ATTR_PAD))) {
12418                         genlmsg_cancel(skb, hdr);
12419                         break;
12420                 }
12421
12422                 vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA);
12423                 if (!vendor_data) {
12424                         genlmsg_cancel(skb, hdr);
12425                         break;
12426                 }
12427
12428                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
12429                                    (unsigned long *)&cb->args[5]);
12430                 nla_nest_end(skb, vendor_data);
12431
12432                 if (err == -ENOBUFS || err == -ENOENT) {
12433                         genlmsg_cancel(skb, hdr);
12434                         break;
12435                 } else if (err) {
12436                         genlmsg_cancel(skb, hdr);
12437                         goto out;
12438                 }
12439
12440                 genlmsg_end(skb, hdr);
12441         }
12442
12443         err = skb->len;
12444  out:
12445         rtnl_unlock();
12446         return err;
12447 }
12448
12449 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
12450                                            enum nl80211_commands cmd,
12451                                            enum nl80211_attrs attr,
12452                                            int approxlen)
12453 {
12454         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12455
12456         if (WARN_ON(!rdev->cur_cmd_info))
12457                 return NULL;
12458
12459         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
12460                                            rdev->cur_cmd_info->snd_portid,
12461                                            rdev->cur_cmd_info->snd_seq,
12462                                            cmd, attr, NULL, GFP_KERNEL);
12463 }
12464 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
12465
12466 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
12467 {
12468         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
12469         void *hdr = ((void **)skb->cb)[1];
12470         struct nlattr *data = ((void **)skb->cb)[2];
12471
12472         /* clear CB data for netlink core to own from now on */
12473         memset(skb->cb, 0, sizeof(skb->cb));
12474
12475         if (WARN_ON(!rdev->cur_cmd_info)) {
12476                 kfree_skb(skb);
12477                 return -EINVAL;
12478         }
12479
12480         nla_nest_end(skb, data);
12481         genlmsg_end(skb, hdr);
12482         return genlmsg_reply(skb, rdev->cur_cmd_info);
12483 }
12484 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
12485
12486 static int nl80211_set_qos_map(struct sk_buff *skb,
12487                                struct genl_info *info)
12488 {
12489         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12490         struct cfg80211_qos_map *qos_map = NULL;
12491         struct net_device *dev = info->user_ptr[1];
12492         u8 *pos, len, num_des, des_len, des;
12493         int ret;
12494
12495         if (!rdev->ops->set_qos_map)
12496                 return -EOPNOTSUPP;
12497
12498         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
12499                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
12500                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
12501
12502                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
12503                     len > IEEE80211_QOS_MAP_LEN_MAX)
12504                         return -EINVAL;
12505
12506                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
12507                 if (!qos_map)
12508                         return -ENOMEM;
12509
12510                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
12511                 if (num_des) {
12512                         des_len = num_des *
12513                                 sizeof(struct cfg80211_dscp_exception);
12514                         memcpy(qos_map->dscp_exception, pos, des_len);
12515                         qos_map->num_des = num_des;
12516                         for (des = 0; des < num_des; des++) {
12517                                 if (qos_map->dscp_exception[des].up > 7) {
12518                                         kfree(qos_map);
12519                                         return -EINVAL;
12520                                 }
12521                         }
12522                         pos += des_len;
12523                 }
12524                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
12525         }
12526
12527         wdev_lock(dev->ieee80211_ptr);
12528         ret = nl80211_key_allowed(dev->ieee80211_ptr);
12529         if (!ret)
12530                 ret = rdev_set_qos_map(rdev, dev, qos_map);
12531         wdev_unlock(dev->ieee80211_ptr);
12532
12533         kfree(qos_map);
12534         return ret;
12535 }
12536
12537 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
12538 {
12539         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12540         struct net_device *dev = info->user_ptr[1];
12541         struct wireless_dev *wdev = dev->ieee80211_ptr;
12542         const u8 *peer;
12543         u8 tsid, up;
12544         u16 admitted_time = 0;
12545         int err;
12546
12547         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
12548                 return -EOPNOTSUPP;
12549
12550         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
12551             !info->attrs[NL80211_ATTR_USER_PRIO])
12552                 return -EINVAL;
12553
12554         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
12555         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
12556
12557         /* WMM uses TIDs 0-7 even for TSPEC */
12558         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
12559                 /* TODO: handle 802.11 TSPEC/admission control
12560                  * need more attributes for that (e.g. BA session requirement);
12561                  * change the WMM adminssion test above to allow both then
12562                  */
12563                 return -EINVAL;
12564         }
12565
12566         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12567
12568         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
12569                 admitted_time =
12570                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
12571                 if (!admitted_time)
12572                         return -EINVAL;
12573         }
12574
12575         wdev_lock(wdev);
12576         switch (wdev->iftype) {
12577         case NL80211_IFTYPE_STATION:
12578         case NL80211_IFTYPE_P2P_CLIENT:
12579                 if (wdev->current_bss)
12580                         break;
12581                 err = -ENOTCONN;
12582                 goto out;
12583         default:
12584                 err = -EOPNOTSUPP;
12585                 goto out;
12586         }
12587
12588         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
12589
12590  out:
12591         wdev_unlock(wdev);
12592         return err;
12593 }
12594
12595 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
12596 {
12597         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12598         struct net_device *dev = info->user_ptr[1];
12599         struct wireless_dev *wdev = dev->ieee80211_ptr;
12600         const u8 *peer;
12601         u8 tsid;
12602         int err;
12603
12604         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
12605                 return -EINVAL;
12606
12607         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
12608         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12609
12610         wdev_lock(wdev);
12611         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
12612         wdev_unlock(wdev);
12613
12614         return err;
12615 }
12616
12617 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
12618                                        struct genl_info *info)
12619 {
12620         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12621         struct net_device *dev = info->user_ptr[1];
12622         struct wireless_dev *wdev = dev->ieee80211_ptr;
12623         struct cfg80211_chan_def chandef = {};
12624         const u8 *addr;
12625         u8 oper_class;
12626         int err;
12627
12628         if (!rdev->ops->tdls_channel_switch ||
12629             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
12630                 return -EOPNOTSUPP;
12631
12632         switch (dev->ieee80211_ptr->iftype) {
12633         case NL80211_IFTYPE_STATION:
12634         case NL80211_IFTYPE_P2P_CLIENT:
12635                 break;
12636         default:
12637                 return -EOPNOTSUPP;
12638         }
12639
12640         if (!info->attrs[NL80211_ATTR_MAC] ||
12641             !info->attrs[NL80211_ATTR_OPER_CLASS])
12642                 return -EINVAL;
12643
12644         err = nl80211_parse_chandef(rdev, info, &chandef);
12645         if (err)
12646                 return err;
12647
12648         /*
12649          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
12650          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
12651          * specification is not defined for them.
12652          */
12653         if (chandef.chan->band == NL80211_BAND_2GHZ &&
12654             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
12655             chandef.width != NL80211_CHAN_WIDTH_20)
12656                 return -EINVAL;
12657
12658         /* we will be active on the TDLS link */
12659         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
12660                                            wdev->iftype))
12661                 return -EINVAL;
12662
12663         /* don't allow switching to DFS channels */
12664         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
12665                 return -EINVAL;
12666
12667         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12668         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
12669
12670         wdev_lock(wdev);
12671         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
12672         wdev_unlock(wdev);
12673
12674         return err;
12675 }
12676
12677 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
12678                                               struct genl_info *info)
12679 {
12680         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12681         struct net_device *dev = info->user_ptr[1];
12682         struct wireless_dev *wdev = dev->ieee80211_ptr;
12683         const u8 *addr;
12684
12685         if (!rdev->ops->tdls_channel_switch ||
12686             !rdev->ops->tdls_cancel_channel_switch ||
12687             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
12688                 return -EOPNOTSUPP;
12689
12690         switch (dev->ieee80211_ptr->iftype) {
12691         case NL80211_IFTYPE_STATION:
12692         case NL80211_IFTYPE_P2P_CLIENT:
12693                 break;
12694         default:
12695                 return -EOPNOTSUPP;
12696         }
12697
12698         if (!info->attrs[NL80211_ATTR_MAC])
12699                 return -EINVAL;
12700
12701         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12702
12703         wdev_lock(wdev);
12704         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
12705         wdev_unlock(wdev);
12706
12707         return 0;
12708 }
12709
12710 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
12711                                             struct genl_info *info)
12712 {
12713         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12714         struct net_device *dev = info->user_ptr[1];
12715         struct wireless_dev *wdev = dev->ieee80211_ptr;
12716         const struct nlattr *nla;
12717         bool enabled;
12718
12719         if (!rdev->ops->set_multicast_to_unicast)
12720                 return -EOPNOTSUPP;
12721
12722         if (wdev->iftype != NL80211_IFTYPE_AP &&
12723             wdev->iftype != NL80211_IFTYPE_P2P_GO)
12724                 return -EOPNOTSUPP;
12725
12726         nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
12727         enabled = nla_get_flag(nla);
12728
12729         return rdev_set_multicast_to_unicast(rdev, dev, enabled);
12730 }
12731
12732 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
12733 {
12734         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12735         struct net_device *dev = info->user_ptr[1];
12736         struct wireless_dev *wdev = dev->ieee80211_ptr;
12737         struct cfg80211_pmk_conf pmk_conf = {};
12738         int ret;
12739
12740         if (wdev->iftype != NL80211_IFTYPE_STATION &&
12741             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12742                 return -EOPNOTSUPP;
12743
12744         if (!wiphy_ext_feature_isset(&rdev->wiphy,
12745                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
12746                 return -EOPNOTSUPP;
12747
12748         if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
12749                 return -EINVAL;
12750
12751         wdev_lock(wdev);
12752         if (!wdev->current_bss) {
12753                 ret = -ENOTCONN;
12754                 goto out;
12755         }
12756
12757         pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
12758         if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) {
12759                 ret = -EINVAL;
12760                 goto out;
12761         }
12762
12763         pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
12764         pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
12765         if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
12766             pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
12767                 ret = -EINVAL;
12768                 goto out;
12769         }
12770
12771         if (info->attrs[NL80211_ATTR_PMKR0_NAME]) {
12772                 int r0_name_len = nla_len(info->attrs[NL80211_ATTR_PMKR0_NAME]);
12773
12774                 if (r0_name_len != WLAN_PMK_NAME_LEN) {
12775                         ret = -EINVAL;
12776                         goto out;
12777                 }
12778
12779                 pmk_conf.pmk_r0_name =
12780                         nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
12781         }
12782
12783         ret = rdev_set_pmk(rdev, dev, &pmk_conf);
12784 out:
12785         wdev_unlock(wdev);
12786         return ret;
12787 }
12788
12789 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
12790 {
12791         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12792         struct net_device *dev = info->user_ptr[1];
12793         struct wireless_dev *wdev = dev->ieee80211_ptr;
12794         const u8 *aa;
12795         int ret;
12796
12797         if (wdev->iftype != NL80211_IFTYPE_STATION &&
12798             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12799                 return -EOPNOTSUPP;
12800
12801         if (!wiphy_ext_feature_isset(&rdev->wiphy,
12802                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
12803                 return -EOPNOTSUPP;
12804
12805         if (!info->attrs[NL80211_ATTR_MAC])
12806                 return -EINVAL;
12807
12808         wdev_lock(wdev);
12809         aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
12810         ret = rdev_del_pmk(rdev, dev, aa);
12811         wdev_unlock(wdev);
12812
12813         return ret;
12814 }
12815
12816 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
12817 {
12818         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12819         struct net_device *dev = info->user_ptr[1];
12820         struct cfg80211_external_auth_params params;
12821
12822         if (!rdev->ops->external_auth)
12823                 return -EOPNOTSUPP;
12824
12825         if (!info->attrs[NL80211_ATTR_SSID])
12826                 return -EINVAL;
12827
12828         if (!info->attrs[NL80211_ATTR_BSSID])
12829                 return -EINVAL;
12830
12831         if (!info->attrs[NL80211_ATTR_STATUS_CODE])
12832                 return -EINVAL;
12833
12834         memset(&params, 0, sizeof(params));
12835
12836         params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12837         if (params.ssid.ssid_len == 0 ||
12838             params.ssid.ssid_len > IEEE80211_MAX_SSID_LEN)
12839                 return -EINVAL;
12840         memcpy(params.ssid.ssid, nla_data(info->attrs[NL80211_ATTR_SSID]),
12841                params.ssid.ssid_len);
12842
12843         memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
12844                ETH_ALEN);
12845
12846         params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
12847
12848         return rdev_external_auth(rdev, dev, &params);
12849 }
12850
12851 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
12852 {
12853         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12854         struct net_device *dev = info->user_ptr[1];
12855         struct wireless_dev *wdev = dev->ieee80211_ptr;
12856         const u8 *buf;
12857         size_t len;
12858         u8 *dest;
12859         u16 proto;
12860         bool noencrypt;
12861         int err;
12862
12863         if (!wiphy_ext_feature_isset(&rdev->wiphy,
12864                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
12865                 return -EOPNOTSUPP;
12866
12867         if (!rdev->ops->tx_control_port)
12868                 return -EOPNOTSUPP;
12869
12870         if (!info->attrs[NL80211_ATTR_FRAME] ||
12871             !info->attrs[NL80211_ATTR_MAC] ||
12872             !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
12873                 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
12874                 return -EINVAL;
12875         }
12876
12877         wdev_lock(wdev);
12878
12879         switch (wdev->iftype) {
12880         case NL80211_IFTYPE_AP:
12881         case NL80211_IFTYPE_P2P_GO:
12882         case NL80211_IFTYPE_MESH_POINT:
12883                 break;
12884         case NL80211_IFTYPE_ADHOC:
12885         case NL80211_IFTYPE_STATION:
12886         case NL80211_IFTYPE_P2P_CLIENT:
12887                 if (wdev->current_bss)
12888                         break;
12889                 err = -ENOTCONN;
12890                 goto out;
12891         default:
12892                 err = -EOPNOTSUPP;
12893                 goto out;
12894         }
12895
12896         wdev_unlock(wdev);
12897
12898         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
12899         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
12900         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
12901         proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
12902         noencrypt =
12903                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
12904
12905         return rdev_tx_control_port(rdev, dev, buf, len,
12906                                     dest, cpu_to_be16(proto), noencrypt);
12907
12908  out:
12909         wdev_unlock(wdev);
12910         return err;
12911 }
12912
12913 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
12914                                            struct genl_info *info)
12915 {
12916         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12917         struct net_device *dev = info->user_ptr[1];
12918         struct wireless_dev *wdev = dev->ieee80211_ptr;
12919         struct cfg80211_ftm_responder_stats ftm_stats = {};
12920         struct sk_buff *msg;
12921         void *hdr;
12922         struct nlattr *ftm_stats_attr;
12923         int err;
12924
12925         if (wdev->iftype != NL80211_IFTYPE_AP || !wdev->beacon_interval)
12926                 return -EOPNOTSUPP;
12927
12928         err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
12929         if (err)
12930                 return err;
12931
12932         if (!ftm_stats.filled)
12933                 return -ENODATA;
12934
12935         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12936         if (!msg)
12937                 return -ENOMEM;
12938
12939         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12940                              NL80211_CMD_GET_FTM_RESPONDER_STATS);
12941         if (!hdr)
12942                 return -ENOBUFS;
12943
12944         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
12945                 goto nla_put_failure;
12946
12947         ftm_stats_attr = nla_nest_start(msg, NL80211_ATTR_FTM_RESPONDER_STATS);
12948         if (!ftm_stats_attr)
12949                 goto nla_put_failure;
12950
12951 #define SET_FTM(field, name, type)                                       \
12952         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
12953             nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name,            \
12954                              ftm_stats.field))                           \
12955                 goto nla_put_failure; } while (0)
12956 #define SET_FTM_U64(field, name)                                         \
12957         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
12958             nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name,           \
12959                               ftm_stats.field, NL80211_FTM_STATS_PAD))   \
12960                 goto nla_put_failure; } while (0)
12961
12962         SET_FTM(success_num, SUCCESS_NUM, u32);
12963         SET_FTM(partial_num, PARTIAL_NUM, u32);
12964         SET_FTM(failed_num, FAILED_NUM, u32);
12965         SET_FTM(asap_num, ASAP_NUM, u32);
12966         SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
12967         SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
12968         SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
12969         SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
12970         SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
12971 #undef SET_FTM
12972
12973         nla_nest_end(msg, ftm_stats_attr);
12974
12975         genlmsg_end(msg, hdr);
12976         return genlmsg_reply(msg, info);
12977
12978 nla_put_failure:
12979         nlmsg_free(msg);
12980         return -ENOBUFS;
12981 }
12982
12983 #define NL80211_FLAG_NEED_WIPHY         0x01
12984 #define NL80211_FLAG_NEED_NETDEV        0x02
12985 #define NL80211_FLAG_NEED_RTNL          0x04
12986 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
12987 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
12988                                          NL80211_FLAG_CHECK_NETDEV_UP)
12989 #define NL80211_FLAG_NEED_WDEV          0x10
12990 /* If a netdev is associated, it must be UP, P2P must be started */
12991 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
12992                                          NL80211_FLAG_CHECK_NETDEV_UP)
12993 #define NL80211_FLAG_CLEAR_SKB          0x20
12994
12995 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
12996                             struct genl_info *info)
12997 {
12998         struct cfg80211_registered_device *rdev;
12999         struct wireless_dev *wdev;
13000         struct net_device *dev;
13001         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
13002
13003         if (rtnl)
13004                 rtnl_lock();
13005
13006         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
13007                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
13008                 if (IS_ERR(rdev)) {
13009                         if (rtnl)
13010                                 rtnl_unlock();
13011                         return PTR_ERR(rdev);
13012                 }
13013                 info->user_ptr[0] = rdev;
13014         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
13015                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
13016                 ASSERT_RTNL();
13017
13018                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
13019                                                   info->attrs);
13020                 if (IS_ERR(wdev)) {
13021                         if (rtnl)
13022                                 rtnl_unlock();
13023                         return PTR_ERR(wdev);
13024                 }
13025
13026                 dev = wdev->netdev;
13027                 rdev = wiphy_to_rdev(wdev->wiphy);
13028
13029                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
13030                         if (!dev) {
13031                                 if (rtnl)
13032                                         rtnl_unlock();
13033                                 return -EINVAL;
13034                         }
13035
13036                         info->user_ptr[1] = dev;
13037                 } else {
13038                         info->user_ptr[1] = wdev;
13039                 }
13040
13041                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
13042                     !wdev_running(wdev)) {
13043                         if (rtnl)
13044                                 rtnl_unlock();
13045                         return -ENETDOWN;
13046                 }
13047
13048                 if (dev)
13049                         dev_hold(dev);
13050
13051                 info->user_ptr[0] = rdev;
13052         }
13053
13054         return 0;
13055 }
13056
13057 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
13058                               struct genl_info *info)
13059 {
13060         if (info->user_ptr[1]) {
13061                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
13062                         struct wireless_dev *wdev = info->user_ptr[1];
13063
13064                         if (wdev->netdev)
13065                                 dev_put(wdev->netdev);
13066                 } else {
13067                         dev_put(info->user_ptr[1]);
13068                 }
13069         }
13070
13071         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
13072                 rtnl_unlock();
13073
13074         /* If needed, clear the netlink message payload from the SKB
13075          * as it might contain key data that shouldn't stick around on
13076          * the heap after the SKB is freed. The netlink message header
13077          * is still needed for further processing, so leave it intact.
13078          */
13079         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
13080                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
13081
13082                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
13083         }
13084 }
13085
13086 static const struct genl_ops nl80211_ops[] = {
13087         {
13088                 .cmd = NL80211_CMD_GET_WIPHY,
13089                 .doit = nl80211_get_wiphy,
13090                 .dumpit = nl80211_dump_wiphy,
13091                 .done = nl80211_dump_wiphy_done,
13092                 .policy = nl80211_policy,
13093                 /* can be retrieved by unprivileged users */
13094                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13095                                   NL80211_FLAG_NEED_RTNL,
13096         },
13097         {
13098                 .cmd = NL80211_CMD_SET_WIPHY,
13099                 .doit = nl80211_set_wiphy,
13100                 .policy = nl80211_policy,
13101                 .flags = GENL_UNS_ADMIN_PERM,
13102                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13103         },
13104         {
13105                 .cmd = NL80211_CMD_GET_INTERFACE,
13106                 .doit = nl80211_get_interface,
13107                 .dumpit = nl80211_dump_interface,
13108                 .policy = nl80211_policy,
13109                 /* can be retrieved by unprivileged users */
13110                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13111                                   NL80211_FLAG_NEED_RTNL,
13112         },
13113         {
13114                 .cmd = NL80211_CMD_SET_INTERFACE,
13115                 .doit = nl80211_set_interface,
13116                 .policy = nl80211_policy,
13117                 .flags = GENL_UNS_ADMIN_PERM,
13118                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13119                                   NL80211_FLAG_NEED_RTNL,
13120         },
13121         {
13122                 .cmd = NL80211_CMD_NEW_INTERFACE,
13123                 .doit = nl80211_new_interface,
13124                 .policy = nl80211_policy,
13125                 .flags = GENL_UNS_ADMIN_PERM,
13126                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13127                                   NL80211_FLAG_NEED_RTNL,
13128         },
13129         {
13130                 .cmd = NL80211_CMD_DEL_INTERFACE,
13131                 .doit = nl80211_del_interface,
13132                 .policy = nl80211_policy,
13133                 .flags = GENL_UNS_ADMIN_PERM,
13134                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13135                                   NL80211_FLAG_NEED_RTNL,
13136         },
13137         {
13138                 .cmd = NL80211_CMD_GET_KEY,
13139                 .doit = nl80211_get_key,
13140                 .policy = nl80211_policy,
13141                 .flags = GENL_UNS_ADMIN_PERM,
13142                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13143                                   NL80211_FLAG_NEED_RTNL,
13144         },
13145         {
13146                 .cmd = NL80211_CMD_SET_KEY,
13147                 .doit = nl80211_set_key,
13148                 .policy = nl80211_policy,
13149                 .flags = GENL_UNS_ADMIN_PERM,
13150                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13151                                   NL80211_FLAG_NEED_RTNL |
13152                                   NL80211_FLAG_CLEAR_SKB,
13153         },
13154         {
13155                 .cmd = NL80211_CMD_NEW_KEY,
13156                 .doit = nl80211_new_key,
13157                 .policy = nl80211_policy,
13158                 .flags = GENL_UNS_ADMIN_PERM,
13159                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13160                                   NL80211_FLAG_NEED_RTNL |
13161                                   NL80211_FLAG_CLEAR_SKB,
13162         },
13163         {
13164                 .cmd = NL80211_CMD_DEL_KEY,
13165                 .doit = nl80211_del_key,
13166                 .policy = nl80211_policy,
13167                 .flags = GENL_UNS_ADMIN_PERM,
13168                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13169                                   NL80211_FLAG_NEED_RTNL,
13170         },
13171         {
13172                 .cmd = NL80211_CMD_SET_BEACON,
13173                 .policy = nl80211_policy,
13174                 .flags = GENL_UNS_ADMIN_PERM,
13175                 .doit = nl80211_set_beacon,
13176                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13177                                   NL80211_FLAG_NEED_RTNL,
13178         },
13179         {
13180                 .cmd = NL80211_CMD_START_AP,
13181                 .policy = nl80211_policy,
13182                 .flags = GENL_UNS_ADMIN_PERM,
13183                 .doit = nl80211_start_ap,
13184                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13185                                   NL80211_FLAG_NEED_RTNL,
13186         },
13187         {
13188                 .cmd = NL80211_CMD_STOP_AP,
13189                 .policy = nl80211_policy,
13190                 .flags = GENL_UNS_ADMIN_PERM,
13191                 .doit = nl80211_stop_ap,
13192                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13193                                   NL80211_FLAG_NEED_RTNL,
13194         },
13195         {
13196                 .cmd = NL80211_CMD_GET_STATION,
13197                 .doit = nl80211_get_station,
13198                 .dumpit = nl80211_dump_station,
13199                 .policy = nl80211_policy,
13200                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13201                                   NL80211_FLAG_NEED_RTNL,
13202         },
13203         {
13204                 .cmd = NL80211_CMD_SET_STATION,
13205                 .doit = nl80211_set_station,
13206                 .policy = nl80211_policy,
13207                 .flags = GENL_UNS_ADMIN_PERM,
13208                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13209                                   NL80211_FLAG_NEED_RTNL,
13210         },
13211         {
13212                 .cmd = NL80211_CMD_NEW_STATION,
13213                 .doit = nl80211_new_station,
13214                 .policy = nl80211_policy,
13215                 .flags = GENL_UNS_ADMIN_PERM,
13216                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13217                                   NL80211_FLAG_NEED_RTNL,
13218         },
13219         {
13220                 .cmd = NL80211_CMD_DEL_STATION,
13221                 .doit = nl80211_del_station,
13222                 .policy = nl80211_policy,
13223                 .flags = GENL_UNS_ADMIN_PERM,
13224                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13225                                   NL80211_FLAG_NEED_RTNL,
13226         },
13227         {
13228                 .cmd = NL80211_CMD_GET_MPATH,
13229                 .doit = nl80211_get_mpath,
13230                 .dumpit = nl80211_dump_mpath,
13231                 .policy = nl80211_policy,
13232                 .flags = GENL_UNS_ADMIN_PERM,
13233                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13234                                   NL80211_FLAG_NEED_RTNL,
13235         },
13236         {
13237                 .cmd = NL80211_CMD_GET_MPP,
13238                 .doit = nl80211_get_mpp,
13239                 .dumpit = nl80211_dump_mpp,
13240                 .policy = nl80211_policy,
13241                 .flags = GENL_UNS_ADMIN_PERM,
13242                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13243                                   NL80211_FLAG_NEED_RTNL,
13244         },
13245         {
13246                 .cmd = NL80211_CMD_SET_MPATH,
13247                 .doit = nl80211_set_mpath,
13248                 .policy = nl80211_policy,
13249                 .flags = GENL_UNS_ADMIN_PERM,
13250                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13251                                   NL80211_FLAG_NEED_RTNL,
13252         },
13253         {
13254                 .cmd = NL80211_CMD_NEW_MPATH,
13255                 .doit = nl80211_new_mpath,
13256                 .policy = nl80211_policy,
13257                 .flags = GENL_UNS_ADMIN_PERM,
13258                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13259                                   NL80211_FLAG_NEED_RTNL,
13260         },
13261         {
13262                 .cmd = NL80211_CMD_DEL_MPATH,
13263                 .doit = nl80211_del_mpath,
13264                 .policy = nl80211_policy,
13265                 .flags = GENL_UNS_ADMIN_PERM,
13266                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13267                                   NL80211_FLAG_NEED_RTNL,
13268         },
13269         {
13270                 .cmd = NL80211_CMD_SET_BSS,
13271                 .doit = nl80211_set_bss,
13272                 .policy = nl80211_policy,
13273                 .flags = GENL_UNS_ADMIN_PERM,
13274                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13275                                   NL80211_FLAG_NEED_RTNL,
13276         },
13277         {
13278                 .cmd = NL80211_CMD_GET_REG,
13279                 .doit = nl80211_get_reg_do,
13280                 .dumpit = nl80211_get_reg_dump,
13281                 .policy = nl80211_policy,
13282                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13283                 /* can be retrieved by unprivileged users */
13284         },
13285 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
13286         {
13287                 .cmd = NL80211_CMD_SET_REG,
13288                 .doit = nl80211_set_reg,
13289                 .policy = nl80211_policy,
13290                 .flags = GENL_ADMIN_PERM,
13291                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13292         },
13293 #endif
13294         {
13295                 .cmd = NL80211_CMD_REQ_SET_REG,
13296                 .doit = nl80211_req_set_reg,
13297                 .policy = nl80211_policy,
13298                 .flags = GENL_ADMIN_PERM,
13299         },
13300         {
13301                 .cmd = NL80211_CMD_RELOAD_REGDB,
13302                 .doit = nl80211_reload_regdb,
13303                 .policy = nl80211_policy,
13304                 .flags = GENL_ADMIN_PERM,
13305         },
13306         {
13307                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
13308                 .doit = nl80211_get_mesh_config,
13309                 .policy = nl80211_policy,
13310                 /* can be retrieved by unprivileged users */
13311                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13312                                   NL80211_FLAG_NEED_RTNL,
13313         },
13314         {
13315                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
13316                 .doit = nl80211_update_mesh_config,
13317                 .policy = nl80211_policy,
13318                 .flags = GENL_UNS_ADMIN_PERM,
13319                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13320                                   NL80211_FLAG_NEED_RTNL,
13321         },
13322         {
13323                 .cmd = NL80211_CMD_TRIGGER_SCAN,
13324                 .doit = nl80211_trigger_scan,
13325                 .policy = nl80211_policy,
13326                 .flags = GENL_UNS_ADMIN_PERM,
13327                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13328                                   NL80211_FLAG_NEED_RTNL,
13329         },
13330         {
13331                 .cmd = NL80211_CMD_ABORT_SCAN,
13332                 .doit = nl80211_abort_scan,
13333                 .policy = nl80211_policy,
13334                 .flags = GENL_UNS_ADMIN_PERM,
13335                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13336                                   NL80211_FLAG_NEED_RTNL,
13337         },
13338         {
13339                 .cmd = NL80211_CMD_GET_SCAN,
13340                 .policy = nl80211_policy,
13341                 .dumpit = nl80211_dump_scan,
13342         },
13343         {
13344                 .cmd = NL80211_CMD_START_SCHED_SCAN,
13345                 .doit = nl80211_start_sched_scan,
13346                 .policy = nl80211_policy,
13347                 .flags = GENL_UNS_ADMIN_PERM,
13348                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13349                                   NL80211_FLAG_NEED_RTNL,
13350         },
13351         {
13352                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
13353                 .doit = nl80211_stop_sched_scan,
13354                 .policy = nl80211_policy,
13355                 .flags = GENL_UNS_ADMIN_PERM,
13356                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13357                                   NL80211_FLAG_NEED_RTNL,
13358         },
13359         {
13360                 .cmd = NL80211_CMD_AUTHENTICATE,
13361                 .doit = nl80211_authenticate,
13362                 .policy = nl80211_policy,
13363                 .flags = GENL_UNS_ADMIN_PERM,
13364                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13365                                   NL80211_FLAG_NEED_RTNL |
13366                                   NL80211_FLAG_CLEAR_SKB,
13367         },
13368         {
13369                 .cmd = NL80211_CMD_ASSOCIATE,
13370                 .doit = nl80211_associate,
13371                 .policy = nl80211_policy,
13372                 .flags = GENL_UNS_ADMIN_PERM,
13373                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13374                                   NL80211_FLAG_NEED_RTNL,
13375         },
13376         {
13377                 .cmd = NL80211_CMD_DEAUTHENTICATE,
13378                 .doit = nl80211_deauthenticate,
13379                 .policy = nl80211_policy,
13380                 .flags = GENL_UNS_ADMIN_PERM,
13381                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13382                                   NL80211_FLAG_NEED_RTNL,
13383         },
13384         {
13385                 .cmd = NL80211_CMD_DISASSOCIATE,
13386                 .doit = nl80211_disassociate,
13387                 .policy = nl80211_policy,
13388                 .flags = GENL_UNS_ADMIN_PERM,
13389                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13390                                   NL80211_FLAG_NEED_RTNL,
13391         },
13392         {
13393                 .cmd = NL80211_CMD_JOIN_IBSS,
13394                 .doit = nl80211_join_ibss,
13395                 .policy = nl80211_policy,
13396                 .flags = GENL_UNS_ADMIN_PERM,
13397                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13398                                   NL80211_FLAG_NEED_RTNL,
13399         },
13400         {
13401                 .cmd = NL80211_CMD_LEAVE_IBSS,
13402                 .doit = nl80211_leave_ibss,
13403                 .policy = nl80211_policy,
13404                 .flags = GENL_UNS_ADMIN_PERM,
13405                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13406                                   NL80211_FLAG_NEED_RTNL,
13407         },
13408 #ifdef CONFIG_NL80211_TESTMODE
13409         {
13410                 .cmd = NL80211_CMD_TESTMODE,
13411                 .doit = nl80211_testmode_do,
13412                 .dumpit = nl80211_testmode_dump,
13413                 .policy = nl80211_policy,
13414                 .flags = GENL_UNS_ADMIN_PERM,
13415                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13416                                   NL80211_FLAG_NEED_RTNL,
13417         },
13418 #endif
13419         {
13420                 .cmd = NL80211_CMD_CONNECT,
13421                 .doit = nl80211_connect,
13422                 .policy = nl80211_policy,
13423                 .flags = GENL_UNS_ADMIN_PERM,
13424                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13425                                   NL80211_FLAG_NEED_RTNL,
13426         },
13427         {
13428                 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
13429                 .doit = nl80211_update_connect_params,
13430                 .policy = nl80211_policy,
13431                 .flags = GENL_ADMIN_PERM,
13432                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13433                                   NL80211_FLAG_NEED_RTNL,
13434         },
13435         {
13436                 .cmd = NL80211_CMD_DISCONNECT,
13437                 .doit = nl80211_disconnect,
13438                 .policy = nl80211_policy,
13439                 .flags = GENL_UNS_ADMIN_PERM,
13440                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13441                                   NL80211_FLAG_NEED_RTNL,
13442         },
13443         {
13444                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
13445                 .doit = nl80211_wiphy_netns,
13446                 .policy = nl80211_policy,
13447                 .flags = GENL_UNS_ADMIN_PERM,
13448                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13449                                   NL80211_FLAG_NEED_RTNL,
13450         },
13451         {
13452                 .cmd = NL80211_CMD_GET_SURVEY,
13453                 .policy = nl80211_policy,
13454                 .dumpit = nl80211_dump_survey,
13455         },
13456         {
13457                 .cmd = NL80211_CMD_SET_PMKSA,
13458                 .doit = nl80211_setdel_pmksa,
13459                 .policy = nl80211_policy,
13460                 .flags = GENL_UNS_ADMIN_PERM,
13461                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13462                                   NL80211_FLAG_NEED_RTNL,
13463         },
13464         {
13465                 .cmd = NL80211_CMD_DEL_PMKSA,
13466                 .doit = nl80211_setdel_pmksa,
13467                 .policy = nl80211_policy,
13468                 .flags = GENL_UNS_ADMIN_PERM,
13469                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13470                                   NL80211_FLAG_NEED_RTNL,
13471         },
13472         {
13473                 .cmd = NL80211_CMD_FLUSH_PMKSA,
13474                 .doit = nl80211_flush_pmksa,
13475                 .policy = nl80211_policy,
13476                 .flags = GENL_UNS_ADMIN_PERM,
13477                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13478                                   NL80211_FLAG_NEED_RTNL,
13479         },
13480         {
13481                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
13482                 .doit = nl80211_remain_on_channel,
13483                 .policy = nl80211_policy,
13484                 .flags = GENL_UNS_ADMIN_PERM,
13485                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13486                                   NL80211_FLAG_NEED_RTNL,
13487         },
13488         {
13489                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
13490                 .doit = nl80211_cancel_remain_on_channel,
13491                 .policy = nl80211_policy,
13492                 .flags = GENL_UNS_ADMIN_PERM,
13493                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13494                                   NL80211_FLAG_NEED_RTNL,
13495         },
13496         {
13497                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
13498                 .doit = nl80211_set_tx_bitrate_mask,
13499                 .policy = nl80211_policy,
13500                 .flags = GENL_UNS_ADMIN_PERM,
13501                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13502                                   NL80211_FLAG_NEED_RTNL,
13503         },
13504         {
13505                 .cmd = NL80211_CMD_REGISTER_FRAME,
13506                 .doit = nl80211_register_mgmt,
13507                 .policy = nl80211_policy,
13508                 .flags = GENL_UNS_ADMIN_PERM,
13509                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13510                                   NL80211_FLAG_NEED_RTNL,
13511         },
13512         {
13513                 .cmd = NL80211_CMD_FRAME,
13514                 .doit = nl80211_tx_mgmt,
13515                 .policy = nl80211_policy,
13516                 .flags = GENL_UNS_ADMIN_PERM,
13517                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13518                                   NL80211_FLAG_NEED_RTNL,
13519         },
13520         {
13521                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
13522                 .doit = nl80211_tx_mgmt_cancel_wait,
13523                 .policy = nl80211_policy,
13524                 .flags = GENL_UNS_ADMIN_PERM,
13525                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13526                                   NL80211_FLAG_NEED_RTNL,
13527         },
13528         {
13529                 .cmd = NL80211_CMD_SET_POWER_SAVE,
13530                 .doit = nl80211_set_power_save,
13531                 .policy = nl80211_policy,
13532                 .flags = GENL_UNS_ADMIN_PERM,
13533                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13534                                   NL80211_FLAG_NEED_RTNL,
13535         },
13536         {
13537                 .cmd = NL80211_CMD_GET_POWER_SAVE,
13538                 .doit = nl80211_get_power_save,
13539                 .policy = nl80211_policy,
13540                 /* can be retrieved by unprivileged users */
13541                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13542                                   NL80211_FLAG_NEED_RTNL,
13543         },
13544         {
13545                 .cmd = NL80211_CMD_SET_CQM,
13546                 .doit = nl80211_set_cqm,
13547                 .policy = nl80211_policy,
13548                 .flags = GENL_UNS_ADMIN_PERM,
13549                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13550                                   NL80211_FLAG_NEED_RTNL,
13551         },
13552         {
13553                 .cmd = NL80211_CMD_SET_CHANNEL,
13554                 .doit = nl80211_set_channel,
13555                 .policy = nl80211_policy,
13556                 .flags = GENL_UNS_ADMIN_PERM,
13557                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13558                                   NL80211_FLAG_NEED_RTNL,
13559         },
13560         {
13561                 .cmd = NL80211_CMD_SET_WDS_PEER,
13562                 .doit = nl80211_set_wds_peer,
13563                 .policy = nl80211_policy,
13564                 .flags = GENL_UNS_ADMIN_PERM,
13565                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13566                                   NL80211_FLAG_NEED_RTNL,
13567         },
13568         {
13569                 .cmd = NL80211_CMD_JOIN_MESH,
13570                 .doit = nl80211_join_mesh,
13571                 .policy = nl80211_policy,
13572                 .flags = GENL_UNS_ADMIN_PERM,
13573                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13574                                   NL80211_FLAG_NEED_RTNL,
13575         },
13576         {
13577                 .cmd = NL80211_CMD_LEAVE_MESH,
13578                 .doit = nl80211_leave_mesh,
13579                 .policy = nl80211_policy,
13580                 .flags = GENL_UNS_ADMIN_PERM,
13581                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13582                                   NL80211_FLAG_NEED_RTNL,
13583         },
13584         {
13585                 .cmd = NL80211_CMD_JOIN_OCB,
13586                 .doit = nl80211_join_ocb,
13587                 .policy = nl80211_policy,
13588                 .flags = GENL_UNS_ADMIN_PERM,
13589                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13590                                   NL80211_FLAG_NEED_RTNL,
13591         },
13592         {
13593                 .cmd = NL80211_CMD_LEAVE_OCB,
13594                 .doit = nl80211_leave_ocb,
13595                 .policy = nl80211_policy,
13596                 .flags = GENL_UNS_ADMIN_PERM,
13597                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13598                                   NL80211_FLAG_NEED_RTNL,
13599         },
13600 #ifdef CONFIG_PM
13601         {
13602                 .cmd = NL80211_CMD_GET_WOWLAN,
13603                 .doit = nl80211_get_wowlan,
13604                 .policy = nl80211_policy,
13605                 /* can be retrieved by unprivileged users */
13606                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13607                                   NL80211_FLAG_NEED_RTNL,
13608         },
13609         {
13610                 .cmd = NL80211_CMD_SET_WOWLAN,
13611                 .doit = nl80211_set_wowlan,
13612                 .policy = nl80211_policy,
13613                 .flags = GENL_UNS_ADMIN_PERM,
13614                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13615                                   NL80211_FLAG_NEED_RTNL,
13616         },
13617 #endif
13618         {
13619                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
13620                 .doit = nl80211_set_rekey_data,
13621                 .policy = nl80211_policy,
13622                 .flags = GENL_UNS_ADMIN_PERM,
13623                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13624                                   NL80211_FLAG_NEED_RTNL |
13625                                   NL80211_FLAG_CLEAR_SKB,
13626         },
13627         {
13628                 .cmd = NL80211_CMD_TDLS_MGMT,
13629                 .doit = nl80211_tdls_mgmt,
13630                 .policy = nl80211_policy,
13631                 .flags = GENL_UNS_ADMIN_PERM,
13632                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13633                                   NL80211_FLAG_NEED_RTNL,
13634         },
13635         {
13636                 .cmd = NL80211_CMD_TDLS_OPER,
13637                 .doit = nl80211_tdls_oper,
13638                 .policy = nl80211_policy,
13639                 .flags = GENL_UNS_ADMIN_PERM,
13640                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13641                                   NL80211_FLAG_NEED_RTNL,
13642         },
13643         {
13644                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
13645                 .doit = nl80211_register_unexpected_frame,
13646                 .policy = nl80211_policy,
13647                 .flags = GENL_UNS_ADMIN_PERM,
13648                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13649                                   NL80211_FLAG_NEED_RTNL,
13650         },
13651         {
13652                 .cmd = NL80211_CMD_PROBE_CLIENT,
13653                 .doit = nl80211_probe_client,
13654                 .policy = nl80211_policy,
13655                 .flags = GENL_UNS_ADMIN_PERM,
13656                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13657                                   NL80211_FLAG_NEED_RTNL,
13658         },
13659         {
13660                 .cmd = NL80211_CMD_REGISTER_BEACONS,
13661                 .doit = nl80211_register_beacons,
13662                 .policy = nl80211_policy,
13663                 .flags = GENL_UNS_ADMIN_PERM,
13664                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13665                                   NL80211_FLAG_NEED_RTNL,
13666         },
13667         {
13668                 .cmd = NL80211_CMD_SET_NOACK_MAP,
13669                 .doit = nl80211_set_noack_map,
13670                 .policy = nl80211_policy,
13671                 .flags = GENL_UNS_ADMIN_PERM,
13672                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13673                                   NL80211_FLAG_NEED_RTNL,
13674         },
13675         {
13676                 .cmd = NL80211_CMD_START_P2P_DEVICE,
13677                 .doit = nl80211_start_p2p_device,
13678                 .policy = nl80211_policy,
13679                 .flags = GENL_UNS_ADMIN_PERM,
13680                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13681                                   NL80211_FLAG_NEED_RTNL,
13682         },
13683         {
13684                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
13685                 .doit = nl80211_stop_p2p_device,
13686                 .policy = nl80211_policy,
13687                 .flags = GENL_UNS_ADMIN_PERM,
13688                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13689                                   NL80211_FLAG_NEED_RTNL,
13690         },
13691         {
13692                 .cmd = NL80211_CMD_START_NAN,
13693                 .doit = nl80211_start_nan,
13694                 .policy = nl80211_policy,
13695                 .flags = GENL_ADMIN_PERM,
13696                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13697                                   NL80211_FLAG_NEED_RTNL,
13698         },
13699         {
13700                 .cmd = NL80211_CMD_STOP_NAN,
13701                 .doit = nl80211_stop_nan,
13702                 .policy = nl80211_policy,
13703                 .flags = GENL_ADMIN_PERM,
13704                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13705                                   NL80211_FLAG_NEED_RTNL,
13706         },
13707         {
13708                 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
13709                 .doit = nl80211_nan_add_func,
13710                 .policy = nl80211_policy,
13711                 .flags = GENL_ADMIN_PERM,
13712                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13713                                   NL80211_FLAG_NEED_RTNL,
13714         },
13715         {
13716                 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
13717                 .doit = nl80211_nan_del_func,
13718                 .policy = nl80211_policy,
13719                 .flags = GENL_ADMIN_PERM,
13720                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13721                                   NL80211_FLAG_NEED_RTNL,
13722         },
13723         {
13724                 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
13725                 .doit = nl80211_nan_change_config,
13726                 .policy = nl80211_policy,
13727                 .flags = GENL_ADMIN_PERM,
13728                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13729                                   NL80211_FLAG_NEED_RTNL,
13730         },
13731         {
13732                 .cmd = NL80211_CMD_SET_MCAST_RATE,
13733                 .doit = nl80211_set_mcast_rate,
13734                 .policy = nl80211_policy,
13735                 .flags = GENL_UNS_ADMIN_PERM,
13736                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13737                                   NL80211_FLAG_NEED_RTNL,
13738         },
13739         {
13740                 .cmd = NL80211_CMD_SET_MAC_ACL,
13741                 .doit = nl80211_set_mac_acl,
13742                 .policy = nl80211_policy,
13743                 .flags = GENL_UNS_ADMIN_PERM,
13744                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13745                                   NL80211_FLAG_NEED_RTNL,
13746         },
13747         {
13748                 .cmd = NL80211_CMD_RADAR_DETECT,
13749                 .doit = nl80211_start_radar_detection,
13750                 .policy = nl80211_policy,
13751                 .flags = GENL_UNS_ADMIN_PERM,
13752                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13753                                   NL80211_FLAG_NEED_RTNL,
13754         },
13755         {
13756                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
13757                 .doit = nl80211_get_protocol_features,
13758                 .policy = nl80211_policy,
13759         },
13760         {
13761                 .cmd = NL80211_CMD_UPDATE_FT_IES,
13762                 .doit = nl80211_update_ft_ies,
13763                 .policy = nl80211_policy,
13764                 .flags = GENL_UNS_ADMIN_PERM,
13765                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13766                                   NL80211_FLAG_NEED_RTNL,
13767         },
13768         {
13769                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
13770                 .doit = nl80211_crit_protocol_start,
13771                 .policy = nl80211_policy,
13772                 .flags = GENL_UNS_ADMIN_PERM,
13773                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13774                                   NL80211_FLAG_NEED_RTNL,
13775         },
13776         {
13777                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
13778                 .doit = nl80211_crit_protocol_stop,
13779                 .policy = nl80211_policy,
13780                 .flags = GENL_UNS_ADMIN_PERM,
13781                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13782                                   NL80211_FLAG_NEED_RTNL,
13783         },
13784         {
13785                 .cmd = NL80211_CMD_GET_COALESCE,
13786                 .doit = nl80211_get_coalesce,
13787                 .policy = nl80211_policy,
13788                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13789                                   NL80211_FLAG_NEED_RTNL,
13790         },
13791         {
13792                 .cmd = NL80211_CMD_SET_COALESCE,
13793                 .doit = nl80211_set_coalesce,
13794                 .policy = nl80211_policy,
13795                 .flags = GENL_UNS_ADMIN_PERM,
13796                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13797                                   NL80211_FLAG_NEED_RTNL,
13798         },
13799         {
13800                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
13801                 .doit = nl80211_channel_switch,
13802                 .policy = nl80211_policy,
13803                 .flags = GENL_UNS_ADMIN_PERM,
13804                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13805                                   NL80211_FLAG_NEED_RTNL,
13806         },
13807         {
13808                 .cmd = NL80211_CMD_VENDOR,
13809                 .doit = nl80211_vendor_cmd,
13810                 .dumpit = nl80211_vendor_cmd_dump,
13811                 .policy = nl80211_policy,
13812                 .flags = GENL_UNS_ADMIN_PERM,
13813                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13814                                   NL80211_FLAG_NEED_RTNL,
13815         },
13816         {
13817                 .cmd = NL80211_CMD_SET_QOS_MAP,
13818                 .doit = nl80211_set_qos_map,
13819                 .policy = nl80211_policy,
13820                 .flags = GENL_UNS_ADMIN_PERM,
13821                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13822                                   NL80211_FLAG_NEED_RTNL,
13823         },
13824         {
13825                 .cmd = NL80211_CMD_ADD_TX_TS,
13826                 .doit = nl80211_add_tx_ts,
13827                 .policy = nl80211_policy,
13828                 .flags = GENL_UNS_ADMIN_PERM,
13829                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13830                                   NL80211_FLAG_NEED_RTNL,
13831         },
13832         {
13833                 .cmd = NL80211_CMD_DEL_TX_TS,
13834                 .doit = nl80211_del_tx_ts,
13835                 .policy = nl80211_policy,
13836                 .flags = GENL_UNS_ADMIN_PERM,
13837                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13838                                   NL80211_FLAG_NEED_RTNL,
13839         },
13840         {
13841                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
13842                 .doit = nl80211_tdls_channel_switch,
13843                 .policy = nl80211_policy,
13844                 .flags = GENL_UNS_ADMIN_PERM,
13845                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13846                                   NL80211_FLAG_NEED_RTNL,
13847         },
13848         {
13849                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
13850                 .doit = nl80211_tdls_cancel_channel_switch,
13851                 .policy = nl80211_policy,
13852                 .flags = GENL_UNS_ADMIN_PERM,
13853                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13854                                   NL80211_FLAG_NEED_RTNL,
13855         },
13856         {
13857                 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
13858                 .doit = nl80211_set_multicast_to_unicast,
13859                 .policy = nl80211_policy,
13860                 .flags = GENL_UNS_ADMIN_PERM,
13861                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13862                                   NL80211_FLAG_NEED_RTNL,
13863         },
13864         {
13865                 .cmd = NL80211_CMD_SET_PMK,
13866                 .doit = nl80211_set_pmk,
13867                 .policy = nl80211_policy,
13868                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13869                                   NL80211_FLAG_NEED_RTNL,
13870         },
13871         {
13872                 .cmd = NL80211_CMD_DEL_PMK,
13873                 .doit = nl80211_del_pmk,
13874                 .policy = nl80211_policy,
13875                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13876                                   NL80211_FLAG_NEED_RTNL,
13877         },
13878         {
13879                 .cmd = NL80211_CMD_EXTERNAL_AUTH,
13880                 .doit = nl80211_external_auth,
13881                 .policy = nl80211_policy,
13882                 .flags = GENL_ADMIN_PERM,
13883                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13884                                   NL80211_FLAG_NEED_RTNL,
13885         },
13886         {
13887                 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
13888                 .doit = nl80211_tx_control_port,
13889                 .policy = nl80211_policy,
13890                 .flags = GENL_UNS_ADMIN_PERM,
13891                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13892                                   NL80211_FLAG_NEED_RTNL,
13893         },
13894         {
13895                 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
13896                 .doit = nl80211_get_ftm_responder_stats,
13897                 .policy = nl80211_policy,
13898                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13899                                   NL80211_FLAG_NEED_RTNL,
13900         },
13901 };
13902
13903 static struct genl_family nl80211_fam __ro_after_init = {
13904         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
13905         .hdrsize = 0,                   /* no private header */
13906         .version = 1,                   /* no particular meaning now */
13907         .maxattr = NL80211_ATTR_MAX,
13908         .netnsok = true,
13909         .pre_doit = nl80211_pre_doit,
13910         .post_doit = nl80211_post_doit,
13911         .module = THIS_MODULE,
13912         .ops = nl80211_ops,
13913         .n_ops = ARRAY_SIZE(nl80211_ops),
13914         .mcgrps = nl80211_mcgrps,
13915         .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
13916 };
13917
13918 /* notification functions */
13919
13920 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
13921                           enum nl80211_commands cmd)
13922 {
13923         struct sk_buff *msg;
13924         struct nl80211_dump_wiphy_state state = {};
13925
13926         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
13927                 cmd != NL80211_CMD_DEL_WIPHY);
13928
13929         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13930         if (!msg)
13931                 return;
13932
13933         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
13934                 nlmsg_free(msg);
13935                 return;
13936         }
13937
13938         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13939                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
13940 }
13941
13942 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
13943                                 struct wireless_dev *wdev,
13944                                 enum nl80211_commands cmd)
13945 {
13946         struct sk_buff *msg;
13947
13948         WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
13949                 cmd != NL80211_CMD_DEL_INTERFACE);
13950
13951         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13952         if (!msg)
13953                 return;
13954
13955         if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev,
13956                                cmd == NL80211_CMD_DEL_INTERFACE) < 0) {
13957                 nlmsg_free(msg);
13958                 return;
13959         }
13960
13961         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13962                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
13963 }
13964
13965 static int nl80211_add_scan_req(struct sk_buff *msg,
13966                                 struct cfg80211_registered_device *rdev)
13967 {
13968         struct cfg80211_scan_request *req = rdev->scan_req;
13969         struct nlattr *nest;
13970         int i;
13971
13972         if (WARN_ON(!req))
13973                 return 0;
13974
13975         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
13976         if (!nest)
13977                 goto nla_put_failure;
13978         for (i = 0; i < req->n_ssids; i++) {
13979                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
13980                         goto nla_put_failure;
13981         }
13982         nla_nest_end(msg, nest);
13983
13984         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
13985         if (!nest)
13986                 goto nla_put_failure;
13987         for (i = 0; i < req->n_channels; i++) {
13988                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
13989                         goto nla_put_failure;
13990         }
13991         nla_nest_end(msg, nest);
13992
13993         if (req->ie &&
13994             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
13995                 goto nla_put_failure;
13996
13997         if (req->flags &&
13998             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
13999                 goto nla_put_failure;
14000
14001         if (req->info.scan_start_tsf &&
14002             (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
14003                                req->info.scan_start_tsf, NL80211_BSS_PAD) ||
14004              nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
14005                      req->info.tsf_bssid)))
14006                 goto nla_put_failure;
14007
14008         return 0;
14009  nla_put_failure:
14010         return -ENOBUFS;
14011 }
14012
14013 static int nl80211_prep_scan_msg(struct sk_buff *msg,
14014                                  struct cfg80211_registered_device *rdev,
14015                                  struct wireless_dev *wdev,
14016                                  u32 portid, u32 seq, int flags,
14017                                  u32 cmd)
14018 {
14019         void *hdr;
14020
14021         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
14022         if (!hdr)
14023                 return -1;
14024
14025         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14026             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14027                                          wdev->netdev->ifindex)) ||
14028             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14029                               NL80211_ATTR_PAD))
14030                 goto nla_put_failure;
14031
14032         /* ignore errors and send incomplete event anyway */
14033         nl80211_add_scan_req(msg, rdev);
14034
14035         genlmsg_end(msg, hdr);
14036         return 0;
14037
14038  nla_put_failure:
14039         genlmsg_cancel(msg, hdr);
14040         return -EMSGSIZE;
14041 }
14042
14043 static int
14044 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
14045                             struct cfg80211_sched_scan_request *req, u32 cmd)
14046 {
14047         void *hdr;
14048
14049         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14050         if (!hdr)
14051                 return -1;
14052
14053         if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
14054                         wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
14055             nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
14056             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
14057                               NL80211_ATTR_PAD))
14058                 goto nla_put_failure;
14059
14060         genlmsg_end(msg, hdr);
14061         return 0;
14062
14063  nla_put_failure:
14064         genlmsg_cancel(msg, hdr);
14065         return -EMSGSIZE;
14066 }
14067
14068 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
14069                              struct wireless_dev *wdev)
14070 {
14071         struct sk_buff *msg;
14072
14073         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14074         if (!msg)
14075                 return;
14076
14077         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
14078                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
14079                 nlmsg_free(msg);
14080                 return;
14081         }
14082
14083         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14084                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14085 }
14086
14087 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
14088                                        struct wireless_dev *wdev, bool aborted)
14089 {
14090         struct sk_buff *msg;
14091
14092         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14093         if (!msg)
14094                 return NULL;
14095
14096         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
14097                                   aborted ? NL80211_CMD_SCAN_ABORTED :
14098                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
14099                 nlmsg_free(msg);
14100                 return NULL;
14101         }
14102
14103         return msg;
14104 }
14105
14106 /* send message created by nl80211_build_scan_msg() */
14107 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
14108                            struct sk_buff *msg)
14109 {
14110         if (!msg)
14111                 return;
14112
14113         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14114                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14115 }
14116
14117 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
14118 {
14119         struct sk_buff *msg;
14120
14121         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14122         if (!msg)
14123                 return;
14124
14125         if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
14126                 nlmsg_free(msg);
14127                 return;
14128         }
14129
14130         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
14131                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14132 }
14133
14134 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
14135                                           struct regulatory_request *request)
14136 {
14137         /* Userspace can always count this one always being set */
14138         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
14139                 goto nla_put_failure;
14140
14141         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
14142                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14143                                NL80211_REGDOM_TYPE_WORLD))
14144                         goto nla_put_failure;
14145         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
14146                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14147                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
14148                         goto nla_put_failure;
14149         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
14150                    request->intersect) {
14151                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14152                                NL80211_REGDOM_TYPE_INTERSECTION))
14153                         goto nla_put_failure;
14154         } else {
14155                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14156                                NL80211_REGDOM_TYPE_COUNTRY) ||
14157                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
14158                                    request->alpha2))
14159                         goto nla_put_failure;
14160         }
14161
14162         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
14163                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
14164
14165                 if (wiphy &&
14166                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
14167                         goto nla_put_failure;
14168
14169                 if (wiphy &&
14170                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
14171                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
14172                         goto nla_put_failure;
14173         }
14174
14175         return true;
14176
14177 nla_put_failure:
14178         return false;
14179 }
14180
14181 /*
14182  * This can happen on global regulatory changes or device specific settings
14183  * based on custom regulatory domains.
14184  */
14185 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
14186                                      struct regulatory_request *request)
14187 {
14188         struct sk_buff *msg;
14189         void *hdr;
14190
14191         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14192         if (!msg)
14193                 return;
14194
14195         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
14196         if (!hdr) {
14197                 nlmsg_free(msg);
14198                 return;
14199         }
14200
14201         if (nl80211_reg_change_event_fill(msg, request) == false)
14202                 goto nla_put_failure;
14203
14204         genlmsg_end(msg, hdr);
14205
14206         rcu_read_lock();
14207         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
14208                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
14209         rcu_read_unlock();
14210
14211         return;
14212
14213 nla_put_failure:
14214         nlmsg_free(msg);
14215 }
14216
14217 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
14218                                     struct net_device *netdev,
14219                                     const u8 *buf, size_t len,
14220                                     enum nl80211_commands cmd, gfp_t gfp,
14221                                     int uapsd_queues)
14222 {
14223         struct sk_buff *msg;
14224         void *hdr;
14225
14226         msg = nlmsg_new(100 + len, gfp);
14227         if (!msg)
14228                 return;
14229
14230         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14231         if (!hdr) {
14232                 nlmsg_free(msg);
14233                 return;
14234         }
14235
14236         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14237             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14238             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
14239                 goto nla_put_failure;
14240
14241         if (uapsd_queues >= 0) {
14242                 struct nlattr *nla_wmm =
14243                         nla_nest_start(msg, NL80211_ATTR_STA_WME);
14244                 if (!nla_wmm)
14245                         goto nla_put_failure;
14246
14247                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
14248                                uapsd_queues))
14249                         goto nla_put_failure;
14250
14251                 nla_nest_end(msg, nla_wmm);
14252         }
14253
14254         genlmsg_end(msg, hdr);
14255
14256         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14257                                 NL80211_MCGRP_MLME, gfp);
14258         return;
14259
14260  nla_put_failure:
14261         nlmsg_free(msg);
14262 }
14263
14264 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
14265                           struct net_device *netdev, const u8 *buf,
14266                           size_t len, gfp_t gfp)
14267 {
14268         nl80211_send_mlme_event(rdev, netdev, buf, len,
14269                                 NL80211_CMD_AUTHENTICATE, gfp, -1);
14270 }
14271
14272 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
14273                            struct net_device *netdev, const u8 *buf,
14274                            size_t len, gfp_t gfp, int uapsd_queues)
14275 {
14276         nl80211_send_mlme_event(rdev, netdev, buf, len,
14277                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues);
14278 }
14279
14280 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
14281                          struct net_device *netdev, const u8 *buf,
14282                          size_t len, gfp_t gfp)
14283 {
14284         nl80211_send_mlme_event(rdev, netdev, buf, len,
14285                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1);
14286 }
14287
14288 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
14289                            struct net_device *netdev, const u8 *buf,
14290                            size_t len, gfp_t gfp)
14291 {
14292         nl80211_send_mlme_event(rdev, netdev, buf, len,
14293                                 NL80211_CMD_DISASSOCIATE, gfp, -1);
14294 }
14295
14296 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
14297                                   size_t len)
14298 {
14299         struct wireless_dev *wdev = dev->ieee80211_ptr;
14300         struct wiphy *wiphy = wdev->wiphy;
14301         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14302         const struct ieee80211_mgmt *mgmt = (void *)buf;
14303         u32 cmd;
14304
14305         if (WARN_ON(len < 2))
14306                 return;
14307
14308         if (ieee80211_is_deauth(mgmt->frame_control))
14309                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
14310         else
14311                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
14312
14313         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
14314         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1);
14315 }
14316 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
14317
14318 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
14319                                       struct net_device *netdev, int cmd,
14320                                       const u8 *addr, gfp_t gfp)
14321 {
14322         struct sk_buff *msg;
14323         void *hdr;
14324
14325         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14326         if (!msg)
14327                 return;
14328
14329         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14330         if (!hdr) {
14331                 nlmsg_free(msg);
14332                 return;
14333         }
14334
14335         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14336             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14337             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
14338             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
14339                 goto nla_put_failure;
14340
14341         genlmsg_end(msg, hdr);
14342
14343         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14344                                 NL80211_MCGRP_MLME, gfp);
14345         return;
14346
14347  nla_put_failure:
14348         nlmsg_free(msg);
14349 }
14350
14351 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
14352                                struct net_device *netdev, const u8 *addr,
14353                                gfp_t gfp)
14354 {
14355         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
14356                                   addr, gfp);
14357 }
14358
14359 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
14360                                 struct net_device *netdev, const u8 *addr,
14361                                 gfp_t gfp)
14362 {
14363         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
14364                                   addr, gfp);
14365 }
14366
14367 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
14368                                  struct net_device *netdev,
14369                                  struct cfg80211_connect_resp_params *cr,
14370                                  gfp_t gfp)
14371 {
14372         struct sk_buff *msg;
14373         void *hdr;
14374
14375         msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
14376                         cr->fils.kek_len + cr->fils.pmk_len +
14377                         (cr->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
14378         if (!msg)
14379                 return;
14380
14381         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
14382         if (!hdr) {
14383                 nlmsg_free(msg);
14384                 return;
14385         }
14386
14387         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14388             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14389             (cr->bssid &&
14390              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) ||
14391             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
14392                         cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
14393                         cr->status) ||
14394             (cr->status < 0 &&
14395              (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
14396               nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
14397                           cr->timeout_reason))) ||
14398             (cr->req_ie &&
14399              nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
14400             (cr->resp_ie &&
14401              nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
14402                      cr->resp_ie)) ||
14403             (cr->fils.update_erp_next_seq_num &&
14404              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
14405                          cr->fils.erp_next_seq_num)) ||
14406             (cr->status == WLAN_STATUS_SUCCESS &&
14407              ((cr->fils.kek &&
14408                nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
14409                        cr->fils.kek)) ||
14410               (cr->fils.pmk &&
14411                nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
14412               (cr->fils.pmkid &&
14413                nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
14414                 goto nla_put_failure;
14415
14416         genlmsg_end(msg, hdr);
14417
14418         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14419                                 NL80211_MCGRP_MLME, gfp);
14420         return;
14421
14422  nla_put_failure:
14423         nlmsg_free(msg);
14424 }
14425
14426 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
14427                          struct net_device *netdev,
14428                          struct cfg80211_roam_info *info, gfp_t gfp)
14429 {
14430         struct sk_buff *msg;
14431         void *hdr;
14432         const u8 *bssid = info->bss ? info->bss->bssid : info->bssid;
14433
14434         msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
14435                         info->fils.kek_len + info->fils.pmk_len +
14436                         (info->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
14437         if (!msg)
14438                 return;
14439
14440         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
14441         if (!hdr) {
14442                 nlmsg_free(msg);
14443                 return;
14444         }
14445
14446         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14447             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14448             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
14449             (info->req_ie &&
14450              nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
14451                      info->req_ie)) ||
14452             (info->resp_ie &&
14453              nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
14454                      info->resp_ie)) ||
14455             (info->fils.update_erp_next_seq_num &&
14456              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
14457                          info->fils.erp_next_seq_num)) ||
14458             (info->fils.kek &&
14459              nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
14460                      info->fils.kek)) ||
14461             (info->fils.pmk &&
14462              nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
14463             (info->fils.pmkid &&
14464              nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
14465                 goto nla_put_failure;
14466
14467         genlmsg_end(msg, hdr);
14468
14469         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14470                                 NL80211_MCGRP_MLME, gfp);
14471         return;
14472
14473  nla_put_failure:
14474         nlmsg_free(msg);
14475 }
14476
14477 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
14478                                   struct net_device *netdev, const u8 *bssid)
14479 {
14480         struct sk_buff *msg;
14481         void *hdr;
14482
14483         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14484         if (!msg)
14485                 return;
14486
14487         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
14488         if (!hdr) {
14489                 nlmsg_free(msg);
14490                 return;
14491         }
14492
14493         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
14494                 goto nla_put_failure;
14495
14496         genlmsg_end(msg, hdr);
14497
14498         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14499                                 NL80211_MCGRP_MLME, GFP_KERNEL);
14500         return;
14501
14502  nla_put_failure:
14503         nlmsg_free(msg);
14504 }
14505
14506 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
14507                                struct net_device *netdev, u16 reason,
14508                                const u8 *ie, size_t ie_len, bool from_ap)
14509 {
14510         struct sk_buff *msg;
14511         void *hdr;
14512
14513         msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
14514         if (!msg)
14515                 return;
14516
14517         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
14518         if (!hdr) {
14519                 nlmsg_free(msg);
14520                 return;
14521         }
14522
14523         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14524             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14525             (reason &&
14526              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
14527             (from_ap &&
14528              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
14529             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
14530                 goto nla_put_failure;
14531
14532         genlmsg_end(msg, hdr);
14533
14534         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14535                                 NL80211_MCGRP_MLME, GFP_KERNEL);
14536         return;
14537
14538  nla_put_failure:
14539         nlmsg_free(msg);
14540 }
14541
14542 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
14543                              struct net_device *netdev, const u8 *bssid,
14544                              gfp_t gfp)
14545 {
14546         struct sk_buff *msg;
14547         void *hdr;
14548
14549         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14550         if (!msg)
14551                 return;
14552
14553         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
14554         if (!hdr) {
14555                 nlmsg_free(msg);
14556                 return;
14557         }
14558
14559         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14560             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14561             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
14562                 goto nla_put_failure;
14563
14564         genlmsg_end(msg, hdr);
14565
14566         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14567                                 NL80211_MCGRP_MLME, gfp);
14568         return;
14569
14570  nla_put_failure:
14571         nlmsg_free(msg);
14572 }
14573
14574 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
14575                                         const u8* ie, u8 ie_len, gfp_t gfp)
14576 {
14577         struct wireless_dev *wdev = dev->ieee80211_ptr;
14578         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14579         struct sk_buff *msg;
14580         void *hdr;
14581
14582         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
14583                 return;
14584
14585         trace_cfg80211_notify_new_peer_candidate(dev, addr);
14586
14587         msg = nlmsg_new(100 + ie_len, gfp);
14588         if (!msg)
14589                 return;
14590
14591         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
14592         if (!hdr) {
14593                 nlmsg_free(msg);
14594                 return;
14595         }
14596
14597         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14598             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14599             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
14600             (ie_len && ie &&
14601              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
14602                 goto nla_put_failure;
14603
14604         genlmsg_end(msg, hdr);
14605
14606         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14607                                 NL80211_MCGRP_MLME, gfp);
14608         return;
14609
14610  nla_put_failure:
14611         nlmsg_free(msg);
14612 }
14613 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
14614
14615 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
14616                                  struct net_device *netdev, const u8 *addr,
14617                                  enum nl80211_key_type key_type, int key_id,
14618                                  const u8 *tsc, gfp_t gfp)
14619 {
14620         struct sk_buff *msg;
14621         void *hdr;
14622
14623         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14624         if (!msg)
14625                 return;
14626
14627         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
14628         if (!hdr) {
14629                 nlmsg_free(msg);
14630                 return;
14631         }
14632
14633         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14634             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14635             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
14636             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
14637             (key_id != -1 &&
14638              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
14639             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
14640                 goto nla_put_failure;
14641
14642         genlmsg_end(msg, hdr);
14643
14644         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14645                                 NL80211_MCGRP_MLME, gfp);
14646         return;
14647
14648  nla_put_failure:
14649         nlmsg_free(msg);
14650 }
14651
14652 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
14653                                     struct ieee80211_channel *channel_before,
14654                                     struct ieee80211_channel *channel_after)
14655 {
14656         struct sk_buff *msg;
14657         void *hdr;
14658         struct nlattr *nl_freq;
14659
14660         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
14661         if (!msg)
14662                 return;
14663
14664         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
14665         if (!hdr) {
14666                 nlmsg_free(msg);
14667                 return;
14668         }
14669
14670         /*
14671          * Since we are applying the beacon hint to a wiphy we know its
14672          * wiphy_idx is valid
14673          */
14674         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
14675                 goto nla_put_failure;
14676
14677         /* Before */
14678         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
14679         if (!nl_freq)
14680                 goto nla_put_failure;
14681
14682         if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
14683                 goto nla_put_failure;
14684         nla_nest_end(msg, nl_freq);
14685
14686         /* After */
14687         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
14688         if (!nl_freq)
14689                 goto nla_put_failure;
14690
14691         if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
14692                 goto nla_put_failure;
14693         nla_nest_end(msg, nl_freq);
14694
14695         genlmsg_end(msg, hdr);
14696
14697         rcu_read_lock();
14698         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
14699                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
14700         rcu_read_unlock();
14701
14702         return;
14703
14704 nla_put_failure:
14705         nlmsg_free(msg);
14706 }
14707
14708 static void nl80211_send_remain_on_chan_event(
14709         int cmd, struct cfg80211_registered_device *rdev,
14710         struct wireless_dev *wdev, u64 cookie,
14711         struct ieee80211_channel *chan,
14712         unsigned int duration, gfp_t gfp)
14713 {
14714         struct sk_buff *msg;
14715         void *hdr;
14716
14717         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14718         if (!msg)
14719                 return;
14720
14721         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14722         if (!hdr) {
14723                 nlmsg_free(msg);
14724                 return;
14725         }
14726
14727         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14728             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14729                                          wdev->netdev->ifindex)) ||
14730             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14731                               NL80211_ATTR_PAD) ||
14732             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
14733             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
14734                         NL80211_CHAN_NO_HT) ||
14735             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14736                               NL80211_ATTR_PAD))
14737                 goto nla_put_failure;
14738
14739         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
14740             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
14741                 goto nla_put_failure;
14742
14743         genlmsg_end(msg, hdr);
14744
14745         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14746                                 NL80211_MCGRP_MLME, gfp);
14747         return;
14748
14749  nla_put_failure:
14750         nlmsg_free(msg);
14751 }
14752
14753 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
14754                                struct ieee80211_channel *chan,
14755                                unsigned int duration, gfp_t gfp)
14756 {
14757         struct wiphy *wiphy = wdev->wiphy;
14758         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14759
14760         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
14761         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
14762                                           rdev, wdev, cookie, chan,
14763                                           duration, gfp);
14764 }
14765 EXPORT_SYMBOL(cfg80211_ready_on_channel);
14766
14767 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
14768                                         struct ieee80211_channel *chan,
14769                                         gfp_t gfp)
14770 {
14771         struct wiphy *wiphy = wdev->wiphy;
14772         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14773
14774         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
14775         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
14776                                           rdev, wdev, cookie, chan, 0, gfp);
14777 }
14778 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
14779
14780 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
14781                       struct station_info *sinfo, gfp_t gfp)
14782 {
14783         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14784         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14785         struct sk_buff *msg;
14786
14787         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
14788
14789         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14790         if (!msg)
14791                 return;
14792
14793         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
14794                                  rdev, dev, mac_addr, sinfo) < 0) {
14795                 nlmsg_free(msg);
14796                 return;
14797         }
14798
14799         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14800                                 NL80211_MCGRP_MLME, gfp);
14801 }
14802 EXPORT_SYMBOL(cfg80211_new_sta);
14803
14804 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
14805                             struct station_info *sinfo, gfp_t gfp)
14806 {
14807         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14808         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14809         struct sk_buff *msg;
14810         struct station_info empty_sinfo = {};
14811
14812         if (!sinfo)
14813                 sinfo = &empty_sinfo;
14814
14815         trace_cfg80211_del_sta(dev, mac_addr);
14816
14817         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14818         if (!msg) {
14819                 cfg80211_sinfo_release_content(sinfo);
14820                 return;
14821         }
14822
14823         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
14824                                  rdev, dev, mac_addr, sinfo) < 0) {
14825                 nlmsg_free(msg);
14826                 return;
14827         }
14828
14829         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14830                                 NL80211_MCGRP_MLME, gfp);
14831 }
14832 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
14833
14834 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
14835                           enum nl80211_connect_failed_reason reason,
14836                           gfp_t gfp)
14837 {
14838         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14839         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14840         struct sk_buff *msg;
14841         void *hdr;
14842
14843         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
14844         if (!msg)
14845                 return;
14846
14847         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
14848         if (!hdr) {
14849                 nlmsg_free(msg);
14850                 return;
14851         }
14852
14853         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14854             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
14855             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
14856                 goto nla_put_failure;
14857
14858         genlmsg_end(msg, hdr);
14859
14860         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14861                                 NL80211_MCGRP_MLME, gfp);
14862         return;
14863
14864  nla_put_failure:
14865         nlmsg_free(msg);
14866 }
14867 EXPORT_SYMBOL(cfg80211_conn_failed);
14868
14869 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
14870                                        const u8 *addr, gfp_t gfp)
14871 {
14872         struct wireless_dev *wdev = dev->ieee80211_ptr;
14873         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14874         struct sk_buff *msg;
14875         void *hdr;
14876         u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
14877
14878         if (!nlportid)
14879                 return false;
14880
14881         msg = nlmsg_new(100, gfp);
14882         if (!msg)
14883                 return true;
14884
14885         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14886         if (!hdr) {
14887                 nlmsg_free(msg);
14888                 return true;
14889         }
14890
14891         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14892             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14893             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
14894                 goto nla_put_failure;
14895
14896         genlmsg_end(msg, hdr);
14897         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
14898         return true;
14899
14900  nla_put_failure:
14901         nlmsg_free(msg);
14902         return true;
14903 }
14904
14905 bool cfg80211_rx_spurious_frame(struct net_device *dev,
14906                                 const u8 *addr, gfp_t gfp)
14907 {
14908         struct wireless_dev *wdev = dev->ieee80211_ptr;
14909         bool ret;
14910
14911         trace_cfg80211_rx_spurious_frame(dev, addr);
14912
14913         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
14914                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
14915                 trace_cfg80211_return_bool(false);
14916                 return false;
14917         }
14918         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
14919                                          addr, gfp);
14920         trace_cfg80211_return_bool(ret);
14921         return ret;
14922 }
14923 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
14924
14925 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
14926                                         const u8 *addr, gfp_t gfp)
14927 {
14928         struct wireless_dev *wdev = dev->ieee80211_ptr;
14929         bool ret;
14930
14931         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
14932
14933         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
14934                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
14935                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
14936                 trace_cfg80211_return_bool(false);
14937                 return false;
14938         }
14939         ret = __nl80211_unexpected_frame(dev,
14940                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
14941                                          addr, gfp);
14942         trace_cfg80211_return_bool(ret);
14943         return ret;
14944 }
14945 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
14946
14947 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
14948                       struct wireless_dev *wdev, u32 nlportid,
14949                       int freq, int sig_dbm,
14950                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
14951 {
14952         struct net_device *netdev = wdev->netdev;
14953         struct sk_buff *msg;
14954         void *hdr;
14955
14956         msg = nlmsg_new(100 + len, gfp);
14957         if (!msg)
14958                 return -ENOMEM;
14959
14960         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
14961         if (!hdr) {
14962                 nlmsg_free(msg);
14963                 return -ENOMEM;
14964         }
14965
14966         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14967             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14968                                         netdev->ifindex)) ||
14969             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14970                               NL80211_ATTR_PAD) ||
14971             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
14972             (sig_dbm &&
14973              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
14974             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
14975             (flags &&
14976              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
14977                 goto nla_put_failure;
14978
14979         genlmsg_end(msg, hdr);
14980
14981         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
14982
14983  nla_put_failure:
14984         nlmsg_free(msg);
14985         return -ENOBUFS;
14986 }
14987
14988 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
14989                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
14990 {
14991         struct wiphy *wiphy = wdev->wiphy;
14992         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14993         struct net_device *netdev = wdev->netdev;
14994         struct sk_buff *msg;
14995         void *hdr;
14996
14997         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
14998
14999         msg = nlmsg_new(100 + len, gfp);
15000         if (!msg)
15001                 return;
15002
15003         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
15004         if (!hdr) {
15005                 nlmsg_free(msg);
15006                 return;
15007         }
15008
15009         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15010             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15011                                    netdev->ifindex)) ||
15012             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15013                               NL80211_ATTR_PAD) ||
15014             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
15015             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15016                               NL80211_ATTR_PAD) ||
15017             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
15018                 goto nla_put_failure;
15019
15020         genlmsg_end(msg, hdr);
15021
15022         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15023                                 NL80211_MCGRP_MLME, gfp);
15024         return;
15025
15026  nla_put_failure:
15027         nlmsg_free(msg);
15028 }
15029 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
15030
15031 static int __nl80211_rx_control_port(struct net_device *dev,
15032                                      struct sk_buff *skb,
15033                                      bool unencrypted, gfp_t gfp)
15034 {
15035         struct wireless_dev *wdev = dev->ieee80211_ptr;
15036         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15037         struct ethhdr *ehdr = eth_hdr(skb);
15038         const u8 *addr = ehdr->h_source;
15039         u16 proto = be16_to_cpu(skb->protocol);
15040         struct sk_buff *msg;
15041         void *hdr;
15042         struct nlattr *frame;
15043
15044         u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
15045
15046         if (!nlportid)
15047                 return -ENOENT;
15048
15049         msg = nlmsg_new(100 + skb->len, gfp);
15050         if (!msg)
15051                 return -ENOMEM;
15052
15053         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
15054         if (!hdr) {
15055                 nlmsg_free(msg);
15056                 return -ENOBUFS;
15057         }
15058
15059         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15060             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15061             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15062                               NL80211_ATTR_PAD) ||
15063             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
15064             nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
15065             (unencrypted && nla_put_flag(msg,
15066                                          NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
15067                 goto nla_put_failure;
15068
15069         frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
15070         if (!frame)
15071                 goto nla_put_failure;
15072
15073         skb_copy_bits(skb, 0, nla_data(frame), skb->len);
15074         genlmsg_end(msg, hdr);
15075
15076         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15077
15078  nla_put_failure:
15079         nlmsg_free(msg);
15080         return -ENOBUFS;
15081 }
15082
15083 bool cfg80211_rx_control_port(struct net_device *dev,
15084                               struct sk_buff *skb, bool unencrypted)
15085 {
15086         int ret;
15087
15088         trace_cfg80211_rx_control_port(dev, skb, unencrypted);
15089         ret = __nl80211_rx_control_port(dev, skb, unencrypted, GFP_ATOMIC);
15090         trace_cfg80211_return_bool(ret == 0);
15091         return ret == 0;
15092 }
15093 EXPORT_SYMBOL(cfg80211_rx_control_port);
15094
15095 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
15096                                             const char *mac, gfp_t gfp)
15097 {
15098         struct wireless_dev *wdev = dev->ieee80211_ptr;
15099         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15100         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15101         void **cb;
15102
15103         if (!msg)
15104                 return NULL;
15105
15106         cb = (void **)msg->cb;
15107
15108         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
15109         if (!cb[0]) {
15110                 nlmsg_free(msg);
15111                 return NULL;
15112         }
15113
15114         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15115             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15116                 goto nla_put_failure;
15117
15118         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
15119                 goto nla_put_failure;
15120
15121         cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM);
15122         if (!cb[1])
15123                 goto nla_put_failure;
15124
15125         cb[2] = rdev;
15126
15127         return msg;
15128  nla_put_failure:
15129         nlmsg_free(msg);
15130         return NULL;
15131 }
15132
15133 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
15134 {
15135         void **cb = (void **)msg->cb;
15136         struct cfg80211_registered_device *rdev = cb[2];
15137
15138         nla_nest_end(msg, cb[1]);
15139         genlmsg_end(msg, cb[0]);
15140
15141         memset(msg->cb, 0, sizeof(msg->cb));
15142
15143         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15144                                 NL80211_MCGRP_MLME, gfp);
15145 }
15146
15147 void cfg80211_cqm_rssi_notify(struct net_device *dev,
15148                               enum nl80211_cqm_rssi_threshold_event rssi_event,
15149                               s32 rssi_level, gfp_t gfp)
15150 {
15151         struct sk_buff *msg;
15152         struct wireless_dev *wdev = dev->ieee80211_ptr;
15153         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15154
15155         trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
15156
15157         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
15158                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
15159                 return;
15160
15161         if (wdev->cqm_config) {
15162                 wdev->cqm_config->last_rssi_event_value = rssi_level;
15163
15164                 cfg80211_cqm_rssi_update(rdev, dev);
15165
15166                 if (rssi_level == 0)
15167                         rssi_level = wdev->cqm_config->last_rssi_event_value;
15168         }
15169
15170         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
15171         if (!msg)
15172                 return;
15173
15174         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
15175                         rssi_event))
15176                 goto nla_put_failure;
15177
15178         if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
15179                                       rssi_level))
15180                 goto nla_put_failure;
15181
15182         cfg80211_send_cqm(msg, gfp);
15183
15184         return;
15185
15186  nla_put_failure:
15187         nlmsg_free(msg);
15188 }
15189 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
15190
15191 void cfg80211_cqm_txe_notify(struct net_device *dev,
15192                              const u8 *peer, u32 num_packets,
15193                              u32 rate, u32 intvl, gfp_t gfp)
15194 {
15195         struct sk_buff *msg;
15196
15197         msg = cfg80211_prepare_cqm(dev, peer, gfp);
15198         if (!msg)
15199                 return;
15200
15201         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
15202                 goto nla_put_failure;
15203
15204         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
15205                 goto nla_put_failure;
15206
15207         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
15208                 goto nla_put_failure;
15209
15210         cfg80211_send_cqm(msg, gfp);
15211         return;
15212
15213  nla_put_failure:
15214         nlmsg_free(msg);
15215 }
15216 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
15217
15218 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
15219                                  const u8 *peer, u32 num_packets, gfp_t gfp)
15220 {
15221         struct sk_buff *msg;
15222
15223         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
15224
15225         msg = cfg80211_prepare_cqm(dev, peer, gfp);
15226         if (!msg)
15227                 return;
15228
15229         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
15230                 goto nla_put_failure;
15231
15232         cfg80211_send_cqm(msg, gfp);
15233         return;
15234
15235  nla_put_failure:
15236         nlmsg_free(msg);
15237 }
15238 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
15239
15240 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
15241 {
15242         struct sk_buff *msg;
15243
15244         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
15245         if (!msg)
15246                 return;
15247
15248         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
15249                 goto nla_put_failure;
15250
15251         cfg80211_send_cqm(msg, gfp);
15252         return;
15253
15254  nla_put_failure:
15255         nlmsg_free(msg);
15256 }
15257 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
15258
15259 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
15260                                      struct net_device *netdev, const u8 *bssid,
15261                                      const u8 *replay_ctr, gfp_t gfp)
15262 {
15263         struct sk_buff *msg;
15264         struct nlattr *rekey_attr;
15265         void *hdr;
15266
15267         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15268         if (!msg)
15269                 return;
15270
15271         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
15272         if (!hdr) {
15273                 nlmsg_free(msg);
15274                 return;
15275         }
15276
15277         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15278             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15279             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
15280                 goto nla_put_failure;
15281
15282         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
15283         if (!rekey_attr)
15284                 goto nla_put_failure;
15285
15286         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
15287                     NL80211_REPLAY_CTR_LEN, replay_ctr))
15288                 goto nla_put_failure;
15289
15290         nla_nest_end(msg, rekey_attr);
15291
15292         genlmsg_end(msg, hdr);
15293
15294         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15295                                 NL80211_MCGRP_MLME, gfp);
15296         return;
15297
15298  nla_put_failure:
15299         nlmsg_free(msg);
15300 }
15301
15302 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
15303                                const u8 *replay_ctr, gfp_t gfp)
15304 {
15305         struct wireless_dev *wdev = dev->ieee80211_ptr;
15306         struct wiphy *wiphy = wdev->wiphy;
15307         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15308
15309         trace_cfg80211_gtk_rekey_notify(dev, bssid);
15310         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
15311 }
15312 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
15313
15314 static void
15315 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
15316                                struct net_device *netdev, int index,
15317                                const u8 *bssid, bool preauth, gfp_t gfp)
15318 {
15319         struct sk_buff *msg;
15320         struct nlattr *attr;
15321         void *hdr;
15322
15323         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15324         if (!msg)
15325                 return;
15326
15327         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
15328         if (!hdr) {
15329                 nlmsg_free(msg);
15330                 return;
15331         }
15332
15333         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15334             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
15335                 goto nla_put_failure;
15336
15337         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
15338         if (!attr)
15339                 goto nla_put_failure;
15340
15341         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
15342             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
15343             (preauth &&
15344              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
15345                 goto nla_put_failure;
15346
15347         nla_nest_end(msg, attr);
15348
15349         genlmsg_end(msg, hdr);
15350
15351         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15352                                 NL80211_MCGRP_MLME, gfp);
15353         return;
15354
15355  nla_put_failure:
15356         nlmsg_free(msg);
15357 }
15358
15359 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
15360                                      const u8 *bssid, bool preauth, gfp_t gfp)
15361 {
15362         struct wireless_dev *wdev = dev->ieee80211_ptr;
15363         struct wiphy *wiphy = wdev->wiphy;
15364         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15365
15366         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
15367         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
15368 }
15369 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
15370
15371 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
15372                                      struct net_device *netdev,
15373                                      struct cfg80211_chan_def *chandef,
15374                                      gfp_t gfp,
15375                                      enum nl80211_commands notif,
15376                                      u8 count)
15377 {
15378         struct sk_buff *msg;
15379         void *hdr;
15380
15381         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15382         if (!msg)
15383                 return;
15384
15385         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
15386         if (!hdr) {
15387                 nlmsg_free(msg);
15388                 return;
15389         }
15390
15391         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
15392                 goto nla_put_failure;
15393
15394         if (nl80211_send_chandef(msg, chandef))
15395                 goto nla_put_failure;
15396
15397         if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
15398             (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
15399                         goto nla_put_failure;
15400
15401         genlmsg_end(msg, hdr);
15402
15403         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15404                                 NL80211_MCGRP_MLME, gfp);
15405         return;
15406
15407  nla_put_failure:
15408         nlmsg_free(msg);
15409 }
15410
15411 void cfg80211_ch_switch_notify(struct net_device *dev,
15412                                struct cfg80211_chan_def *chandef)
15413 {
15414         struct wireless_dev *wdev = dev->ieee80211_ptr;
15415         struct wiphy *wiphy = wdev->wiphy;
15416         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15417
15418         ASSERT_WDEV_LOCK(wdev);
15419
15420         trace_cfg80211_ch_switch_notify(dev, chandef);
15421
15422         wdev->chandef = *chandef;
15423         wdev->preset_chandef = *chandef;
15424         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
15425                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0);
15426 }
15427 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
15428
15429 void cfg80211_ch_switch_started_notify(struct net_device *dev,
15430                                        struct cfg80211_chan_def *chandef,
15431                                        u8 count)
15432 {
15433         struct wireless_dev *wdev = dev->ieee80211_ptr;
15434         struct wiphy *wiphy = wdev->wiphy;
15435         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15436
15437         trace_cfg80211_ch_switch_started_notify(dev, chandef);
15438
15439         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
15440                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
15441 }
15442 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
15443
15444 void
15445 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
15446                      const struct cfg80211_chan_def *chandef,
15447                      enum nl80211_radar_event event,
15448                      struct net_device *netdev, gfp_t gfp)
15449 {
15450         struct sk_buff *msg;
15451         void *hdr;
15452
15453         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15454         if (!msg)
15455                 return;
15456
15457         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
15458         if (!hdr) {
15459                 nlmsg_free(msg);
15460                 return;
15461         }
15462
15463         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
15464                 goto nla_put_failure;
15465
15466         /* NOP and radar events don't need a netdev parameter */
15467         if (netdev) {
15468                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
15469
15470                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15471                     nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15472                                       NL80211_ATTR_PAD))
15473                         goto nla_put_failure;
15474         }
15475
15476         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
15477                 goto nla_put_failure;
15478
15479         if (nl80211_send_chandef(msg, chandef))
15480                 goto nla_put_failure;
15481
15482         genlmsg_end(msg, hdr);
15483
15484         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15485                                 NL80211_MCGRP_MLME, gfp);
15486         return;
15487
15488  nla_put_failure:
15489         nlmsg_free(msg);
15490 }
15491
15492 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
15493                                        struct sta_opmode_info *sta_opmode,
15494                                        gfp_t gfp)
15495 {
15496         struct sk_buff *msg;
15497         struct wireless_dev *wdev = dev->ieee80211_ptr;
15498         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15499         void *hdr;
15500
15501         if (WARN_ON(!mac))
15502                 return;
15503
15504         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15505         if (!msg)
15506                 return;
15507
15508         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
15509         if (!hdr) {
15510                 nlmsg_free(msg);
15511                 return;
15512         }
15513
15514         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
15515                 goto nla_put_failure;
15516
15517         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15518                 goto nla_put_failure;
15519
15520         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
15521                 goto nla_put_failure;
15522
15523         if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
15524             nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
15525                 goto nla_put_failure;
15526
15527         if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
15528             nla_put_u8(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
15529                 goto nla_put_failure;
15530
15531         if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
15532             nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
15533                 goto nla_put_failure;
15534
15535         genlmsg_end(msg, hdr);
15536
15537         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15538                                 NL80211_MCGRP_MLME, gfp);
15539
15540         return;
15541
15542 nla_put_failure:
15543         nlmsg_free(msg);
15544 }
15545 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
15546
15547 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
15548                            u64 cookie, bool acked, s32 ack_signal,
15549                            bool is_valid_ack_signal, gfp_t gfp)
15550 {
15551         struct wireless_dev *wdev = dev->ieee80211_ptr;
15552         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15553         struct sk_buff *msg;
15554         void *hdr;
15555
15556         trace_cfg80211_probe_status(dev, addr, cookie, acked);
15557
15558         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15559
15560         if (!msg)
15561                 return;
15562
15563         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
15564         if (!hdr) {
15565                 nlmsg_free(msg);
15566                 return;
15567         }
15568
15569         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15570             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15571             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
15572             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15573                               NL80211_ATTR_PAD) ||
15574             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
15575             (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
15576                                                 ack_signal)))
15577                 goto nla_put_failure;
15578
15579         genlmsg_end(msg, hdr);
15580
15581         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15582                                 NL80211_MCGRP_MLME, gfp);
15583         return;
15584
15585  nla_put_failure:
15586         nlmsg_free(msg);
15587 }
15588 EXPORT_SYMBOL(cfg80211_probe_status);
15589
15590 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
15591                                  const u8 *frame, size_t len,
15592                                  int freq, int sig_dbm)
15593 {
15594         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15595         struct sk_buff *msg;
15596         void *hdr;
15597         struct cfg80211_beacon_registration *reg;
15598
15599         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
15600
15601         spin_lock_bh(&rdev->beacon_registrations_lock);
15602         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
15603                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
15604                 if (!msg) {
15605                         spin_unlock_bh(&rdev->beacon_registrations_lock);
15606                         return;
15607                 }
15608
15609                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
15610                 if (!hdr)
15611                         goto nla_put_failure;
15612
15613                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15614                     (freq &&
15615                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
15616                     (sig_dbm &&
15617                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
15618                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
15619                         goto nla_put_failure;
15620
15621                 genlmsg_end(msg, hdr);
15622
15623                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
15624         }
15625         spin_unlock_bh(&rdev->beacon_registrations_lock);
15626         return;
15627
15628  nla_put_failure:
15629         spin_unlock_bh(&rdev->beacon_registrations_lock);
15630         nlmsg_free(msg);
15631 }
15632 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
15633
15634 #ifdef CONFIG_PM
15635 static int cfg80211_net_detect_results(struct sk_buff *msg,
15636                                        struct cfg80211_wowlan_wakeup *wakeup)
15637 {
15638         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
15639         struct nlattr *nl_results, *nl_match, *nl_freqs;
15640         int i, j;
15641
15642         nl_results = nla_nest_start(
15643                 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
15644         if (!nl_results)
15645                 return -EMSGSIZE;
15646
15647         for (i = 0; i < nd->n_matches; i++) {
15648                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
15649
15650                 nl_match = nla_nest_start(msg, i);
15651                 if (!nl_match)
15652                         break;
15653
15654                 /* The SSID attribute is optional in nl80211, but for
15655                  * simplicity reasons it's always present in the
15656                  * cfg80211 structure.  If a driver can't pass the
15657                  * SSID, that needs to be changed.  A zero length SSID
15658                  * is still a valid SSID (wildcard), so it cannot be
15659                  * used for this purpose.
15660                  */
15661                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
15662                             match->ssid.ssid)) {
15663                         nla_nest_cancel(msg, nl_match);
15664                         goto out;
15665                 }
15666
15667                 if (match->n_channels) {
15668                         nl_freqs = nla_nest_start(
15669                                 msg, NL80211_ATTR_SCAN_FREQUENCIES);
15670                         if (!nl_freqs) {
15671                                 nla_nest_cancel(msg, nl_match);
15672                                 goto out;
15673                         }
15674
15675                         for (j = 0; j < match->n_channels; j++) {
15676                                 if (nla_put_u32(msg, j, match->channels[j])) {
15677                                         nla_nest_cancel(msg, nl_freqs);
15678                                         nla_nest_cancel(msg, nl_match);
15679                                         goto out;
15680                                 }
15681                         }
15682
15683                         nla_nest_end(msg, nl_freqs);
15684                 }
15685
15686                 nla_nest_end(msg, nl_match);
15687         }
15688
15689 out:
15690         nla_nest_end(msg, nl_results);
15691         return 0;
15692 }
15693
15694 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
15695                                    struct cfg80211_wowlan_wakeup *wakeup,
15696                                    gfp_t gfp)
15697 {
15698         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15699         struct sk_buff *msg;
15700         void *hdr;
15701         int size = 200;
15702
15703         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
15704
15705         if (wakeup)
15706                 size += wakeup->packet_present_len;
15707
15708         msg = nlmsg_new(size, gfp);
15709         if (!msg)
15710                 return;
15711
15712         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
15713         if (!hdr)
15714                 goto free_msg;
15715
15716         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15717             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15718                               NL80211_ATTR_PAD))
15719                 goto free_msg;
15720
15721         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15722                                         wdev->netdev->ifindex))
15723                 goto free_msg;
15724
15725         if (wakeup) {
15726                 struct nlattr *reasons;
15727
15728                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
15729                 if (!reasons)
15730                         goto free_msg;
15731
15732                 if (wakeup->disconnect &&
15733                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
15734                         goto free_msg;
15735                 if (wakeup->magic_pkt &&
15736                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
15737                         goto free_msg;
15738                 if (wakeup->gtk_rekey_failure &&
15739                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
15740                         goto free_msg;
15741                 if (wakeup->eap_identity_req &&
15742                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
15743                         goto free_msg;
15744                 if (wakeup->four_way_handshake &&
15745                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
15746                         goto free_msg;
15747                 if (wakeup->rfkill_release &&
15748                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
15749                         goto free_msg;
15750
15751                 if (wakeup->pattern_idx >= 0 &&
15752                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
15753                                 wakeup->pattern_idx))
15754                         goto free_msg;
15755
15756                 if (wakeup->tcp_match &&
15757                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
15758                         goto free_msg;
15759
15760                 if (wakeup->tcp_connlost &&
15761                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
15762                         goto free_msg;
15763
15764                 if (wakeup->tcp_nomoretokens &&
15765                     nla_put_flag(msg,
15766                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
15767                         goto free_msg;
15768
15769                 if (wakeup->packet) {
15770                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
15771                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
15772
15773                         if (!wakeup->packet_80211) {
15774                                 pkt_attr =
15775                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
15776                                 len_attr =
15777                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
15778                         }
15779
15780                         if (wakeup->packet_len &&
15781                             nla_put_u32(msg, len_attr, wakeup->packet_len))
15782                                 goto free_msg;
15783
15784                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
15785                                     wakeup->packet))
15786                                 goto free_msg;
15787                 }
15788
15789                 if (wakeup->net_detect &&
15790                     cfg80211_net_detect_results(msg, wakeup))
15791                                 goto free_msg;
15792
15793                 nla_nest_end(msg, reasons);
15794         }
15795
15796         genlmsg_end(msg, hdr);
15797
15798         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15799                                 NL80211_MCGRP_MLME, gfp);
15800         return;
15801
15802  free_msg:
15803         nlmsg_free(msg);
15804 }
15805 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
15806 #endif
15807
15808 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
15809                                 enum nl80211_tdls_operation oper,
15810                                 u16 reason_code, gfp_t gfp)
15811 {
15812         struct wireless_dev *wdev = dev->ieee80211_ptr;
15813         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15814         struct sk_buff *msg;
15815         void *hdr;
15816
15817         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
15818                                          reason_code);
15819
15820         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15821         if (!msg)
15822                 return;
15823
15824         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
15825         if (!hdr) {
15826                 nlmsg_free(msg);
15827                 return;
15828         }
15829
15830         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15831             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15832             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
15833             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
15834             (reason_code > 0 &&
15835              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
15836                 goto nla_put_failure;
15837
15838         genlmsg_end(msg, hdr);
15839
15840         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15841                                 NL80211_MCGRP_MLME, gfp);
15842         return;
15843
15844  nla_put_failure:
15845         nlmsg_free(msg);
15846 }
15847 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
15848
15849 static int nl80211_netlink_notify(struct notifier_block * nb,
15850                                   unsigned long state,
15851                                   void *_notify)
15852 {
15853         struct netlink_notify *notify = _notify;
15854         struct cfg80211_registered_device *rdev;
15855         struct wireless_dev *wdev;
15856         struct cfg80211_beacon_registration *reg, *tmp;
15857
15858         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
15859                 return NOTIFY_DONE;
15860
15861         rcu_read_lock();
15862
15863         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
15864                 struct cfg80211_sched_scan_request *sched_scan_req;
15865
15866                 list_for_each_entry_rcu(sched_scan_req,
15867                                         &rdev->sched_scan_req_list,
15868                                         list) {
15869                         if (sched_scan_req->owner_nlportid == notify->portid) {
15870                                 sched_scan_req->nl_owner_dead = true;
15871                                 schedule_work(&rdev->sched_scan_stop_wk);
15872                         }
15873                 }
15874
15875                 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
15876                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
15877
15878                         if (wdev->owner_nlportid == notify->portid) {
15879                                 wdev->nl_owner_dead = true;
15880                                 schedule_work(&rdev->destroy_work);
15881                         } else if (wdev->conn_owner_nlportid == notify->portid) {
15882                                 schedule_work(&wdev->disconnect_wk);
15883                         }
15884                 }
15885
15886                 spin_lock_bh(&rdev->beacon_registrations_lock);
15887                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
15888                                          list) {
15889                         if (reg->nlportid == notify->portid) {
15890                                 list_del(&reg->list);
15891                                 kfree(reg);
15892                                 break;
15893                         }
15894                 }
15895                 spin_unlock_bh(&rdev->beacon_registrations_lock);
15896         }
15897
15898         rcu_read_unlock();
15899
15900         /*
15901          * It is possible that the user space process that is controlling the
15902          * indoor setting disappeared, so notify the regulatory core.
15903          */
15904         regulatory_netlink_notify(notify->portid);
15905         return NOTIFY_OK;
15906 }
15907
15908 static struct notifier_block nl80211_netlink_notifier = {
15909         .notifier_call = nl80211_netlink_notify,
15910 };
15911
15912 void cfg80211_ft_event(struct net_device *netdev,
15913                        struct cfg80211_ft_event_params *ft_event)
15914 {
15915         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
15916         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15917         struct sk_buff *msg;
15918         void *hdr;
15919
15920         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
15921
15922         if (!ft_event->target_ap)
15923                 return;
15924
15925         msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
15926                         GFP_KERNEL);
15927         if (!msg)
15928                 return;
15929
15930         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
15931         if (!hdr)
15932                 goto out;
15933
15934         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15935             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15936             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
15937                 goto out;
15938
15939         if (ft_event->ies &&
15940             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
15941                 goto out;
15942         if (ft_event->ric_ies &&
15943             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
15944                     ft_event->ric_ies))
15945                 goto out;
15946
15947         genlmsg_end(msg, hdr);
15948
15949         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15950                                 NL80211_MCGRP_MLME, GFP_KERNEL);
15951         return;
15952  out:
15953         nlmsg_free(msg);
15954 }
15955 EXPORT_SYMBOL(cfg80211_ft_event);
15956
15957 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
15958 {
15959         struct cfg80211_registered_device *rdev;
15960         struct sk_buff *msg;
15961         void *hdr;
15962         u32 nlportid;
15963
15964         rdev = wiphy_to_rdev(wdev->wiphy);
15965         if (!rdev->crit_proto_nlportid)
15966                 return;
15967
15968         nlportid = rdev->crit_proto_nlportid;
15969         rdev->crit_proto_nlportid = 0;
15970
15971         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15972         if (!msg)
15973                 return;
15974
15975         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
15976         if (!hdr)
15977                 goto nla_put_failure;
15978
15979         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15980             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15981                               NL80211_ATTR_PAD))
15982                 goto nla_put_failure;
15983
15984         genlmsg_end(msg, hdr);
15985
15986         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15987         return;
15988
15989  nla_put_failure:
15990         nlmsg_free(msg);
15991 }
15992 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
15993
15994 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
15995 {
15996         struct wiphy *wiphy = wdev->wiphy;
15997         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15998         struct sk_buff *msg;
15999         void *hdr;
16000
16001         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16002         if (!msg)
16003                 return;
16004
16005         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
16006         if (!hdr)
16007                 goto out;
16008
16009         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16010             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
16011             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16012                               NL80211_ATTR_PAD))
16013                 goto out;
16014
16015         genlmsg_end(msg, hdr);
16016
16017         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
16018                                 NL80211_MCGRP_MLME, GFP_KERNEL);
16019         return;
16020  out:
16021         nlmsg_free(msg);
16022 }
16023
16024 int cfg80211_external_auth_request(struct net_device *dev,
16025                                    struct cfg80211_external_auth_params *params,
16026                                    gfp_t gfp)
16027 {
16028         struct wireless_dev *wdev = dev->ieee80211_ptr;
16029         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16030         struct sk_buff *msg;
16031         void *hdr;
16032
16033         if (!wdev->conn_owner_nlportid)
16034                 return -EINVAL;
16035
16036         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16037         if (!msg)
16038                 return -ENOMEM;
16039
16040         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
16041         if (!hdr)
16042                 goto nla_put_failure;
16043
16044         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16045             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16046             nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) ||
16047             nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
16048                         params->action) ||
16049             nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
16050             nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
16051                     params->ssid.ssid))
16052                 goto nla_put_failure;
16053
16054         genlmsg_end(msg, hdr);
16055         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
16056                         wdev->conn_owner_nlportid);
16057         return 0;
16058
16059  nla_put_failure:
16060         nlmsg_free(msg);
16061         return -ENOBUFS;
16062 }
16063 EXPORT_SYMBOL(cfg80211_external_auth_request);
16064
16065 /* initialisation/exit functions */
16066
16067 int __init nl80211_init(void)
16068 {
16069         int err;
16070
16071         err = genl_register_family(&nl80211_fam);
16072         if (err)
16073                 return err;
16074
16075         err = netlink_register_notifier(&nl80211_netlink_notifier);
16076         if (err)
16077                 goto err_out;
16078
16079         return 0;
16080  err_out:
16081         genl_unregister_family(&nl80211_fam);
16082         return err;
16083 }
16084
16085 void nl80211_exit(void)
16086 {
16087         netlink_unregister_notifier(&nl80211_netlink_notifier);
16088         genl_unregister_family(&nl80211_fam);
16089 }