net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright 2013-2014  Intel Mobile Communications GmbH
   6  * Copyright 2015-2017  Intel Deutschland GmbH
   7  * Copyright (C) 2018-2019 Intel Corporation
   8  */
   9
  10 #include <linux/if.h>
  11 #include <linux/module.h>
  12 #include <linux/err.h>
  13 #include <linux/slab.h>
  14 #include <linux/list.h>
  15 #include <linux/if_ether.h>
  16 #include <linux/ieee80211.h>
  17 #include <linux/nl80211.h>
  18 #include <linux/rtnetlink.h>
  19 #include <linux/netlink.h>
  20 #include <linux/nospec.h>
  21 #include <linux/etherdevice.h>
  22 #include <net/net_namespace.h>
  23 #include <net/genetlink.h>
  24 #include <net/cfg80211.h>
  25 #include <net/sock.h>
  26 #include <net/inet_connection_sock.h>
  27 #include "core.h"
  28 #include "nl80211.h"
  29 #include "reg.h"
  30 #include "rdev-ops.h"
  31
  32 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  33                                    struct genl_info *info,
  34                                    struct cfg80211_crypto_settings *settings,
  35                                    int cipher_limit);
  36
  37 /* the netlink family */
  38 static struct genl_family nl80211_fam;
  39
  40 /* multicast groups */
  41 enum nl80211_multicast_groups {
  42         NL80211_MCGRP_CONFIG,
  43         NL80211_MCGRP_SCAN,
  44         NL80211_MCGRP_REGULATORY,
  45         NL80211_MCGRP_MLME,
  46         NL80211_MCGRP_VENDOR,
  47         NL80211_MCGRP_NAN,
  48         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  49 };
  50
  51 static const struct genl_multicast_group nl80211_mcgrps[] = {
  52         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  53         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  54         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  55         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  56         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  57         [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
  58 #ifdef CONFIG_NL80211_TESTMODE
  59         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  60 #endif
  61 };
  62
  63 /* returns ERR_PTR values */
  64 static struct wireless_dev *
  65 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  66 {
  67         struct cfg80211_registered_device *rdev;
  68         struct wireless_dev *result = NULL;
  69         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  70         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  71         u64 wdev_id;
  72         int wiphy_idx = -1;
  73         int ifidx = -1;
  74
  75         ASSERT_RTNL();
  76
  77         if (!have_ifidx && !have_wdev_id)
  78                 return ERR_PTR(-EINVAL);
  79
  80         if (have_ifidx)
  81                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  82         if (have_wdev_id) {
  83                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  84                 wiphy_idx = wdev_id >> 32;
  85         }
  86
  87         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  88                 struct wireless_dev *wdev;
  89
  90                 if (wiphy_net(&rdev->wiphy) != netns)
  91                         continue;
  92
  93                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  94                         continue;
  95
  96                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
  97                         if (have_ifidx && wdev->netdev &&
  98                             wdev->netdev->ifindex == ifidx) {
  99                                 result = wdev;
 100                                 break;
 101                         }
 102                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 103                                 result = wdev;
 104                                 break;
 105                         }
 106                 }
 107
 108                 if (result)
 109                         break;
 110         }
 111
 112         if (result)
 113                 return result;
 114         return ERR_PTR(-ENODEV);
 115 }
 116
 117 static struct cfg80211_registered_device *
 118 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 119 {
 120         struct cfg80211_registered_device *rdev = NULL, *tmp;
 121         struct net_device *netdev;
 122
 123         ASSERT_RTNL();
 124
 125         if (!attrs[NL80211_ATTR_WIPHY] &&
 126             !attrs[NL80211_ATTR_IFINDEX] &&
 127             !attrs[NL80211_ATTR_WDEV])
 128                 return ERR_PTR(-EINVAL);
 129
 130         if (attrs[NL80211_ATTR_WIPHY])
 131                 rdev = cfg80211_rdev_by_wiphy_idx(
 132                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 133
 134         if (attrs[NL80211_ATTR_WDEV]) {
 135                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 136                 struct wireless_dev *wdev;
 137                 bool found = false;
 138
 139                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 140                 if (tmp) {
 141                         /* make sure wdev exists */
 142                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 143                                 if (wdev->identifier != (u32)wdev_id)
 144                                         continue;
 145                                 found = true;
 146                                 break;
 147                         }
 148
 149                         if (!found)
 150                                 tmp = NULL;
 151
 152                         if (rdev && tmp != rdev)
 153                                 return ERR_PTR(-EINVAL);
 154                         rdev = tmp;
 155                 }
 156         }
 157
 158         if (attrs[NL80211_ATTR_IFINDEX]) {
 159                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 160
 161                 netdev = __dev_get_by_index(netns, ifindex);
 162                 if (netdev) {
 163                         if (netdev->ieee80211_ptr)
 164                                 tmp = wiphy_to_rdev(
 165                                         netdev->ieee80211_ptr->wiphy);
 166                         else
 167                                 tmp = NULL;
 168
 169                         /* not wireless device -- return error */
 170                         if (!tmp)
 171                                 return ERR_PTR(-EINVAL);
 172
 173                         /* mismatch -- return error */
 174                         if (rdev && tmp != rdev)
 175                                 return ERR_PTR(-EINVAL);
 176
 177                         rdev = tmp;
 178                 }
 179         }
 180
 181         if (!rdev)
 182                 return ERR_PTR(-ENODEV);
 183
 184         if (netns != wiphy_net(&rdev->wiphy))
 185                 return ERR_PTR(-ENODEV);
 186
 187         return rdev;
 188 }
 189
 190 /*
 191  * This function returns a pointer to the driver
 192  * that the genl_info item that is passed refers to.
 193  *
 194  * The result of this can be a PTR_ERR and hence must
 195  * be checked with IS_ERR() for errors.
 196  */
 197 static struct cfg80211_registered_device *
 198 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 199 {
 200         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 201 }
 202
 203 static int validate_ie_attr(const struct nlattr *attr,
 204                             struct netlink_ext_ack *extack)
 205 {
 206         const u8 *data = nla_data(attr);
 207         unsigned int len = nla_len(attr);
 208         const struct element *elem;
 209
 210         for_each_element(elem, data, len) {
 211                 /* nothing */
 212         }
 213
 214         if (for_each_element_completed(elem, data, len))
 215                 return 0;
 216
 217         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
 218         return -EINVAL;
 219 }
 220
 221 /* policy for the attributes */
 222 static const struct nla_policy
 223 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
 224         [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
 225         [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
 226                                         .len = U8_MAX },
 227         [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
 228                                              .len = U8_MAX },
 229 };
 230
 231 static const struct nla_policy
 232 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
 233         [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
 234         [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
 235         [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
 236                 NLA_POLICY_MAX(NLA_U8, 15),
 237         [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
 238         [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
 239                 NLA_POLICY_MAX(NLA_U8, 15),
 240         [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] =
 241                 NLA_POLICY_MAX(NLA_U8, 31),
 242         [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
 243         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
 244         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
 245 };
 246
 247 static const struct nla_policy
 248 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
 249         [NL80211_PMSR_TYPE_FTM] =
 250                 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
 251 };
 252
 253 static const struct nla_policy
 254 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
 255         [NL80211_PMSR_REQ_ATTR_DATA] =
 256                 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
 257         [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
 258 };
 259
 260 static const struct nla_policy
 261 nl80211_psmr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
 262         [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
 263         /*
 264          * we could specify this again to be the top-level policy,
 265          * but that would open us up to recursion problems ...
 266          */
 267         [NL80211_PMSR_PEER_ATTR_CHAN] = { .type = NLA_NESTED },
 268         [NL80211_PMSR_PEER_ATTR_REQ] =
 269                 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
 270         [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
 271 };
 272
 273 static const struct nla_policy
 274 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
 275         [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
 276         [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
 277         [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
 278         [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
 279         [NL80211_PMSR_ATTR_PEERS] =
 280                 NLA_POLICY_NESTED_ARRAY(nl80211_psmr_peer_attr_policy),
 281 };
 282
 283 const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 284         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 285         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 286                                       .len = 20-1 },
 287         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 288
 289         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 290         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 291         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 292         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 293         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 294
 295         [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 296         [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 297         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 298         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 299         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 300         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 301
 302         [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
 303         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 304         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 305
 306         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 307         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 308
 309         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 310         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 311                                     .len = WLAN_MAX_KEY_LEN },
 312         [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 5),
 313         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 314         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 315         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 316         [NL80211_ATTR_KEY_TYPE] =
 317                 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
 318
 319         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 320         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 321         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 322                                        .len = IEEE80211_MAX_DATA_LEN },
 323         [NL80211_ATTR_BEACON_TAIL] =
 324                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 325                                        IEEE80211_MAX_DATA_LEN),
 326         [NL80211_ATTR_STA_AID] =
 327                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 328         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 329         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 330         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 331                                                .len = NL80211_MAX_SUPP_RATES },
 332         [NL80211_ATTR_STA_PLINK_ACTION] =
 333                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
 334         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 335         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 336         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 337                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 338         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 339
 340         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 341         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 342
 343         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 344         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 345         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 346         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 347                                            .len = NL80211_MAX_SUPP_RATES },
 348         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 349
 350         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 351         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 352
 353         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 354
 355         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 356         [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
 357                                                    validate_ie_attr,
 358                                                    IEEE80211_MAX_DATA_LEN),
 359         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 360         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 361
 362         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 363                                 .len = IEEE80211_MAX_SSID_LEN },
 364         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 365         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 366         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 367         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 368         [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
 369                                                   NL80211_MFP_NO,
 370                                                   NL80211_MFP_OPTIONAL),
 371         [NL80211_ATTR_STA_FLAGS2] = {
 372                 .len = sizeof(struct nl80211_sta_flag_update),
 373         },
 374         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 375         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 376         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 377         [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
 378         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 379         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 380         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 381         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 382         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 383         [NL80211_ATTR_PMKID] = { .len = WLAN_PMKID_LEN },
 384         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 385         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 386         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 387         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 388                                  .len = IEEE80211_MAX_DATA_LEN },
 389         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 390         [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
 391                                                    NL80211_PS_DISABLED,
 392                                                    NL80211_PS_ENABLED),
 393         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 394         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 395         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 396         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 397         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 398         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 399         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 400         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 401         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 402         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 403         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 404         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 405         [NL80211_ATTR_STA_PLINK_STATE] =
 406                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
 407         [NL80211_ATTR_MESH_PEER_AID] =
 408                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 409         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 410         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 411         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 412         [NL80211_ATTR_HIDDEN_SSID] =
 413                 NLA_POLICY_RANGE(NLA_U32,
 414                                  NL80211_HIDDEN_SSID_NOT_IN_USE,
 415                                  NL80211_HIDDEN_SSID_ZERO_CONTENTS),
 416         [NL80211_ATTR_IE_PROBE_RESP] =
 417                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 418                                        IEEE80211_MAX_DATA_LEN),
 419         [NL80211_ATTR_IE_ASSOC_RESP] =
 420                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 421                                        IEEE80211_MAX_DATA_LEN),
 422         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 423         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 424         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 425         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 426         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 427         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 428         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 429         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 430         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 431         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 432         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 433                                       .len = IEEE80211_MAX_DATA_LEN },
 434         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 435         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 436         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 437                 .len = NL80211_HT_CAPABILITY_LEN
 438         },
 439         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 440         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 441         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 442         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 443         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 444         [NL80211_ATTR_AUTH_DATA] = { .type = NLA_BINARY, },
 445         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 446         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 447         [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
 448         [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
 449         [NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
 450                 NLA_POLICY_RANGE(NLA_U32,
 451                                  NL80211_MESH_POWER_UNKNOWN + 1,
 452                                  NL80211_MESH_POWER_MAX),
 453         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 454         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 455         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 456         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 457         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 458         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 459         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 460                 .len = NL80211_VHT_CAPABILITY_LEN,
 461         },
 462         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 463         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 464                                   .len = IEEE80211_MAX_DATA_LEN },
 465         [NL80211_ATTR_PEER_AID] =
 466                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 467         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 468         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 469         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 470         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 471         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 472         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 473         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 474         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 475         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 476         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 477         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 478         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 479         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 480                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 481         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 482         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 483         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 484         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 485         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 486         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 487         [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
 488         [NL80211_ATTR_USER_PRIO] =
 489                 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
 490         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 491         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 492         [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
 493         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 494         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 495         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 496         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 497         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 498         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 499         [NL80211_ATTR_STA_SUPPORT_P2P_PS] =
 500                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
 501         [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 502                 .len = VHT_MUMIMO_GROUPS_DATA_LEN
 503         },
 504         [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = { .len = ETH_ALEN },
 505         [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
 506         [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
 507         [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 508         [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
 509                                     .len = FILS_MAX_KEK_LEN },
 510         [NL80211_ATTR_FILS_NONCES] = { .len = 2 * FILS_NONCE_LEN },
 511         [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
 512         [NL80211_ATTR_BSSID] = { .len = ETH_ALEN },
 513         [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
 514         [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
 515                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 516         },
 517         [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
 518         [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
 519                                              .len = FILS_ERP_MAX_USERNAME_LEN },
 520         [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
 521                                           .len = FILS_ERP_MAX_REALM_LEN },
 522         [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
 523         [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
 524                                         .len = FILS_ERP_MAX_RRK_LEN },
 525         [NL80211_ATTR_FILS_CACHE_ID] = { .len = 2 },
 526         [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
 527         [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
 528         [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
 529
 530         [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
 531         [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
 532         [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
 533         [NL80211_ATTR_HE_CAPABILITY] = { .type = NLA_BINARY,
 534                                          .len = NL80211_HE_MAX_CAPABILITY_LEN },
 535
 536         [NL80211_ATTR_FTM_RESPONDER] = {
 537                 .type = NLA_NESTED,
 538                 .validation_data = nl80211_ftm_responder_policy,
 539         },
 540         [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
 541         [NL80211_ATTR_PEER_MEASUREMENTS] =
 542                 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
 543         [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
 544 };
 545
 546 /* policy for the key attributes */
 547 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 548         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 549         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 550         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 551         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 552         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 553         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 554         [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
 555         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 556 };
 557
 558 /* policy for the key default flags */
 559 static const struct nla_policy
 560 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 561         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 562         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 563 };
 564
 565 #ifdef CONFIG_PM
 566 /* policy for WoWLAN attributes */
 567 static const struct nla_policy
 568 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 569         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 570         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 571         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 572         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 573         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 574         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 575         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 576         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 577         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 578         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 579 };
 580
 581 static const struct nla_policy
 582 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 583         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 584         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 585         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 586         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 587         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 588         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 589         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 590                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 591         },
 592         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 593                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 594         },
 595         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 596         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 597         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 598 };
 599 #endif /* CONFIG_PM */
 600
 601 /* policy for coalesce rule attributes */
 602 static const struct nla_policy
 603 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 604         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 605         [NL80211_ATTR_COALESCE_RULE_CONDITION] =
 606                 NLA_POLICY_RANGE(NLA_U32,
 607                                  NL80211_COALESCE_CONDITION_MATCH,
 608                                  NL80211_COALESCE_CONDITION_NO_MATCH),
 609         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 610 };
 611
 612 /* policy for GTK rekey offload attributes */
 613 static const struct nla_policy
 614 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 615         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 616         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 617         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 618 };
 619
 620 static const struct nla_policy
 621 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 622         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 623                                                  .len = IEEE80211_MAX_SSID_LEN },
 624         [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = { .len = ETH_ALEN },
 625         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 626 };
 627
 628 static const struct nla_policy
 629 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 630         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 631         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 632 };
 633
 634 static const struct nla_policy
 635 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 636         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 637         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 638         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 639                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 640         },
 641 };
 642
 643 /* policy for NAN function attributes */
 644 static const struct nla_policy
 645 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 646         [NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 },
 647         [NL80211_NAN_FUNC_SERVICE_ID] = {
 648                                     .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 649         [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 650         [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 651         [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 652         [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 653         [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 654         [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = { .len = ETH_ALEN },
 655         [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 656         [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 657         [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 658                         .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 659         [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 660         [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 661         [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 662         [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 663         [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 664 };
 665
 666 /* policy for Service Response Filter attributes */
 667 static const struct nla_policy
 668 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 669         [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 670         [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 671                                  .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 672         [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 673         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 674 };
 675
 676 /* policy for packet pattern attributes */
 677 static const struct nla_policy
 678 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
 679         [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
 680         [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
 681         [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
 682 };
 683
 684 int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
 685                               struct cfg80211_registered_device **rdev,
 686                               struct wireless_dev **wdev)
 687 {
 688         int err;
 689
 690         if (!cb->args[0]) {
 691                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 692                                   genl_family_attrbuf(&nl80211_fam),
 693                                   nl80211_fam.maxattr, nl80211_policy, NULL);
 694                 if (err)
 695                         return err;
 696
 697                 *wdev = __cfg80211_wdev_from_attrs(
 698                                         sock_net(cb->skb->sk),
 699                                         genl_family_attrbuf(&nl80211_fam));
 700                 if (IS_ERR(*wdev))
 701                         return PTR_ERR(*wdev);
 702                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 703                 /* 0 is the first index - add 1 to parse only once */
 704                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 705                 cb->args[1] = (*wdev)->identifier;
 706         } else {
 707                 /* subtract the 1 again here */
 708                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 709                 struct wireless_dev *tmp;
 710
 711                 if (!wiphy)
 712                         return -ENODEV;
 713                 *rdev = wiphy_to_rdev(wiphy);
 714                 *wdev = NULL;
 715
 716                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
 717                         if (tmp->identifier == cb->args[1]) {
 718                                 *wdev = tmp;
 719                                 break;
 720                         }
 721                 }
 722
 723                 if (!*wdev)
 724                         return -ENODEV;
 725         }
 726
 727         return 0;
 728 }
 729
 730 /* message building helper */
 731 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 732                      int flags, u8 cmd)
 733 {
 734         /* since there is no private header just add the generic one */
 735         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 736 }
 737
 738 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
 739                                      const struct ieee80211_reg_rule *rule)
 740 {
 741         int j;
 742         struct nlattr *nl_wmm_rules =
 743                 nla_nest_start(msg, NL80211_FREQUENCY_ATTR_WMM);
 744
 745         if (!nl_wmm_rules)
 746                 goto nla_put_failure;
 747
 748         for (j = 0; j < IEEE80211_NUM_ACS; j++) {
 749                 struct nlattr *nl_wmm_rule = nla_nest_start(msg, j);
 750
 751                 if (!nl_wmm_rule)
 752                         goto nla_put_failure;
 753
 754                 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
 755                                 rule->wmm_rule.client[j].cw_min) ||
 756                     nla_put_u16(msg, NL80211_WMMR_CW_MAX,
 757                                 rule->wmm_rule.client[j].cw_max) ||
 758                     nla_put_u8(msg, NL80211_WMMR_AIFSN,
 759                                rule->wmm_rule.client[j].aifsn) ||
 760                     nla_put_u16(msg, NL80211_WMMR_TXOP,
 761                                 rule->wmm_rule.client[j].cot))
 762                         goto nla_put_failure;
 763
 764                 nla_nest_end(msg, nl_wmm_rule);
 765         }
 766         nla_nest_end(msg, nl_wmm_rules);
 767
 768         return 0;
 769
 770 nla_put_failure:
 771         return -ENOBUFS;
 772 }
 773
 774 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
 775                                    struct ieee80211_channel *chan,
 776                                    bool large)
 777 {
 778         /* Some channels must be completely excluded from the
 779          * list to protect old user-space tools from breaking
 780          */
 781         if (!large && chan->flags &
 782             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 783                 return 0;
 784
 785         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 786                         chan->center_freq))
 787                 goto nla_put_failure;
 788
 789         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 790             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 791                 goto nla_put_failure;
 792         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 793                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 794                         goto nla_put_failure;
 795                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 796                         goto nla_put_failure;
 797         }
 798         if (chan->flags & IEEE80211_CHAN_RADAR) {
 799                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 800                         goto nla_put_failure;
 801                 if (large) {
 802                         u32 time;
 803
 804                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 805
 806                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 807                                         chan->dfs_state))
 808                                 goto nla_put_failure;
 809                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 810                                         time))
 811                                 goto nla_put_failure;
 812                         if (nla_put_u32(msg,
 813                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 814                                         chan->dfs_cac_ms))
 815                                 goto nla_put_failure;
 816                 }
 817         }
 818
 819         if (large) {
 820                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 821                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 822                         goto nla_put_failure;
 823                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 824                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 825                         goto nla_put_failure;
 826                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 827                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 828                         goto nla_put_failure;
 829                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 830                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 831                         goto nla_put_failure;
 832                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 833                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 834                         goto nla_put_failure;
 835                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
 836                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
 837                         goto nla_put_failure;
 838                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 839                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 840                         goto nla_put_failure;
 841                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 842                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 843                         goto nla_put_failure;
 844         }
 845
 846         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 847                         DBM_TO_MBM(chan->max_power)))
 848                 goto nla_put_failure;
 849
 850         if (large) {
 851                 const struct ieee80211_reg_rule *rule =
 852                         freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
 853
 854                 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
 855                         if (nl80211_msg_put_wmm_rules(msg, rule))
 856                                 goto nla_put_failure;
 857                 }
 858         }
 859
 860         return 0;
 861
 862  nla_put_failure:
 863         return -ENOBUFS;
 864 }
 865
 866 static bool nl80211_put_txq_stats(struct sk_buff *msg,
 867                                   struct cfg80211_txq_stats *txqstats,
 868                                   int attrtype)
 869 {
 870         struct nlattr *txqattr;
 871
 872 #define PUT_TXQVAL_U32(attr, memb) do {                                   \
 873         if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) &&         \
 874             nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
 875                 return false;                                             \
 876         } while (0)
 877
 878         txqattr = nla_nest_start(msg, attrtype);
 879         if (!txqattr)
 880                 return false;
 881
 882         PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
 883         PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
 884         PUT_TXQVAL_U32(FLOWS, flows);
 885         PUT_TXQVAL_U32(DROPS, drops);
 886         PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
 887         PUT_TXQVAL_U32(OVERLIMIT, overlimit);
 888         PUT_TXQVAL_U32(OVERMEMORY, overmemory);
 889         PUT_TXQVAL_U32(COLLISIONS, collisions);
 890         PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
 891         PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
 892         PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
 893         nla_nest_end(msg, txqattr);
 894
 895 #undef PUT_TXQVAL_U32
 896         return true;
 897 }
 898
 899 /* netlink command implementations */
 900
 901 struct key_parse {
 902         struct key_params p;
 903         int idx;
 904         int type;
 905         bool def, defmgmt;
 906         bool def_uni, def_multi;
 907 };
 908
 909 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
 910                                  struct key_parse *k)
 911 {
 912         struct nlattr *tb[NL80211_KEY_MAX + 1];
 913         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 914                                    nl80211_key_policy, info->extack);
 915         if (err)
 916                 return err;
 917
 918         k->def = !!tb[NL80211_KEY_DEFAULT];
 919         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 920
 921         if (k->def) {
 922                 k->def_uni = true;
 923                 k->def_multi = true;
 924         }
 925         if (k->defmgmt)
 926                 k->def_multi = true;
 927
 928         if (tb[NL80211_KEY_IDX])
 929                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 930
 931         if (tb[NL80211_KEY_DATA]) {
 932                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 933                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 934         }
 935
 936         if (tb[NL80211_KEY_SEQ]) {
 937                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 938                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 939         }
 940
 941         if (tb[NL80211_KEY_CIPHER])
 942                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 943
 944         if (tb[NL80211_KEY_TYPE])
 945                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 946
 947         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 948                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 949
 950                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 951                                        tb[NL80211_KEY_DEFAULT_TYPES],
 952                                        nl80211_key_default_policy,
 953                                        info->extack);
 954                 if (err)
 955                         return err;
 956
 957                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 958                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 959         }
 960
 961         return 0;
 962 }
 963
 964 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 965 {
 966         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 967                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 968                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 969         }
 970
 971         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 972                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 973                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 974         }
 975
 976         if (info->attrs[NL80211_ATTR_KEY_IDX])
 977                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 978
 979         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 980                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 981
 982         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 983         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 984
 985         if (k->def) {
 986                 k->def_uni = true;
 987                 k->def_multi = true;
 988         }
 989         if (k->defmgmt)
 990                 k->def_multi = true;
 991
 992         if (info->attrs[NL80211_ATTR_KEY_TYPE])
 993                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 994
 995         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 996                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 997                 int err = nla_parse_nested(kdt,
 998                                            NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 999                                            info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
1000                                            nl80211_key_default_policy,
1001                                            info->extack);
1002                 if (err)
1003                         return err;
1004
1005                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1006                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1007         }
1008
1009         return 0;
1010 }
1011
1012 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
1013 {
1014         int err;
1015
1016         memset(k, 0, sizeof(*k));
1017         k->idx = -1;
1018         k->type = -1;
1019
1020         if (info->attrs[NL80211_ATTR_KEY])
1021                 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
1022         else
1023                 err = nl80211_parse_key_old(info, k);
1024
1025         if (err)
1026                 return err;
1027
1028         if (k->def && k->defmgmt) {
1029                 GENL_SET_ERR_MSG(info, "key with def && defmgmt is invalid");
1030                 return -EINVAL;
1031         }
1032
1033         if (k->defmgmt) {
1034                 if (k->def_uni || !k->def_multi) {
1035                         GENL_SET_ERR_MSG(info, "defmgmt key must be mcast");
1036                         return -EINVAL;
1037                 }
1038         }
1039
1040         if (k->idx != -1) {
1041                 if (k->defmgmt) {
1042                         if (k->idx < 4 || k->idx > 5) {
1043                                 GENL_SET_ERR_MSG(info,
1044                                                  "defmgmt key idx not 4 or 5");
1045                                 return -EINVAL;
1046                         }
1047                 } else if (k->def) {
1048                         if (k->idx < 0 || k->idx > 3) {
1049                                 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1050                                 return -EINVAL;
1051                         }
1052                 } else {
1053                         if (k->idx < 0 || k->idx > 5) {
1054                                 GENL_SET_ERR_MSG(info, "key idx not 0-5");
1055                                 return -EINVAL;
1056                         }
1057                 }
1058         }
1059
1060         return 0;
1061 }
1062
1063 static struct cfg80211_cached_keys *
1064 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1065                        struct genl_info *info, bool *no_ht)
1066 {
1067         struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1068         struct key_parse parse;
1069         struct nlattr *key;
1070         struct cfg80211_cached_keys *result;
1071         int rem, err, def = 0;
1072         bool have_key = false;
1073
1074         nla_for_each_nested(key, keys, rem) {
1075                 have_key = true;
1076                 break;
1077         }
1078
1079         if (!have_key)
1080                 return NULL;
1081
1082         result = kzalloc(sizeof(*result), GFP_KERNEL);
1083         if (!result)
1084                 return ERR_PTR(-ENOMEM);
1085
1086         result->def = -1;
1087
1088         nla_for_each_nested(key, keys, rem) {
1089                 memset(&parse, 0, sizeof(parse));
1090                 parse.idx = -1;
1091
1092                 err = nl80211_parse_key_new(info, key, &parse);
1093                 if (err)
1094                         goto error;
1095                 err = -EINVAL;
1096                 if (!parse.p.key)
1097                         goto error;
1098                 if (parse.idx < 0 || parse.idx > 3) {
1099                         GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1100                         goto error;
1101                 }
1102                 if (parse.def) {
1103                         if (def) {
1104                                 GENL_SET_ERR_MSG(info,
1105                                                  "only one key can be default");
1106                                 goto error;
1107                         }
1108                         def = 1;
1109                         result->def = parse.idx;
1110                         if (!parse.def_uni || !parse.def_multi)
1111                                 goto error;
1112                 } else if (parse.defmgmt)
1113                         goto error;
1114                 err = cfg80211_validate_key_settings(rdev, &parse.p,
1115                                                      parse.idx, false, NULL);
1116                 if (err)
1117                         goto error;
1118                 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1119                     parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1120                         GENL_SET_ERR_MSG(info, "connect key must be WEP");
1121                         err = -EINVAL;
1122                         goto error;
1123                 }
1124                 result->params[parse.idx].cipher = parse.p.cipher;
1125                 result->params[parse.idx].key_len = parse.p.key_len;
1126                 result->params[parse.idx].key = result->data[parse.idx];
1127                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1128
1129                 /* must be WEP key if we got here */
1130                 if (no_ht)
1131                         *no_ht = true;
1132         }
1133
1134         if (result->def < 0) {
1135                 err = -EINVAL;
1136                 GENL_SET_ERR_MSG(info, "need a default/TX key");
1137                 goto error;
1138         }
1139
1140         return result;
1141  error:
1142         kfree(result);
1143         return ERR_PTR(err);
1144 }
1145
1146 static int nl80211_key_allowed(struct wireless_dev *wdev)
1147 {
1148         ASSERT_WDEV_LOCK(wdev);
1149
1150         switch (wdev->iftype) {
1151         case NL80211_IFTYPE_AP:
1152         case NL80211_IFTYPE_AP_VLAN:
1153         case NL80211_IFTYPE_P2P_GO:
1154         case NL80211_IFTYPE_MESH_POINT:
1155                 break;
1156         case NL80211_IFTYPE_ADHOC:
1157         case NL80211_IFTYPE_STATION:
1158         case NL80211_IFTYPE_P2P_CLIENT:
1159                 if (!wdev->current_bss)
1160                         return -ENOLINK;
1161                 break;
1162         case NL80211_IFTYPE_UNSPECIFIED:
1163         case NL80211_IFTYPE_OCB:
1164         case NL80211_IFTYPE_MONITOR:
1165         case NL80211_IFTYPE_NAN:
1166         case NL80211_IFTYPE_P2P_DEVICE:
1167         case NL80211_IFTYPE_WDS:
1168         case NUM_NL80211_IFTYPES:
1169                 return -EINVAL;
1170         }
1171
1172         return 0;
1173 }
1174
1175 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1176                                                         struct nlattr *tb)
1177 {
1178         struct ieee80211_channel *chan;
1179
1180         if (tb == NULL)
1181                 return NULL;
1182         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
1183         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1184                 return NULL;
1185         return chan;
1186 }
1187
1188 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1189 {
1190         struct nlattr *nl_modes = nla_nest_start(msg, attr);
1191         int i;
1192
1193         if (!nl_modes)
1194                 goto nla_put_failure;
1195
1196         i = 0;
1197         while (ifmodes) {
1198                 if ((ifmodes & 1) && nla_put_flag(msg, i))
1199                         goto nla_put_failure;
1200                 ifmodes >>= 1;
1201                 i++;
1202         }
1203
1204         nla_nest_end(msg, nl_modes);
1205         return 0;
1206
1207 nla_put_failure:
1208         return -ENOBUFS;
1209 }
1210
1211 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1212                                           struct sk_buff *msg,
1213                                           bool large)
1214 {
1215         struct nlattr *nl_combis;
1216         int i, j;
1217
1218         nl_combis = nla_nest_start(msg,
1219                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
1220         if (!nl_combis)
1221                 goto nla_put_failure;
1222
1223         for (i = 0; i < wiphy->n_iface_combinations; i++) {
1224                 const struct ieee80211_iface_combination *c;
1225                 struct nlattr *nl_combi, *nl_limits;
1226
1227                 c = &wiphy->iface_combinations[i];
1228
1229                 nl_combi = nla_nest_start(msg, i + 1);
1230                 if (!nl_combi)
1231                         goto nla_put_failure;
1232
1233                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
1234                 if (!nl_limits)
1235                         goto nla_put_failure;
1236
1237                 for (j = 0; j < c->n_limits; j++) {
1238                         struct nlattr *nl_limit;
1239
1240                         nl_limit = nla_nest_start(msg, j + 1);
1241                         if (!nl_limit)
1242                                 goto nla_put_failure;
1243                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1244                                         c->limits[j].max))
1245                                 goto nla_put_failure;
1246                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1247                                                 c->limits[j].types))
1248                                 goto nla_put_failure;
1249                         nla_nest_end(msg, nl_limit);
1250                 }
1251
1252                 nla_nest_end(msg, nl_limits);
1253
1254                 if (c->beacon_int_infra_match &&
1255                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1256                         goto nla_put_failure;
1257                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1258                                 c->num_different_channels) ||
1259                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1260                                 c->max_interfaces))
1261                         goto nla_put_failure;
1262                 if (large &&
1263                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1264                                 c->radar_detect_widths) ||
1265                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1266                                 c->radar_detect_regions)))
1267                         goto nla_put_failure;
1268                 if (c->beacon_int_min_gcd &&
1269                     nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1270                                 c->beacon_int_min_gcd))
1271                         goto nla_put_failure;
1272
1273                 nla_nest_end(msg, nl_combi);
1274         }
1275
1276         nla_nest_end(msg, nl_combis);
1277
1278         return 0;
1279 nla_put_failure:
1280         return -ENOBUFS;
1281 }
1282
1283 #ifdef CONFIG_PM
1284 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1285                                         struct sk_buff *msg)
1286 {
1287         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1288         struct nlattr *nl_tcp;
1289
1290         if (!tcp)
1291                 return 0;
1292
1293         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1294         if (!nl_tcp)
1295                 return -ENOBUFS;
1296
1297         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1298                         tcp->data_payload_max))
1299                 return -ENOBUFS;
1300
1301         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1302                         tcp->data_payload_max))
1303                 return -ENOBUFS;
1304
1305         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1306                 return -ENOBUFS;
1307
1308         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1309                                 sizeof(*tcp->tok), tcp->tok))
1310                 return -ENOBUFS;
1311
1312         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1313                         tcp->data_interval_max))
1314                 return -ENOBUFS;
1315
1316         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1317                         tcp->wake_payload_max))
1318                 return -ENOBUFS;
1319
1320         nla_nest_end(msg, nl_tcp);
1321         return 0;
1322 }
1323
1324 static int nl80211_send_wowlan(struct sk_buff *msg,
1325                                struct cfg80211_registered_device *rdev,
1326                                bool large)
1327 {
1328         struct nlattr *nl_wowlan;
1329
1330         if (!rdev->wiphy.wowlan)
1331                 return 0;
1332
1333         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1334         if (!nl_wowlan)
1335                 return -ENOBUFS;
1336
1337         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1338              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1339             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1340              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1341             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1342              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1343             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1344              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1345             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1346              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1347             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1348              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1349             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1350              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1351             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1352              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1353                 return -ENOBUFS;
1354
1355         if (rdev->wiphy.wowlan->n_patterns) {
1356                 struct nl80211_pattern_support pat = {
1357                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1358                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1359                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1360                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1361                 };
1362
1363                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1364                             sizeof(pat), &pat))
1365                         return -ENOBUFS;
1366         }
1367
1368         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1369             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1370                         rdev->wiphy.wowlan->max_nd_match_sets))
1371                 return -ENOBUFS;
1372
1373         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1374                 return -ENOBUFS;
1375
1376         nla_nest_end(msg, nl_wowlan);
1377
1378         return 0;
1379 }
1380 #endif
1381
1382 static int nl80211_send_coalesce(struct sk_buff *msg,
1383                                  struct cfg80211_registered_device *rdev)
1384 {
1385         struct nl80211_coalesce_rule_support rule;
1386
1387         if (!rdev->wiphy.coalesce)
1388                 return 0;
1389
1390         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1391         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1392         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1393         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1394         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1395         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1396
1397         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1398                 return -ENOBUFS;
1399
1400         return 0;
1401 }
1402
1403 static int
1404 nl80211_send_iftype_data(struct sk_buff *msg,
1405                          const struct ieee80211_sband_iftype_data *iftdata)
1406 {
1407         const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1408
1409         if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1410                                 iftdata->types_mask))
1411                 return -ENOBUFS;
1412
1413         if (he_cap->has_he) {
1414                 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1415                             sizeof(he_cap->he_cap_elem.mac_cap_info),
1416                             he_cap->he_cap_elem.mac_cap_info) ||
1417                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1418                             sizeof(he_cap->he_cap_elem.phy_cap_info),
1419                             he_cap->he_cap_elem.phy_cap_info) ||
1420                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1421                             sizeof(he_cap->he_mcs_nss_supp),
1422                             &he_cap->he_mcs_nss_supp) ||
1423                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1424                             sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1425                         return -ENOBUFS;
1426         }
1427
1428         return 0;
1429 }
1430
1431 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1432                                       struct ieee80211_supported_band *sband)
1433 {
1434         struct nlattr *nl_rates, *nl_rate;
1435         struct ieee80211_rate *rate;
1436         int i;
1437
1438         /* add HT info */
1439         if (sband->ht_cap.ht_supported &&
1440             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1441                      sizeof(sband->ht_cap.mcs),
1442                      &sband->ht_cap.mcs) ||
1443              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1444                          sband->ht_cap.cap) ||
1445              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1446                         sband->ht_cap.ampdu_factor) ||
1447              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1448                         sband->ht_cap.ampdu_density)))
1449                 return -ENOBUFS;
1450
1451         /* add VHT info */
1452         if (sband->vht_cap.vht_supported &&
1453             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1454                      sizeof(sband->vht_cap.vht_mcs),
1455                      &sband->vht_cap.vht_mcs) ||
1456              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1457                          sband->vht_cap.cap)))
1458                 return -ENOBUFS;
1459
1460         if (sband->n_iftype_data) {
1461                 struct nlattr *nl_iftype_data =
1462                         nla_nest_start(msg, NL80211_BAND_ATTR_IFTYPE_DATA);
1463                 int err;
1464
1465                 if (!nl_iftype_data)
1466                         return -ENOBUFS;
1467
1468                 for (i = 0; i < sband->n_iftype_data; i++) {
1469                         struct nlattr *iftdata;
1470
1471                         iftdata = nla_nest_start(msg, i + 1);
1472                         if (!iftdata)
1473                                 return -ENOBUFS;
1474
1475                         err = nl80211_send_iftype_data(msg,
1476                                                        &sband->iftype_data[i]);
1477                         if (err)
1478                                 return err;
1479
1480                         nla_nest_end(msg, iftdata);
1481                 }
1482
1483                 nla_nest_end(msg, nl_iftype_data);
1484         }
1485
1486         /* add bitrates */
1487         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1488         if (!nl_rates)
1489                 return -ENOBUFS;
1490
1491         for (i = 0; i < sband->n_bitrates; i++) {
1492                 nl_rate = nla_nest_start(msg, i);
1493                 if (!nl_rate)
1494                         return -ENOBUFS;
1495
1496                 rate = &sband->bitrates[i];
1497                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1498                                 rate->bitrate))
1499                         return -ENOBUFS;
1500                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1501                     nla_put_flag(msg,
1502                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1503                         return -ENOBUFS;
1504
1505                 nla_nest_end(msg, nl_rate);
1506         }
1507
1508         nla_nest_end(msg, nl_rates);
1509
1510         return 0;
1511 }
1512
1513 static int
1514 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1515                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1516 {
1517         u16 stypes;
1518         struct nlattr *nl_ftypes, *nl_ifs;
1519         enum nl80211_iftype ift;
1520         int i;
1521
1522         if (!mgmt_stypes)
1523                 return 0;
1524
1525         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1526         if (!nl_ifs)
1527                 return -ENOBUFS;
1528
1529         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1530                 nl_ftypes = nla_nest_start(msg, ift);
1531                 if (!nl_ftypes)
1532                         return -ENOBUFS;
1533                 i = 0;
1534                 stypes = mgmt_stypes[ift].tx;
1535                 while (stypes) {
1536                         if ((stypes & 1) &&
1537                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1538                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1539                                 return -ENOBUFS;
1540                         stypes >>= 1;
1541                         i++;
1542                 }
1543                 nla_nest_end(msg, nl_ftypes);
1544         }
1545
1546         nla_nest_end(msg, nl_ifs);
1547
1548         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1549         if (!nl_ifs)
1550                 return -ENOBUFS;
1551
1552         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1553                 nl_ftypes = nla_nest_start(msg, ift);
1554                 if (!nl_ftypes)
1555                         return -ENOBUFS;
1556                 i = 0;
1557                 stypes = mgmt_stypes[ift].rx;
1558                 while (stypes) {
1559                         if ((stypes & 1) &&
1560                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1561                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1562                                 return -ENOBUFS;
1563                         stypes >>= 1;
1564                         i++;
1565                 }
1566                 nla_nest_end(msg, nl_ftypes);
1567         }
1568         nla_nest_end(msg, nl_ifs);
1569
1570         return 0;
1571 }
1572
1573 #define CMD(op, n)                                                      \
1574          do {                                                           \
1575                 if (rdev->ops->op) {                                    \
1576                         i++;                                            \
1577                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n))     \
1578                                 goto nla_put_failure;                   \
1579                 }                                                       \
1580         } while (0)
1581
1582 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
1583                                         struct sk_buff *msg)
1584 {
1585         int i = 0;
1586
1587         /*
1588          * do *NOT* add anything into this function, new things need to be
1589          * advertised only to new versions of userspace that can deal with
1590          * the split (and they can't possibly care about new features...
1591          */
1592         CMD(add_virtual_intf, NEW_INTERFACE);
1593         CMD(change_virtual_intf, SET_INTERFACE);
1594         CMD(add_key, NEW_KEY);
1595         CMD(start_ap, START_AP);
1596         CMD(add_station, NEW_STATION);
1597         CMD(add_mpath, NEW_MPATH);
1598         CMD(update_mesh_config, SET_MESH_CONFIG);
1599         CMD(change_bss, SET_BSS);
1600         CMD(auth, AUTHENTICATE);
1601         CMD(assoc, ASSOCIATE);
1602         CMD(deauth, DEAUTHENTICATE);
1603         CMD(disassoc, DISASSOCIATE);
1604         CMD(join_ibss, JOIN_IBSS);
1605         CMD(join_mesh, JOIN_MESH);
1606         CMD(set_pmksa, SET_PMKSA);
1607         CMD(del_pmksa, DEL_PMKSA);
1608         CMD(flush_pmksa, FLUSH_PMKSA);
1609         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1610                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1611         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1612         CMD(mgmt_tx, FRAME);
1613         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1614         if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1615                 i++;
1616                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1617                         goto nla_put_failure;
1618         }
1619         if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1620             rdev->ops->join_mesh) {
1621                 i++;
1622                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1623                         goto nla_put_failure;
1624         }
1625         CMD(set_wds_peer, SET_WDS_PEER);
1626         if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1627                 CMD(tdls_mgmt, TDLS_MGMT);
1628                 CMD(tdls_oper, TDLS_OPER);
1629         }
1630         if (rdev->wiphy.max_sched_scan_reqs)
1631                 CMD(sched_scan_start, START_SCHED_SCAN);
1632         CMD(probe_client, PROBE_CLIENT);
1633         CMD(set_noack_map, SET_NOACK_MAP);
1634         if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1635                 i++;
1636                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1637                         goto nla_put_failure;
1638         }
1639         CMD(start_p2p_device, START_P2P_DEVICE);
1640         CMD(set_mcast_rate, SET_MCAST_RATE);
1641 #ifdef CONFIG_NL80211_TESTMODE
1642         CMD(testmode_cmd, TESTMODE);
1643 #endif
1644
1645         if (rdev->ops->connect || rdev->ops->auth) {
1646                 i++;
1647                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1648                         goto nla_put_failure;
1649         }
1650
1651         if (rdev->ops->disconnect || rdev->ops->deauth) {
1652                 i++;
1653                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1654                         goto nla_put_failure;
1655         }
1656
1657         return i;
1658  nla_put_failure:
1659         return -ENOBUFS;
1660 }
1661
1662 static int
1663 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
1664                            struct sk_buff *msg)
1665 {
1666         struct nlattr *ftm;
1667
1668         if (!cap->ftm.supported)
1669                 return 0;
1670
1671         ftm = nla_nest_start(msg, NL80211_PMSR_TYPE_FTM);
1672         if (!ftm)
1673                 return -ENOBUFS;
1674
1675         if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
1676                 return -ENOBUFS;
1677         if (cap->ftm.non_asap &&
1678             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
1679                 return -ENOBUFS;
1680         if (cap->ftm.request_lci &&
1681             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
1682                 return -ENOBUFS;
1683         if (cap->ftm.request_civicloc &&
1684             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
1685                 return -ENOBUFS;
1686         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
1687                         cap->ftm.preambles))
1688                 return -ENOBUFS;
1689         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
1690                         cap->ftm.bandwidths))
1691                 return -ENOBUFS;
1692         if (cap->ftm.max_bursts_exponent >= 0 &&
1693             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
1694                         cap->ftm.max_bursts_exponent))
1695                 return -ENOBUFS;
1696         if (cap->ftm.max_ftms_per_burst &&
1697             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
1698                         cap->ftm.max_ftms_per_burst))
1699                 return -ENOBUFS;
1700
1701         nla_nest_end(msg, ftm);
1702         return 0;
1703 }
1704
1705 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
1706                                   struct sk_buff *msg)
1707 {
1708         const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
1709         struct nlattr *pmsr, *caps;
1710
1711         if (!cap)
1712                 return 0;
1713
1714         /*
1715          * we don't need to clean up anything here since the caller
1716          * will genlmsg_cancel() if we fail
1717          */
1718
1719         pmsr = nla_nest_start(msg, NL80211_ATTR_PEER_MEASUREMENTS);
1720         if (!pmsr)
1721                 return -ENOBUFS;
1722
1723         if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
1724                 return -ENOBUFS;
1725
1726         if (cap->report_ap_tsf &&
1727             nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
1728                 return -ENOBUFS;
1729
1730         if (cap->randomize_mac_addr &&
1731             nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
1732                 return -ENOBUFS;
1733
1734         caps = nla_nest_start(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
1735         if (!caps)
1736                 return -ENOBUFS;
1737
1738         if (nl80211_send_pmsr_ftm_capa(cap, msg))
1739                 return -ENOBUFS;
1740
1741         nla_nest_end(msg, caps);
1742         nla_nest_end(msg, pmsr);
1743
1744         return 0;
1745 }
1746
1747 struct nl80211_dump_wiphy_state {
1748         s64 filter_wiphy;
1749         long start;
1750         long split_start, band_start, chan_start, capa_start;
1751         bool split;
1752 };
1753
1754 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1755                               enum nl80211_commands cmd,
1756                               struct sk_buff *msg, u32 portid, u32 seq,
1757                               int flags, struct nl80211_dump_wiphy_state *state)
1758 {
1759         void *hdr;
1760         struct nlattr *nl_bands, *nl_band;
1761         struct nlattr *nl_freqs, *nl_freq;
1762         struct nlattr *nl_cmds;
1763         enum nl80211_band band;
1764         struct ieee80211_channel *chan;
1765         int i;
1766         const struct ieee80211_txrx_stypes *mgmt_stypes =
1767                                 rdev->wiphy.mgmt_stypes;
1768         u32 features;
1769
1770         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1771         if (!hdr)
1772                 return -ENOBUFS;
1773
1774         if (WARN_ON(!state))
1775                 return -EINVAL;
1776
1777         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1778             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1779                            wiphy_name(&rdev->wiphy)) ||
1780             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1781                         cfg80211_rdev_list_generation))
1782                 goto nla_put_failure;
1783
1784         if (cmd != NL80211_CMD_NEW_WIPHY)
1785                 goto finish;
1786
1787         switch (state->split_start) {
1788         case 0:
1789                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1790                                rdev->wiphy.retry_short) ||
1791                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1792                                rdev->wiphy.retry_long) ||
1793                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1794                                 rdev->wiphy.frag_threshold) ||
1795                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1796                                 rdev->wiphy.rts_threshold) ||
1797                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1798                                rdev->wiphy.coverage_class) ||
1799                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1800                                rdev->wiphy.max_scan_ssids) ||
1801                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1802                                rdev->wiphy.max_sched_scan_ssids) ||
1803                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1804                                 rdev->wiphy.max_scan_ie_len) ||
1805                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1806                                 rdev->wiphy.max_sched_scan_ie_len) ||
1807                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1808                                rdev->wiphy.max_match_sets) ||
1809                     nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1810                                 rdev->wiphy.max_sched_scan_plans) ||
1811                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1812                                 rdev->wiphy.max_sched_scan_plan_interval) ||
1813                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1814                                 rdev->wiphy.max_sched_scan_plan_iterations))
1815                         goto nla_put_failure;
1816
1817                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1818                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1819                         goto nla_put_failure;
1820                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1821                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1822                         goto nla_put_failure;
1823                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1824                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1825                         goto nla_put_failure;
1826                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1827                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1828                         goto nla_put_failure;
1829                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1830                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1831                         goto nla_put_failure;
1832                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1833                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1834                         goto nla_put_failure;
1835                 state->split_start++;
1836                 if (state->split)
1837                         break;
1838                 /* fall through */
1839         case 1:
1840                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1841                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1842                             rdev->wiphy.cipher_suites))
1843                         goto nla_put_failure;
1844
1845                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1846                                rdev->wiphy.max_num_pmkids))
1847                         goto nla_put_failure;
1848
1849                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1850                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1851                         goto nla_put_failure;
1852
1853                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1854                                 rdev->wiphy.available_antennas_tx) ||
1855                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1856                                 rdev->wiphy.available_antennas_rx))
1857                         goto nla_put_failure;
1858
1859                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1860                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1861                                 rdev->wiphy.probe_resp_offload))
1862                         goto nla_put_failure;
1863
1864                 if ((rdev->wiphy.available_antennas_tx ||
1865                      rdev->wiphy.available_antennas_rx) &&
1866                     rdev->ops->get_antenna) {
1867                         u32 tx_ant = 0, rx_ant = 0;
1868                         int res;
1869
1870                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1871                         if (!res) {
1872                                 if (nla_put_u32(msg,
1873                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1874                                                 tx_ant) ||
1875                                     nla_put_u32(msg,
1876                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1877                                                 rx_ant))
1878                                         goto nla_put_failure;
1879                         }
1880                 }
1881
1882                 state->split_start++;
1883                 if (state->split)
1884                         break;
1885                 /* fall through */
1886         case 2:
1887                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1888                                         rdev->wiphy.interface_modes))
1889                                 goto nla_put_failure;
1890                 state->split_start++;
1891                 if (state->split)
1892                         break;
1893                 /* fall through */
1894         case 3:
1895                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1896                 if (!nl_bands)
1897                         goto nla_put_failure;
1898
1899                 for (band = state->band_start;
1900                      band < NUM_NL80211_BANDS; band++) {
1901                         struct ieee80211_supported_band *sband;
1902
1903                         sband = rdev->wiphy.bands[band];
1904
1905                         if (!sband)
1906                                 continue;
1907
1908                         nl_band = nla_nest_start(msg, band);
1909                         if (!nl_band)
1910                                 goto nla_put_failure;
1911
1912                         switch (state->chan_start) {
1913                         case 0:
1914                                 if (nl80211_send_band_rateinfo(msg, sband))
1915                                         goto nla_put_failure;
1916                                 state->chan_start++;
1917                                 if (state->split)
1918                                         break;
1919                                 /* fall through */
1920                         default:
1921                                 /* add frequencies */
1922                                 nl_freqs = nla_nest_start(
1923                                         msg, NL80211_BAND_ATTR_FREQS);
1924                                 if (!nl_freqs)
1925                                         goto nla_put_failure;
1926
1927                                 for (i = state->chan_start - 1;
1928                                      i < sband->n_channels;
1929                                      i++) {
1930                                         nl_freq = nla_nest_start(msg, i);
1931                                         if (!nl_freq)
1932                                                 goto nla_put_failure;
1933
1934                                         chan = &sband->channels[i];
1935
1936                                         if (nl80211_msg_put_channel(
1937                                                         msg, &rdev->wiphy, chan,
1938                                                         state->split))
1939                                                 goto nla_put_failure;
1940
1941                                         nla_nest_end(msg, nl_freq);
1942                                         if (state->split)
1943                                                 break;
1944                                 }
1945                                 if (i < sband->n_channels)
1946                                         state->chan_start = i + 2;
1947                                 else
1948                                         state->chan_start = 0;
1949                                 nla_nest_end(msg, nl_freqs);
1950                         }
1951
1952                         nla_nest_end(msg, nl_band);
1953
1954                         if (state->split) {
1955                                 /* start again here */
1956                                 if (state->chan_start)
1957                                         band--;
1958                                 break;
1959                         }
1960                 }
1961                 nla_nest_end(msg, nl_bands);
1962
1963                 if (band < NUM_NL80211_BANDS)
1964                         state->band_start = band + 1;
1965                 else
1966                         state->band_start = 0;
1967
1968                 /* if bands & channels are done, continue outside */
1969                 if (state->band_start == 0 && state->chan_start == 0)
1970                         state->split_start++;
1971                 if (state->split)
1972                         break;
1973                 /* fall through */
1974         case 4:
1975                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1976                 if (!nl_cmds)
1977                         goto nla_put_failure;
1978
1979                 i = nl80211_add_commands_unsplit(rdev, msg);
1980                 if (i < 0)
1981                         goto nla_put_failure;
1982                 if (state->split) {
1983                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1984                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1985                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1986                                 CMD(channel_switch, CHANNEL_SWITCH);
1987                         CMD(set_qos_map, SET_QOS_MAP);
1988                         if (rdev->wiphy.features &
1989                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1990                                 CMD(add_tx_ts, ADD_TX_TS);
1991                         CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
1992                         CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
1993                 }
1994 #undef CMD
1995
1996                 nla_nest_end(msg, nl_cmds);
1997                 state->split_start++;
1998                 if (state->split)
1999                         break;
2000                 /* fall through */
2001         case 5:
2002                 if (rdev->ops->remain_on_channel &&
2003                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
2004                     nla_put_u32(msg,
2005                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
2006                                 rdev->wiphy.max_remain_on_channel_duration))
2007                         goto nla_put_failure;
2008
2009                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
2010                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
2011                         goto nla_put_failure;
2012
2013                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
2014                         goto nla_put_failure;
2015                 state->split_start++;
2016                 if (state->split)
2017                         break;
2018                 /* fall through */
2019         case 6:
2020 #ifdef CONFIG_PM
2021                 if (nl80211_send_wowlan(msg, rdev, state->split))
2022                         goto nla_put_failure;
2023                 state->split_start++;
2024                 if (state->split)
2025                         break;
2026 #else
2027                 state->split_start++;
2028 #endif
2029                 /* fall through */
2030         case 7:
2031                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
2032                                         rdev->wiphy.software_iftypes))
2033                         goto nla_put_failure;
2034
2035                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
2036                                                    state->split))
2037                         goto nla_put_failure;
2038
2039                 state->split_start++;
2040                 if (state->split)
2041                         break;
2042                 /* fall through */
2043         case 8:
2044                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
2045                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
2046                                 rdev->wiphy.ap_sme_capa))
2047                         goto nla_put_failure;
2048
2049                 features = rdev->wiphy.features;
2050                 /*
2051                  * We can only add the per-channel limit information if the
2052                  * dump is split, otherwise it makes it too big. Therefore
2053                  * only advertise it in that case.
2054                  */
2055                 if (state->split)
2056                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
2057                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
2058                         goto nla_put_failure;
2059
2060                 if (rdev->wiphy.ht_capa_mod_mask &&
2061                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
2062                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
2063                             rdev->wiphy.ht_capa_mod_mask))
2064                         goto nla_put_failure;
2065
2066                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
2067                     rdev->wiphy.max_acl_mac_addrs &&
2068                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
2069                                 rdev->wiphy.max_acl_mac_addrs))
2070                         goto nla_put_failure;
2071
2072                 /*
2073                  * Any information below this point is only available to
2074                  * applications that can deal with it being split. This
2075                  * helps ensure that newly added capabilities don't break
2076                  * older tools by overrunning their buffers.
2077                  *
2078                  * We still increment split_start so that in the split
2079                  * case we'll continue with more data in the next round,
2080                  * but break unconditionally so unsplit data stops here.
2081                  */
2082                 state->split_start++;
2083                 break;
2084         case 9:
2085                 if (rdev->wiphy.extended_capabilities &&
2086                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
2087                              rdev->wiphy.extended_capabilities_len,
2088                              rdev->wiphy.extended_capabilities) ||
2089                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2090                              rdev->wiphy.extended_capabilities_len,
2091                              rdev->wiphy.extended_capabilities_mask)))
2092                         goto nla_put_failure;
2093
2094                 if (rdev->wiphy.vht_capa_mod_mask &&
2095                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
2096                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
2097                             rdev->wiphy.vht_capa_mod_mask))
2098                         goto nla_put_failure;
2099
2100                 state->split_start++;
2101                 break;
2102         case 10:
2103                 if (nl80211_send_coalesce(msg, rdev))
2104                         goto nla_put_failure;
2105
2106                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
2107                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
2108                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
2109                         goto nla_put_failure;
2110
2111                 if (rdev->wiphy.max_ap_assoc_sta &&
2112                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
2113                                 rdev->wiphy.max_ap_assoc_sta))
2114                         goto nla_put_failure;
2115
2116                 state->split_start++;
2117                 break;
2118         case 11:
2119                 if (rdev->wiphy.n_vendor_commands) {
2120                         const struct nl80211_vendor_cmd_info *info;
2121                         struct nlattr *nested;
2122
2123                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
2124                         if (!nested)
2125                                 goto nla_put_failure;
2126
2127                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
2128                                 info = &rdev->wiphy.vendor_commands[i].info;
2129                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2130                                         goto nla_put_failure;
2131                         }
2132                         nla_nest_end(msg, nested);
2133                 }
2134
2135                 if (rdev->wiphy.n_vendor_events) {
2136                         const struct nl80211_vendor_cmd_info *info;
2137                         struct nlattr *nested;
2138
2139                         nested = nla_nest_start(msg,
2140                                                 NL80211_ATTR_VENDOR_EVENTS);
2141                         if (!nested)
2142                                 goto nla_put_failure;
2143
2144                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
2145                                 info = &rdev->wiphy.vendor_events[i];
2146                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2147                                         goto nla_put_failure;
2148                         }
2149                         nla_nest_end(msg, nested);
2150                 }
2151                 state->split_start++;
2152                 break;
2153         case 12:
2154                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
2155                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
2156                                rdev->wiphy.max_num_csa_counters))
2157                         goto nla_put_failure;
2158
2159                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2160                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
2161                         goto nla_put_failure;
2162
2163                 if (rdev->wiphy.max_sched_scan_reqs &&
2164                     nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
2165                                 rdev->wiphy.max_sched_scan_reqs))
2166                         goto nla_put_failure;
2167
2168                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2169                             sizeof(rdev->wiphy.ext_features),
2170                             rdev->wiphy.ext_features))
2171                         goto nla_put_failure;
2172
2173                 if (rdev->wiphy.bss_select_support) {
2174                         struct nlattr *nested;
2175                         u32 bss_select_support = rdev->wiphy.bss_select_support;
2176
2177                         nested = nla_nest_start(msg, NL80211_ATTR_BSS_SELECT);
2178                         if (!nested)
2179                                 goto nla_put_failure;
2180
2181                         i = 0;
2182                         while (bss_select_support) {
2183                                 if ((bss_select_support & 1) &&
2184                                     nla_put_flag(msg, i))
2185                                         goto nla_put_failure;
2186                                 i++;
2187                                 bss_select_support >>= 1;
2188                         }
2189                         nla_nest_end(msg, nested);
2190                 }
2191
2192                 state->split_start++;
2193                 break;
2194         case 13:
2195                 if (rdev->wiphy.num_iftype_ext_capab &&
2196                     rdev->wiphy.iftype_ext_capab) {
2197                         struct nlattr *nested_ext_capab, *nested;
2198
2199                         nested = nla_nest_start(msg,
2200                                                 NL80211_ATTR_IFTYPE_EXT_CAPA);
2201                         if (!nested)
2202                                 goto nla_put_failure;
2203
2204                         for (i = state->capa_start;
2205                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
2206                                 const struct wiphy_iftype_ext_capab *capab;
2207
2208                                 capab = &rdev->wiphy.iftype_ext_capab[i];
2209
2210                                 nested_ext_capab = nla_nest_start(msg, i);
2211                                 if (!nested_ext_capab ||
2212                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
2213                                                 capab->iftype) ||
2214                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
2215                                             capab->extended_capabilities_len,
2216                                             capab->extended_capabilities) ||
2217                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2218                                             capab->extended_capabilities_len,
2219                                             capab->extended_capabilities_mask))
2220                                         goto nla_put_failure;
2221
2222                                 nla_nest_end(msg, nested_ext_capab);
2223                                 if (state->split)
2224                                         break;
2225                         }
2226                         nla_nest_end(msg, nested);
2227                         if (i < rdev->wiphy.num_iftype_ext_capab) {
2228                                 state->capa_start = i + 1;
2229                                 break;
2230                         }
2231                 }
2232
2233                 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
2234                                 rdev->wiphy.nan_supported_bands))
2235                         goto nla_put_failure;
2236
2237                 if (wiphy_ext_feature_isset(&rdev->wiphy,
2238                                             NL80211_EXT_FEATURE_TXQS)) {
2239                         struct cfg80211_txq_stats txqstats = {};
2240                         int res;
2241
2242                         res = rdev_get_txq_stats(rdev, NULL, &txqstats);
2243                         if (!res &&
2244                             !nl80211_put_txq_stats(msg, &txqstats,
2245                                                    NL80211_ATTR_TXQ_STATS))
2246                                 goto nla_put_failure;
2247
2248                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
2249                                         rdev->wiphy.txq_limit))
2250                                 goto nla_put_failure;
2251                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
2252                                         rdev->wiphy.txq_memory_limit))
2253                                 goto nla_put_failure;
2254                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
2255                                         rdev->wiphy.txq_quantum))
2256                                 goto nla_put_failure;
2257                 }
2258
2259                 state->split_start++;
2260                 break;
2261         case 14:
2262                 if (nl80211_send_pmsr_capa(rdev, msg))
2263                         goto nla_put_failure;
2264
2265                 state->split_start++;
2266                 break;
2267         case 15:
2268                 if (rdev->wiphy.akm_suites &&
2269                     nla_put(msg, NL80211_ATTR_AKM_SUITES,
2270                             sizeof(u32) * rdev->wiphy.n_akm_suites,
2271                             rdev->wiphy.akm_suites))
2272                         goto nla_put_failure;
2273
2274                 /* done */
2275                 state->split_start = 0;
2276                 break;
2277         }
2278  finish:
2279         genlmsg_end(msg, hdr);
2280         return 0;
2281
2282  nla_put_failure:
2283         genlmsg_cancel(msg, hdr);
2284         return -EMSGSIZE;
2285 }
2286
2287 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
2288                                     struct netlink_callback *cb,
2289                                     struct nl80211_dump_wiphy_state *state)
2290 {
2291         struct nlattr **tb = genl_family_attrbuf(&nl80211_fam);
2292         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, tb,
2293                               nl80211_fam.maxattr, nl80211_policy, NULL);
2294         /* ignore parse errors for backward compatibility */
2295         if (ret)
2296                 return 0;
2297
2298         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
2299         if (tb[NL80211_ATTR_WIPHY])
2300                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
2301         if (tb[NL80211_ATTR_WDEV])
2302                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
2303         if (tb[NL80211_ATTR_IFINDEX]) {
2304                 struct net_device *netdev;
2305                 struct cfg80211_registered_device *rdev;
2306                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2307
2308                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2309                 if (!netdev)
2310                         return -ENODEV;
2311                 if (netdev->ieee80211_ptr) {
2312                         rdev = wiphy_to_rdev(
2313                                 netdev->ieee80211_ptr->wiphy);
2314                         state->filter_wiphy = rdev->wiphy_idx;
2315                 }
2316         }
2317
2318         return 0;
2319 }
2320
2321 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
2322 {
2323         int idx = 0, ret;
2324         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
2325         struct cfg80211_registered_device *rdev;
2326
2327         rtnl_lock();
2328         if (!state) {
2329                 state = kzalloc(sizeof(*state), GFP_KERNEL);
2330                 if (!state) {
2331                         rtnl_unlock();
2332                         return -ENOMEM;
2333                 }
2334                 state->filter_wiphy = -1;
2335                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
2336                 if (ret) {
2337                         kfree(state);
2338                         rtnl_unlock();
2339                         return ret;
2340                 }
2341                 cb->args[0] = (long)state;
2342         }
2343
2344         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2345                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2346                         continue;
2347                 if (++idx <= state->start)
2348                         continue;
2349                 if (state->filter_wiphy != -1 &&
2350                     state->filter_wiphy != rdev->wiphy_idx)
2351                         continue;
2352                 /* attempt to fit multiple wiphy data chunks into the skb */
2353                 do {
2354                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
2355                                                  skb,
2356                                                  NETLINK_CB(cb->skb).portid,
2357                                                  cb->nlh->nlmsg_seq,
2358                                                  NLM_F_MULTI, state);
2359                         if (ret < 0) {
2360                                 /*
2361                                  * If sending the wiphy data didn't fit (ENOBUFS
2362                                  * or EMSGSIZE returned), this SKB is still
2363                                  * empty (so it's not too big because another
2364                                  * wiphy dataset is already in the skb) and
2365                                  * we've not tried to adjust the dump allocation
2366                                  * yet ... then adjust the alloc size to be
2367                                  * bigger, and return 1 but with the empty skb.
2368                                  * This results in an empty message being RX'ed
2369                                  * in userspace, but that is ignored.
2370                                  *
2371                                  * We can then retry with the larger buffer.
2372                                  */
2373                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
2374                                     !skb->len && !state->split &&
2375                                     cb->min_dump_alloc < 4096) {
2376                                         cb->min_dump_alloc = 4096;
2377                                         state->split_start = 0;
2378                                         rtnl_unlock();
2379                                         return 1;
2380                                 }
2381                                 idx--;
2382                                 break;
2383                         }
2384                 } while (state->split_start > 0);
2385                 break;
2386         }
2387         rtnl_unlock();
2388
2389         state->start = idx;
2390
2391         return skb->len;
2392 }
2393
2394 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
2395 {
2396         kfree((void *)cb->args[0]);
2397         return 0;
2398 }
2399
2400 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
2401 {
2402         struct sk_buff *msg;
2403         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2404         struct nl80211_dump_wiphy_state state = {};
2405
2406         msg = nlmsg_new(4096, GFP_KERNEL);
2407         if (!msg)
2408                 return -ENOMEM;
2409
2410         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
2411                                info->snd_portid, info->snd_seq, 0,
2412                                &state) < 0) {
2413                 nlmsg_free(msg);
2414                 return -ENOBUFS;
2415         }
2416
2417         return genlmsg_reply(msg, info);
2418 }
2419
2420 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2421         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
2422         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
2423         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
2424         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
2425         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
2426 };
2427
2428 static int parse_txq_params(struct nlattr *tb[],
2429                             struct ieee80211_txq_params *txq_params)
2430 {
2431         u8 ac;
2432
2433         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2434             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2435             !tb[NL80211_TXQ_ATTR_AIFS])
2436                 return -EINVAL;
2437
2438         ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2439         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2440         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2441         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2442         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2443
2444         if (ac >= NL80211_NUM_ACS)
2445                 return -EINVAL;
2446         txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
2447         return 0;
2448 }
2449
2450 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2451 {
2452         /*
2453          * You can only set the channel explicitly for WDS interfaces,
2454          * all others have their channel managed via their respective
2455          * "establish a connection" command (connect, join, ...)
2456          *
2457          * For AP/GO and mesh mode, the channel can be set with the
2458          * channel userspace API, but is only stored and passed to the
2459          * low-level driver when the AP starts or the mesh is joined.
2460          * This is for backward compatibility, userspace can also give
2461          * the channel in the start-ap or join-mesh commands instead.
2462          *
2463          * Monitors are special as they are normally slaved to
2464          * whatever else is going on, so they have their own special
2465          * operation to set the monitor channel if possible.
2466          */
2467         return !wdev ||
2468                 wdev->iftype == NL80211_IFTYPE_AP ||
2469                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2470                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
2471                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
2472 }
2473
2474 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2475                           struct genl_info *info,
2476                           struct cfg80211_chan_def *chandef)
2477 {
2478         struct netlink_ext_ack *extack = info->extack;
2479         struct nlattr **attrs = info->attrs;
2480         u32 control_freq;
2481
2482         if (!attrs[NL80211_ATTR_WIPHY_FREQ])
2483                 return -EINVAL;
2484
2485         control_freq = nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ]);
2486
2487         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
2488         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2489         chandef->center_freq1 = control_freq;
2490         chandef->center_freq2 = 0;
2491
2492         /* Primary channel not allowed */
2493         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) {
2494                 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
2495                                     "Channel is disabled");
2496                 return -EINVAL;
2497         }
2498
2499         if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2500                 enum nl80211_channel_type chantype;
2501
2502                 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2503
2504                 switch (chantype) {
2505                 case NL80211_CHAN_NO_HT:
2506                 case NL80211_CHAN_HT20:
2507                 case NL80211_CHAN_HT40PLUS:
2508                 case NL80211_CHAN_HT40MINUS:
2509                         cfg80211_chandef_create(chandef, chandef->chan,
2510                                                 chantype);
2511                         /* user input for center_freq is incorrect */
2512                         if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
2513                             chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
2514                                 NL_SET_ERR_MSG_ATTR(extack,
2515                                                     attrs[NL80211_ATTR_CENTER_FREQ1],
2516                                                     "bad center frequency 1");
2517                                 return -EINVAL;
2518                         }
2519                         /* center_freq2 must be zero */
2520                         if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
2521                             nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
2522                                 NL_SET_ERR_MSG_ATTR(extack,
2523                                                     attrs[NL80211_ATTR_CENTER_FREQ2],
2524                                                     "center frequency 2 can't be used");
2525                                 return -EINVAL;
2526                         }
2527                         break;
2528                 default:
2529                         NL_SET_ERR_MSG_ATTR(extack,
2530                                             attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
2531                                             "invalid channel type");
2532                         return -EINVAL;
2533                 }
2534         } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2535                 chandef->width =
2536                         nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2537                 if (attrs[NL80211_ATTR_CENTER_FREQ1])
2538                         chandef->center_freq1 =
2539                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
2540                 if (attrs[NL80211_ATTR_CENTER_FREQ2])
2541                         chandef->center_freq2 =
2542                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
2543         }
2544
2545         if (!cfg80211_chandef_valid(chandef)) {
2546                 NL_SET_ERR_MSG(extack, "invalid channel definition");
2547                 return -EINVAL;
2548         }
2549
2550         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2551                                      IEEE80211_CHAN_DISABLED)) {
2552                 NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
2553                 return -EINVAL;
2554         }
2555
2556         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2557              chandef->width == NL80211_CHAN_WIDTH_10) &&
2558             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
2559                 NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
2560                 return -EINVAL;
2561         }
2562
2563         return 0;
2564 }
2565
2566 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
2567                                  struct net_device *dev,
2568                                  struct genl_info *info)
2569 {
2570         struct cfg80211_chan_def chandef;
2571         int result;
2572         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2573         struct wireless_dev *wdev = NULL;
2574
2575         if (dev)
2576                 wdev = dev->ieee80211_ptr;
2577         if (!nl80211_can_set_dev_channel(wdev))
2578                 return -EOPNOTSUPP;
2579         if (wdev)
2580                 iftype = wdev->iftype;
2581
2582         result = nl80211_parse_chandef(rdev, info, &chandef);
2583         if (result)
2584                 return result;
2585
2586         switch (iftype) {
2587         case NL80211_IFTYPE_AP:
2588         case NL80211_IFTYPE_P2P_GO:
2589                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2590                                                    iftype)) {
2591                         result = -EINVAL;
2592                         break;
2593                 }
2594                 if (wdev->beacon_interval) {
2595                         if (!dev || !rdev->ops->set_ap_chanwidth ||
2596                             !(rdev->wiphy.features &
2597                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2598                                 result = -EBUSY;
2599                                 break;
2600                         }
2601
2602                         /* Only allow dynamic channel width changes */
2603                         if (chandef.chan != wdev->preset_chandef.chan) {
2604                                 result = -EBUSY;
2605                                 break;
2606                         }
2607                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2608                         if (result)
2609                                 break;
2610                 }
2611                 wdev->preset_chandef = chandef;
2612                 result = 0;
2613                 break;
2614         case NL80211_IFTYPE_MESH_POINT:
2615                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2616                 break;
2617         case NL80211_IFTYPE_MONITOR:
2618                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2619                 break;
2620         default:
2621                 result = -EINVAL;
2622         }
2623
2624         return result;
2625 }
2626
2627 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2628 {
2629         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2630         struct net_device *netdev = info->user_ptr[1];
2631
2632         return __nl80211_set_channel(rdev, netdev, info);
2633 }
2634
2635 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2636 {
2637         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2638         struct net_device *dev = info->user_ptr[1];
2639         struct wireless_dev *wdev = dev->ieee80211_ptr;
2640         const u8 *bssid;
2641
2642         if (!info->attrs[NL80211_ATTR_MAC])
2643                 return -EINVAL;
2644
2645         if (netif_running(dev))
2646                 return -EBUSY;
2647
2648         if (!rdev->ops->set_wds_peer)
2649                 return -EOPNOTSUPP;
2650
2651         if (wdev->iftype != NL80211_IFTYPE_WDS)
2652                 return -EOPNOTSUPP;
2653
2654         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2655         return rdev_set_wds_peer(rdev, dev, bssid);
2656 }
2657
2658 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2659 {
2660         struct cfg80211_registered_device *rdev;
2661         struct net_device *netdev = NULL;
2662         struct wireless_dev *wdev;
2663         int result = 0, rem_txq_params = 0;
2664         struct nlattr *nl_txq_params;
2665         u32 changed;
2666         u8 retry_short = 0, retry_long = 0;
2667         u32 frag_threshold = 0, rts_threshold = 0;
2668         u8 coverage_class = 0;
2669         u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
2670
2671         ASSERT_RTNL();
2672
2673         /*
2674          * Try to find the wiphy and netdev. Normally this
2675          * function shouldn't need the netdev, but this is
2676          * done for backward compatibility -- previously
2677          * setting the channel was done per wiphy, but now
2678          * it is per netdev. Previous userland like hostapd
2679          * also passed a netdev to set_wiphy, so that it is
2680          * possible to let that go to the right netdev!
2681          */
2682
2683         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2684                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2685
2686                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2687                 if (netdev && netdev->ieee80211_ptr)
2688                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2689                 else
2690                         netdev = NULL;
2691         }
2692
2693         if (!netdev) {
2694                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2695                                                   info->attrs);
2696                 if (IS_ERR(rdev))
2697                         return PTR_ERR(rdev);
2698                 wdev = NULL;
2699                 netdev = NULL;
2700                 result = 0;
2701         } else
2702                 wdev = netdev->ieee80211_ptr;
2703
2704         /*
2705          * end workaround code, by now the rdev is available
2706          * and locked, and wdev may or may not be NULL.
2707          */
2708
2709         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2710                 result = cfg80211_dev_rename(
2711                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2712
2713         if (result)
2714                 return result;
2715
2716         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2717                 struct ieee80211_txq_params txq_params;
2718                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2719
2720                 if (!rdev->ops->set_txq_params)
2721                         return -EOPNOTSUPP;
2722
2723                 if (!netdev)
2724                         return -EINVAL;
2725
2726                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2727                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2728                         return -EINVAL;
2729
2730                 if (!netif_running(netdev))
2731                         return -ENETDOWN;
2732
2733                 nla_for_each_nested(nl_txq_params,
2734                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2735                                     rem_txq_params) {
2736                         result = nla_parse_nested(tb, NL80211_TXQ_ATTR_MAX,
2737                                                   nl_txq_params,
2738                                                   txq_params_policy,
2739                                                   info->extack);
2740                         if (result)
2741                                 return result;
2742                         result = parse_txq_params(tb, &txq_params);
2743                         if (result)
2744                                 return result;
2745
2746                         result = rdev_set_txq_params(rdev, netdev,
2747                                                      &txq_params);
2748                         if (result)
2749                                 return result;
2750                 }
2751         }
2752
2753         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2754                 result = __nl80211_set_channel(
2755                         rdev,
2756                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2757                         info);
2758                 if (result)
2759                         return result;
2760         }
2761
2762         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2763                 struct wireless_dev *txp_wdev = wdev;
2764                 enum nl80211_tx_power_setting type;
2765                 int idx, mbm = 0;
2766
2767                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2768                         txp_wdev = NULL;
2769
2770                 if (!rdev->ops->set_tx_power)
2771                         return -EOPNOTSUPP;
2772
2773                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2774                 type = nla_get_u32(info->attrs[idx]);
2775
2776                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2777                     (type != NL80211_TX_POWER_AUTOMATIC))
2778                         return -EINVAL;
2779
2780                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2781                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2782                         mbm = nla_get_u32(info->attrs[idx]);
2783                 }
2784
2785                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2786                 if (result)
2787                         return result;
2788         }
2789
2790         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2791             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2792                 u32 tx_ant, rx_ant;
2793
2794                 if ((!rdev->wiphy.available_antennas_tx &&
2795                      !rdev->wiphy.available_antennas_rx) ||
2796                     !rdev->ops->set_antenna)
2797                         return -EOPNOTSUPP;
2798
2799                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2800                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2801
2802                 /* reject antenna configurations which don't match the
2803                  * available antenna masks, except for the "all" mask */
2804                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2805                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2806                         return -EINVAL;
2807
2808                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2809                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2810
2811                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2812                 if (result)
2813                         return result;
2814         }
2815
2816         changed = 0;
2817
2818         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2819                 retry_short = nla_get_u8(
2820                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2821
2822                 changed |= WIPHY_PARAM_RETRY_SHORT;
2823         }
2824
2825         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2826                 retry_long = nla_get_u8(
2827                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2828
2829                 changed |= WIPHY_PARAM_RETRY_LONG;
2830         }
2831
2832         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2833                 frag_threshold = nla_get_u32(
2834                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2835                 if (frag_threshold < 256)
2836                         return -EINVAL;
2837
2838                 if (frag_threshold != (u32) -1) {
2839                         /*
2840                          * Fragments (apart from the last one) are required to
2841                          * have even length. Make the fragmentation code
2842                          * simpler by stripping LSB should someone try to use
2843                          * odd threshold value.
2844                          */
2845                         frag_threshold &= ~0x1;
2846                 }
2847                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2848         }
2849
2850         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2851                 rts_threshold = nla_get_u32(
2852                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2853                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2854         }
2855
2856         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2857                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2858                         return -EINVAL;
2859
2860                 coverage_class = nla_get_u8(
2861                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2862                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2863         }
2864
2865         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2866                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2867                         return -EOPNOTSUPP;
2868
2869                 changed |= WIPHY_PARAM_DYN_ACK;
2870         }
2871
2872         if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
2873                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2874                                              NL80211_EXT_FEATURE_TXQS))
2875                         return -EOPNOTSUPP;
2876                 txq_limit = nla_get_u32(
2877                         info->attrs[NL80211_ATTR_TXQ_LIMIT]);
2878                 changed |= WIPHY_PARAM_TXQ_LIMIT;
2879         }
2880
2881         if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
2882                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2883                                              NL80211_EXT_FEATURE_TXQS))
2884                         return -EOPNOTSUPP;
2885                 txq_memory_limit = nla_get_u32(
2886                         info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
2887                 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
2888         }
2889
2890         if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
2891                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2892                                              NL80211_EXT_FEATURE_TXQS))
2893                         return -EOPNOTSUPP;
2894                 txq_quantum = nla_get_u32(
2895                         info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
2896                 changed |= WIPHY_PARAM_TXQ_QUANTUM;
2897         }
2898
2899         if (changed) {
2900                 u8 old_retry_short, old_retry_long;
2901                 u32 old_frag_threshold, old_rts_threshold;
2902                 u8 old_coverage_class;
2903                 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
2904
2905                 if (!rdev->ops->set_wiphy_params)
2906                         return -EOPNOTSUPP;
2907
2908                 old_retry_short = rdev->wiphy.retry_short;
2909                 old_retry_long = rdev->wiphy.retry_long;
2910                 old_frag_threshold = rdev->wiphy.frag_threshold;
2911                 old_rts_threshold = rdev->wiphy.rts_threshold;
2912                 old_coverage_class = rdev->wiphy.coverage_class;
2913                 old_txq_limit = rdev->wiphy.txq_limit;
2914                 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
2915                 old_txq_quantum = rdev->wiphy.txq_quantum;
2916
2917                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2918                         rdev->wiphy.retry_short = retry_short;
2919                 if (changed & WIPHY_PARAM_RETRY_LONG)
2920                         rdev->wiphy.retry_long = retry_long;
2921                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2922                         rdev->wiphy.frag_threshold = frag_threshold;
2923                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2924                         rdev->wiphy.rts_threshold = rts_threshold;
2925                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2926                         rdev->wiphy.coverage_class = coverage_class;
2927                 if (changed & WIPHY_PARAM_TXQ_LIMIT)
2928                         rdev->wiphy.txq_limit = txq_limit;
2929                 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
2930                         rdev->wiphy.txq_memory_limit = txq_memory_limit;
2931                 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
2932                         rdev->wiphy.txq_quantum = txq_quantum;
2933
2934                 result = rdev_set_wiphy_params(rdev, changed);
2935                 if (result) {
2936                         rdev->wiphy.retry_short = old_retry_short;
2937                         rdev->wiphy.retry_long = old_retry_long;
2938                         rdev->wiphy.frag_threshold = old_frag_threshold;
2939                         rdev->wiphy.rts_threshold = old_rts_threshold;
2940                         rdev->wiphy.coverage_class = old_coverage_class;
2941                         rdev->wiphy.txq_limit = old_txq_limit;
2942                         rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
2943                         rdev->wiphy.txq_quantum = old_txq_quantum;
2944                         return result;
2945                 }
2946         }
2947         return 0;
2948 }
2949
2950 static int nl80211_send_chandef(struct sk_buff *msg,
2951                                 const struct cfg80211_chan_def *chandef)
2952 {
2953         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2954                 return -EINVAL;
2955
2956         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2957                         chandef->chan->center_freq))
2958                 return -ENOBUFS;
2959         switch (chandef->width) {
2960         case NL80211_CHAN_WIDTH_20_NOHT:
2961         case NL80211_CHAN_WIDTH_20:
2962         case NL80211_CHAN_WIDTH_40:
2963                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2964                                 cfg80211_get_chandef_type(chandef)))
2965                         return -ENOBUFS;
2966                 break;
2967         default:
2968                 break;
2969         }
2970         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2971                 return -ENOBUFS;
2972         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2973                 return -ENOBUFS;
2974         if (chandef->center_freq2 &&
2975             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2976                 return -ENOBUFS;
2977         return 0;
2978 }
2979
2980 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2981                               struct cfg80211_registered_device *rdev,
2982                               struct wireless_dev *wdev,
2983                               enum nl80211_commands cmd)
2984 {
2985         struct net_device *dev = wdev->netdev;
2986         void *hdr;
2987
2988         WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
2989                 cmd != NL80211_CMD_DEL_INTERFACE &&
2990                 cmd != NL80211_CMD_SET_INTERFACE);
2991
2992         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2993         if (!hdr)
2994                 return -1;
2995
2996         if (dev &&
2997             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2998              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2999                 goto nla_put_failure;
3000
3001         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
3002             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
3003             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
3004                               NL80211_ATTR_PAD) ||
3005             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
3006             nla_put_u32(msg, NL80211_ATTR_GENERATION,
3007                         rdev->devlist_generation ^
3008                         (cfg80211_rdev_list_generation << 2)) ||
3009             nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr))
3010                 goto nla_put_failure;
3011
3012         if (rdev->ops->get_channel) {
3013                 int ret;
3014                 struct cfg80211_chan_def chandef;
3015
3016                 ret = rdev_get_channel(rdev, wdev, &chandef);
3017                 if (ret == 0) {
3018                         if (nl80211_send_chandef(msg, &chandef))
3019                                 goto nla_put_failure;
3020                 }
3021         }
3022
3023         if (rdev->ops->get_tx_power) {
3024                 int dbm, ret;
3025
3026                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
3027                 if (ret == 0 &&
3028                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
3029                                 DBM_TO_MBM(dbm)))
3030                         goto nla_put_failure;
3031         }
3032
3033         wdev_lock(wdev);
3034         switch (wdev->iftype) {
3035         case NL80211_IFTYPE_AP:
3036                 if (wdev->ssid_len &&
3037                     nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
3038                         goto nla_put_failure_locked;
3039                 break;
3040         case NL80211_IFTYPE_STATION:
3041         case NL80211_IFTYPE_P2P_CLIENT:
3042         case NL80211_IFTYPE_ADHOC: {
3043                 const u8 *ssid_ie;
3044                 if (!wdev->current_bss)
3045                         break;
3046                 rcu_read_lock();
3047                 ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
3048                                                WLAN_EID_SSID);
3049                 if (ssid_ie &&
3050                     nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2))
3051                         goto nla_put_failure_rcu_locked;
3052                 rcu_read_unlock();
3053                 break;
3054                 }
3055         default:
3056                 /* nothing */
3057                 break;
3058         }
3059         wdev_unlock(wdev);
3060
3061         if (rdev->ops->get_txq_stats) {
3062                 struct cfg80211_txq_stats txqstats = {};
3063                 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
3064
3065                 if (ret == 0 &&
3066                     !nl80211_put_txq_stats(msg, &txqstats,
3067                                            NL80211_ATTR_TXQ_STATS))
3068                         goto nla_put_failure;
3069         }
3070
3071         genlmsg_end(msg, hdr);
3072         return 0;
3073
3074  nla_put_failure_rcu_locked:
3075         rcu_read_unlock();
3076  nla_put_failure_locked:
3077         wdev_unlock(wdev);
3078  nla_put_failure:
3079         genlmsg_cancel(msg, hdr);
3080         return -EMSGSIZE;
3081 }
3082
3083 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
3084 {
3085         int wp_idx = 0;
3086         int if_idx = 0;
3087         int wp_start = cb->args[0];
3088         int if_start = cb->args[1];
3089         int filter_wiphy = -1;
3090         struct cfg80211_registered_device *rdev;
3091         struct wireless_dev *wdev;
3092         int ret;
3093
3094         rtnl_lock();
3095         if (!cb->args[2]) {
3096                 struct nl80211_dump_wiphy_state state = {
3097                         .filter_wiphy = -1,
3098                 };
3099
3100                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
3101                 if (ret)
3102                         goto out_unlock;
3103
3104                 filter_wiphy = state.filter_wiphy;
3105
3106                 /*
3107                  * if filtering, set cb->args[2] to +1 since 0 is the default
3108                  * value needed to determine that parsing is necessary.
3109                  */
3110                 if (filter_wiphy >= 0)
3111                         cb->args[2] = filter_wiphy + 1;
3112                 else
3113                         cb->args[2] = -1;
3114         } else if (cb->args[2] > 0) {
3115                 filter_wiphy = cb->args[2] - 1;
3116         }
3117
3118         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3119                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3120                         continue;
3121                 if (wp_idx < wp_start) {
3122                         wp_idx++;
3123                         continue;
3124                 }
3125
3126                 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
3127                         continue;
3128
3129                 if_idx = 0;
3130
3131                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3132                         if (if_idx < if_start) {
3133                                 if_idx++;
3134                                 continue;
3135                         }
3136                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
3137                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
3138                                                rdev, wdev,
3139                                                NL80211_CMD_NEW_INTERFACE) < 0) {
3140                                 goto out;
3141                         }
3142                         if_idx++;
3143                 }
3144
3145                 wp_idx++;
3146         }
3147  out:
3148         cb->args[0] = wp_idx;
3149         cb->args[1] = if_idx;
3150
3151         ret = skb->len;
3152  out_unlock:
3153         rtnl_unlock();
3154
3155         return ret;
3156 }
3157
3158 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
3159 {
3160         struct sk_buff *msg;
3161         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3162         struct wireless_dev *wdev = info->user_ptr[1];
3163
3164         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3165         if (!msg)
3166                 return -ENOMEM;
3167
3168         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3169                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
3170                 nlmsg_free(msg);
3171                 return -ENOBUFS;
3172         }
3173
3174         return genlmsg_reply(msg, info);
3175 }
3176
3177 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
3178         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
3179         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
3180         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
3181         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
3182         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
3183         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
3184 };
3185
3186 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
3187 {
3188         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
3189         int flag;
3190
3191         *mntrflags = 0;
3192
3193         if (!nla)
3194                 return -EINVAL;
3195
3196         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX, nla,
3197                              mntr_flags_policy, NULL))
3198                 return -EINVAL;
3199
3200         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
3201                 if (flags[flag])
3202                         *mntrflags |= (1<<flag);
3203
3204         *mntrflags |= MONITOR_FLAG_CHANGED;
3205
3206         return 0;
3207 }
3208
3209 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
3210                                      enum nl80211_iftype type,
3211                                      struct genl_info *info,
3212                                      struct vif_params *params)
3213 {
3214         bool change = false;
3215         int err;
3216
3217         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
3218                 if (type != NL80211_IFTYPE_MONITOR)
3219                         return -EINVAL;
3220
3221                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
3222                                           &params->flags);
3223                 if (err)
3224                         return err;
3225
3226                 change = true;
3227         }
3228
3229         if (params->flags & MONITOR_FLAG_ACTIVE &&
3230             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
3231                 return -EOPNOTSUPP;
3232
3233         if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
3234                 const u8 *mumimo_groups;
3235                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3236
3237                 if (type != NL80211_IFTYPE_MONITOR)
3238                         return -EINVAL;
3239
3240                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3241                         return -EOPNOTSUPP;
3242
3243                 mumimo_groups =
3244                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
3245
3246                 /* bits 0 and 63 are reserved and must be zero */
3247                 if ((mumimo_groups[0] & BIT(0)) ||
3248                     (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
3249                         return -EINVAL;
3250
3251                 params->vht_mumimo_groups = mumimo_groups;
3252                 change = true;
3253         }
3254
3255         if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
3256                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3257
3258                 if (type != NL80211_IFTYPE_MONITOR)
3259                         return -EINVAL;
3260
3261                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3262                         return -EOPNOTSUPP;
3263
3264                 params->vht_mumimo_follow_addr =
3265                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
3266                 change = true;
3267         }
3268
3269         return change ? 1 : 0;
3270 }
3271
3272 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
3273                                struct net_device *netdev, u8 use_4addr,
3274                                enum nl80211_iftype iftype)
3275 {
3276         if (!use_4addr) {
3277                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
3278                         return -EBUSY;
3279                 return 0;
3280         }
3281
3282         switch (iftype) {
3283         case NL80211_IFTYPE_AP_VLAN:
3284                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
3285                         return 0;
3286                 break;
3287         case NL80211_IFTYPE_STATION:
3288                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
3289                         return 0;
3290                 break;
3291         default:
3292                 break;
3293         }
3294
3295         return -EOPNOTSUPP;
3296 }
3297
3298 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
3299 {
3300         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3301         struct vif_params params;
3302         int err;
3303         enum nl80211_iftype otype, ntype;
3304         struct net_device *dev = info->user_ptr[1];
3305         bool change = false;
3306
3307         memset(&params, 0, sizeof(params));
3308
3309         otype = ntype = dev->ieee80211_ptr->iftype;
3310
3311         if (info->attrs[NL80211_ATTR_IFTYPE]) {
3312                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3313                 if (otype != ntype)
3314                         change = true;
3315         }
3316
3317         if (info->attrs[NL80211_ATTR_MESH_ID]) {
3318                 struct wireless_dev *wdev = dev->ieee80211_ptr;
3319
3320                 if (ntype != NL80211_IFTYPE_MESH_POINT)
3321                         return -EINVAL;
3322                 if (netif_running(dev))
3323                         return -EBUSY;
3324
3325                 wdev_lock(wdev);
3326                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3327                              IEEE80211_MAX_MESH_ID_LEN);
3328                 wdev->mesh_id_up_len =
3329                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3330                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3331                        wdev->mesh_id_up_len);
3332                 wdev_unlock(wdev);
3333         }
3334
3335         if (info->attrs[NL80211_ATTR_4ADDR]) {
3336                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3337                 change = true;
3338                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
3339                 if (err)
3340                         return err;
3341         } else {
3342                 params.use_4addr = -1;
3343         }
3344
3345         err = nl80211_parse_mon_options(rdev, ntype, info, &params);
3346         if (err < 0)
3347                 return err;
3348         if (err > 0)
3349                 change = true;
3350
3351         if (change)
3352                 err = cfg80211_change_iface(rdev, dev, ntype, &params);
3353         else
3354                 err = 0;
3355
3356         if (!err && params.use_4addr != -1)
3357                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
3358
3359         if (change && !err) {
3360                 struct wireless_dev *wdev = dev->ieee80211_ptr;
3361
3362                 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
3363         }
3364
3365         return err;
3366 }
3367
3368 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
3369 {
3370         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3371         struct vif_params params;
3372         struct wireless_dev *wdev;
3373         struct sk_buff *msg;
3374         int err;
3375         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
3376
3377         /* to avoid failing a new interface creation due to pending removal */
3378         cfg80211_destroy_ifaces(rdev);
3379
3380         memset(&params, 0, sizeof(params));
3381
3382         if (!info->attrs[NL80211_ATTR_IFNAME])
3383                 return -EINVAL;
3384
3385         if (info->attrs[NL80211_ATTR_IFTYPE])
3386                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3387
3388         if (!rdev->ops->add_virtual_intf ||
3389             !(rdev->wiphy.interface_modes & (1 << type)))
3390                 return -EOPNOTSUPP;
3391
3392         if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
3393              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
3394             info->attrs[NL80211_ATTR_MAC]) {
3395                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
3396                            ETH_ALEN);
3397                 if (!is_valid_ether_addr(params.macaddr))
3398                         return -EADDRNOTAVAIL;
3399         }
3400
3401         if (info->attrs[NL80211_ATTR_4ADDR]) {
3402                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3403                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
3404                 if (err)
3405                         return err;
3406         }
3407
3408         err = nl80211_parse_mon_options(rdev, type, info, &params);
3409         if (err < 0)
3410                 return err;
3411
3412         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3413         if (!msg)
3414                 return -ENOMEM;
3415
3416         wdev = rdev_add_virtual_intf(rdev,
3417                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
3418                                 NET_NAME_USER, type, &params);
3419         if (WARN_ON(!wdev)) {
3420                 nlmsg_free(msg);
3421                 return -EPROTO;
3422         } else if (IS_ERR(wdev)) {
3423                 nlmsg_free(msg);
3424                 return PTR_ERR(wdev);
3425         }
3426
3427         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
3428                 wdev->owner_nlportid = info->snd_portid;
3429
3430         switch (type) {
3431         case NL80211_IFTYPE_MESH_POINT:
3432                 if (!info->attrs[NL80211_ATTR_MESH_ID])
3433                         break;
3434                 wdev_lock(wdev);
3435                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3436                              IEEE80211_MAX_MESH_ID_LEN);
3437                 wdev->mesh_id_up_len =
3438                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3439                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3440                        wdev->mesh_id_up_len);
3441                 wdev_unlock(wdev);
3442                 break;
3443         case NL80211_IFTYPE_NAN:
3444         case NL80211_IFTYPE_P2P_DEVICE:
3445                 /*
3446                  * P2P Device and NAN do not have a netdev, so don't go
3447                  * through the netdev notifier and must be added here
3448                  */
3449                 cfg80211_init_wdev(rdev, wdev);
3450                 break;
3451         default:
3452                 break;
3453         }
3454
3455         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3456                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
3457                 nlmsg_free(msg);
3458                 return -ENOBUFS;
3459         }
3460
3461         return genlmsg_reply(msg, info);
3462 }
3463
3464 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
3465 {
3466         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3467         struct wireless_dev *wdev = info->user_ptr[1];
3468
3469         if (!rdev->ops->del_virtual_intf)
3470                 return -EOPNOTSUPP;
3471
3472         /*
3473          * If we remove a wireless device without a netdev then clear
3474          * user_ptr[1] so that nl80211_post_doit won't dereference it
3475          * to check if it needs to do dev_put(). Otherwise it crashes
3476          * since the wdev has been freed, unlike with a netdev where
3477          * we need the dev_put() for the netdev to really be freed.
3478          */
3479         if (!wdev->netdev)
3480                 info->user_ptr[1] = NULL;
3481
3482         return rdev_del_virtual_intf(rdev, wdev);
3483 }
3484
3485 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
3486 {
3487         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3488         struct net_device *dev = info->user_ptr[1];
3489         u16 noack_map;
3490
3491         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
3492                 return -EINVAL;
3493
3494         if (!rdev->ops->set_noack_map)
3495                 return -EOPNOTSUPP;
3496
3497         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
3498
3499         return rdev_set_noack_map(rdev, dev, noack_map);
3500 }
3501
3502 struct get_key_cookie {
3503         struct sk_buff *msg;
3504         int error;
3505         int idx;
3506 };
3507
3508 static void get_key_callback(void *c, struct key_params *params)
3509 {
3510         struct nlattr *key;
3511         struct get_key_cookie *cookie = c;
3512
3513         if ((params->key &&
3514              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
3515                      params->key_len, params->key)) ||
3516             (params->seq &&
3517              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
3518                      params->seq_len, params->seq)) ||
3519             (params->cipher &&
3520              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
3521                          params->cipher)))
3522                 goto nla_put_failure;
3523
3524         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
3525         if (!key)
3526                 goto nla_put_failure;
3527
3528         if ((params->key &&
3529              nla_put(cookie->msg, NL80211_KEY_DATA,
3530                      params->key_len, params->key)) ||
3531             (params->seq &&
3532              nla_put(cookie->msg, NL80211_KEY_SEQ,
3533                      params->seq_len, params->seq)) ||
3534             (params->cipher &&
3535              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
3536                          params->cipher)))
3537                 goto nla_put_failure;
3538
3539         if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
3540                 goto nla_put_failure;
3541
3542         nla_nest_end(cookie->msg, key);
3543
3544         return;
3545  nla_put_failure:
3546         cookie->error = 1;
3547 }
3548
3549 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
3550 {
3551         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3552         int err;
3553         struct net_device *dev = info->user_ptr[1];
3554         u8 key_idx = 0;
3555         const u8 *mac_addr = NULL;
3556         bool pairwise;
3557         struct get_key_cookie cookie = {
3558                 .error = 0,
3559         };
3560         void *hdr;
3561         struct sk_buff *msg;
3562
3563         if (info->attrs[NL80211_ATTR_KEY_IDX])
3564                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
3565
3566         if (info->attrs[NL80211_ATTR_MAC])
3567                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3568
3569         pairwise = !!mac_addr;
3570         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
3571                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
3572
3573                 if (kt != NL80211_KEYTYPE_GROUP &&
3574                     kt != NL80211_KEYTYPE_PAIRWISE)
3575                         return -EINVAL;
3576                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
3577         }
3578
3579         if (!rdev->ops->get_key)
3580                 return -EOPNOTSUPP;
3581
3582         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3583                 return -ENOENT;
3584
3585         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3586         if (!msg)
3587                 return -ENOMEM;
3588
3589         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3590                              NL80211_CMD_NEW_KEY);
3591         if (!hdr)
3592                 goto nla_put_failure;
3593
3594         cookie.msg = msg;
3595         cookie.idx = key_idx;
3596
3597         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3598             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
3599                 goto nla_put_failure;
3600         if (mac_addr &&
3601             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
3602                 goto nla_put_failure;
3603
3604         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
3605                            get_key_callback);
3606
3607         if (err)
3608                 goto free_msg;
3609
3610         if (cookie.error)
3611                 goto nla_put_failure;
3612
3613         genlmsg_end(msg, hdr);
3614         return genlmsg_reply(msg, info);
3615
3616  nla_put_failure:
3617         err = -ENOBUFS;
3618  free_msg:
3619         nlmsg_free(msg);
3620         return err;
3621 }
3622
3623 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
3624 {
3625         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3626         struct key_parse key;
3627         int err;
3628         struct net_device *dev = info->user_ptr[1];
3629
3630         err = nl80211_parse_key(info, &key);
3631         if (err)
3632                 return err;
3633
3634         if (key.idx < 0)
3635                 return -EINVAL;
3636
3637         /* only support setting default key */
3638         if (!key.def && !key.defmgmt)
3639                 return -EINVAL;
3640
3641         wdev_lock(dev->ieee80211_ptr);
3642
3643         if (key.def) {
3644                 if (!rdev->ops->set_default_key) {
3645                         err = -EOPNOTSUPP;
3646                         goto out;
3647                 }
3648
3649                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3650                 if (err)
3651                         goto out;
3652
3653                 err = rdev_set_default_key(rdev, dev, key.idx,
3654                                                  key.def_uni, key.def_multi);
3655
3656                 if (err)
3657                         goto out;
3658
3659 #ifdef CONFIG_CFG80211_WEXT
3660                 dev->ieee80211_ptr->wext.default_key = key.idx;
3661 #endif
3662         } else {
3663                 if (key.def_uni || !key.def_multi) {
3664                         err = -EINVAL;
3665                         goto out;
3666                 }
3667
3668                 if (!rdev->ops->set_default_mgmt_key) {
3669                         err = -EOPNOTSUPP;
3670                         goto out;
3671                 }
3672
3673                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3674                 if (err)
3675                         goto out;
3676
3677                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
3678                 if (err)
3679                         goto out;
3680
3681 #ifdef CONFIG_CFG80211_WEXT
3682                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3683 #endif
3684         }
3685
3686  out:
3687         wdev_unlock(dev->ieee80211_ptr);
3688
3689         return err;
3690 }
3691
3692 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3693 {
3694         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3695         int err;
3696         struct net_device *dev = info->user_ptr[1];
3697         struct key_parse key;
3698         const u8 *mac_addr = NULL;
3699
3700         err = nl80211_parse_key(info, &key);
3701         if (err)
3702                 return err;
3703
3704         if (!key.p.key)
3705                 return -EINVAL;
3706
3707         if (info->attrs[NL80211_ATTR_MAC])
3708                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3709
3710         if (key.type == -1) {
3711                 if (mac_addr)
3712                         key.type = NL80211_KEYTYPE_PAIRWISE;
3713                 else
3714                         key.type = NL80211_KEYTYPE_GROUP;
3715         }
3716
3717         /* for now */
3718         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3719             key.type != NL80211_KEYTYPE_GROUP)
3720                 return -EINVAL;
3721
3722         if (!rdev->ops->add_key)
3723                 return -EOPNOTSUPP;
3724
3725         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3726                                            key.type == NL80211_KEYTYPE_PAIRWISE,
3727                                            mac_addr))
3728                 return -EINVAL;
3729
3730         wdev_lock(dev->ieee80211_ptr);
3731         err = nl80211_key_allowed(dev->ieee80211_ptr);
3732         if (!err)
3733                 err = rdev_add_key(rdev, dev, key.idx,
3734                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3735                                     mac_addr, &key.p);
3736         wdev_unlock(dev->ieee80211_ptr);
3737
3738         return err;
3739 }
3740
3741 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3742 {
3743         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3744         int err;
3745         struct net_device *dev = info->user_ptr[1];
3746         u8 *mac_addr = NULL;
3747         struct key_parse key;
3748
3749         err = nl80211_parse_key(info, &key);
3750         if (err)
3751                 return err;
3752
3753         if (info->attrs[NL80211_ATTR_MAC])
3754                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3755
3756         if (key.type == -1) {
3757                 if (mac_addr)
3758                         key.type = NL80211_KEYTYPE_PAIRWISE;
3759                 else
3760                         key.type = NL80211_KEYTYPE_GROUP;
3761         }
3762
3763         /* for now */
3764         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3765             key.type != NL80211_KEYTYPE_GROUP)
3766                 return -EINVAL;
3767
3768         if (!rdev->ops->del_key)
3769                 return -EOPNOTSUPP;
3770
3771         wdev_lock(dev->ieee80211_ptr);
3772         err = nl80211_key_allowed(dev->ieee80211_ptr);
3773
3774         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3775             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3776                 err = -ENOENT;
3777
3778         if (!err)
3779                 err = rdev_del_key(rdev, dev, key.idx,
3780                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3781                                    mac_addr);
3782
3783 #ifdef CONFIG_CFG80211_WEXT
3784         if (!err) {
3785                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3786                         dev->ieee80211_ptr->wext.default_key = -1;
3787                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3788                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3789         }
3790 #endif
3791         wdev_unlock(dev->ieee80211_ptr);
3792
3793         return err;
3794 }
3795
3796 /* This function returns an error or the number of nested attributes */
3797 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3798 {
3799         struct nlattr *attr;
3800         int n_entries = 0, tmp;
3801
3802         nla_for_each_nested(attr, nl_attr, tmp) {
3803                 if (nla_len(attr) != ETH_ALEN)
3804                         return -EINVAL;
3805
3806                 n_entries++;
3807         }
3808
3809         return n_entries;
3810 }
3811
3812 /*
3813  * This function parses ACL information and allocates memory for ACL data.
3814  * On successful return, the calling function is responsible to free the
3815  * ACL buffer returned by this function.
3816  */
3817 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3818                                                 struct genl_info *info)
3819 {
3820         enum nl80211_acl_policy acl_policy;
3821         struct nlattr *attr;
3822         struct cfg80211_acl_data *acl;
3823         int i = 0, n_entries, tmp;
3824
3825         if (!wiphy->max_acl_mac_addrs)
3826                 return ERR_PTR(-EOPNOTSUPP);
3827
3828         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3829                 return ERR_PTR(-EINVAL);
3830
3831         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3832         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3833             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3834                 return ERR_PTR(-EINVAL);
3835
3836         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3837                 return ERR_PTR(-EINVAL);
3838
3839         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3840         if (n_entries < 0)
3841                 return ERR_PTR(n_entries);
3842
3843         if (n_entries > wiphy->max_acl_mac_addrs)
3844                 return ERR_PTR(-ENOTSUPP);
3845
3846         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3847                       GFP_KERNEL);
3848         if (!acl)
3849                 return ERR_PTR(-ENOMEM);
3850
3851         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3852                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3853                 i++;
3854         }
3855
3856         acl->n_acl_entries = n_entries;
3857         acl->acl_policy = acl_policy;
3858
3859         return acl;
3860 }
3861
3862 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3863 {
3864         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3865         struct net_device *dev = info->user_ptr[1];
3866         struct cfg80211_acl_data *acl;
3867         int err;
3868
3869         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3870             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3871                 return -EOPNOTSUPP;
3872
3873         if (!dev->ieee80211_ptr->beacon_interval)
3874                 return -EINVAL;
3875
3876         acl = parse_acl_data(&rdev->wiphy, info);
3877         if (IS_ERR(acl))
3878                 return PTR_ERR(acl);
3879
3880         err = rdev_set_mac_acl(rdev, dev, acl);
3881
3882         kfree(acl);
3883
3884         return err;
3885 }
3886
3887 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
3888                            u8 *rates, u8 rates_len)
3889 {
3890         u8 i;
3891         u32 mask = 0;
3892
3893         for (i = 0; i < rates_len; i++) {
3894                 int rate = (rates[i] & 0x7f) * 5;
3895                 int ridx;
3896
3897                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
3898                         struct ieee80211_rate *srate =
3899                                 &sband->bitrates[ridx];
3900                         if (rate == srate->bitrate) {
3901                                 mask |= 1 << ridx;
3902                                 break;
3903                         }
3904                 }
3905                 if (ridx == sband->n_bitrates)
3906                         return 0; /* rate not found */
3907         }
3908
3909         return mask;
3910 }
3911
3912 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
3913                                u8 *rates, u8 rates_len,
3914                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
3915 {
3916         u8 i;
3917
3918         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
3919
3920         for (i = 0; i < rates_len; i++) {
3921                 int ridx, rbit;
3922
3923                 ridx = rates[i] / 8;
3924                 rbit = BIT(rates[i] % 8);
3925
3926                 /* check validity */
3927                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
3928                         return false;
3929
3930                 /* check availability */
3931                 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
3932                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
3933                         mcs[ridx] |= rbit;
3934                 else
3935                         return false;
3936         }
3937
3938         return true;
3939 }
3940
3941 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
3942 {
3943         u16 mcs_mask = 0;
3944
3945         switch (vht_mcs_map) {
3946         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
3947                 break;
3948         case IEEE80211_VHT_MCS_SUPPORT_0_7:
3949                 mcs_mask = 0x00FF;
3950                 break;
3951         case IEEE80211_VHT_MCS_SUPPORT_0_8:
3952                 mcs_mask = 0x01FF;
3953                 break;
3954         case IEEE80211_VHT_MCS_SUPPORT_0_9:
3955                 mcs_mask = 0x03FF;
3956                 break;
3957         default:
3958                 break;
3959         }
3960
3961         return mcs_mask;
3962 }
3963
3964 static void vht_build_mcs_mask(u16 vht_mcs_map,
3965                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
3966 {
3967         u8 nss;
3968
3969         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
3970                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
3971                 vht_mcs_map >>= 2;
3972         }
3973 }
3974
3975 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
3976                              struct nl80211_txrate_vht *txrate,
3977                              u16 mcs[NL80211_VHT_NSS_MAX])
3978 {
3979         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3980         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
3981         u8 i;
3982
3983         if (!sband->vht_cap.vht_supported)
3984                 return false;
3985
3986         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
3987
3988         /* Build vht_mcs_mask from VHT capabilities */
3989         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
3990
3991         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3992                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
3993                         mcs[i] = txrate->mcs[i];
3994                 else
3995                         return false;
3996         }
3997
3998         return true;
3999 }
4000
4001 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
4002         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
4003                                     .len = NL80211_MAX_SUPP_RATES },
4004         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
4005                                 .len = NL80211_MAX_SUPP_HT_RATES },
4006         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
4007         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
4008 };
4009
4010 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
4011                                          struct cfg80211_bitrate_mask *mask)
4012 {
4013         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
4014         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4015         int rem, i;
4016         struct nlattr *tx_rates;
4017         struct ieee80211_supported_band *sband;
4018         u16 vht_tx_mcs_map;
4019
4020         memset(mask, 0, sizeof(*mask));
4021         /* Default to all rates enabled */
4022         for (i = 0; i < NUM_NL80211_BANDS; i++) {
4023                 sband = rdev->wiphy.bands[i];
4024
4025                 if (!sband)
4026                         continue;
4027
4028                 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
4029                 memcpy(mask->control[i].ht_mcs,
4030                        sband->ht_cap.mcs.rx_mask,
4031                        sizeof(mask->control[i].ht_mcs));
4032
4033                 if (!sband->vht_cap.vht_supported)
4034                         continue;
4035
4036                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4037                 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
4038         }
4039
4040         /* if no rates are given set it back to the defaults */
4041         if (!info->attrs[NL80211_ATTR_TX_RATES])
4042                 goto out;
4043
4044         /* The nested attribute uses enum nl80211_band as the index. This maps
4045          * directly to the enum nl80211_band values used in cfg80211.
4046          */
4047         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
4048         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
4049                 enum nl80211_band band = nla_type(tx_rates);
4050                 int err;
4051
4052                 if (band < 0 || band >= NUM_NL80211_BANDS)
4053                         return -EINVAL;
4054                 sband = rdev->wiphy.bands[band];
4055                 if (sband == NULL)
4056                         return -EINVAL;
4057                 err = nla_parse_nested(tb, NL80211_TXRATE_MAX, tx_rates,
4058                                        nl80211_txattr_policy, info->extack);
4059                 if (err)
4060                         return err;
4061                 if (tb[NL80211_TXRATE_LEGACY]) {
4062                         mask->control[band].legacy = rateset_to_mask(
4063                                 sband,
4064                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
4065                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
4066                         if ((mask->control[band].legacy == 0) &&
4067                             nla_len(tb[NL80211_TXRATE_LEGACY]))
4068                                 return -EINVAL;
4069                 }
4070                 if (tb[NL80211_TXRATE_HT]) {
4071                         if (!ht_rateset_to_mask(
4072                                         sband,
4073                                         nla_data(tb[NL80211_TXRATE_HT]),
4074                                         nla_len(tb[NL80211_TXRATE_HT]),
4075                                         mask->control[band].ht_mcs))
4076                                 return -EINVAL;
4077                 }
4078                 if (tb[NL80211_TXRATE_VHT]) {
4079                         if (!vht_set_mcs_mask(
4080                                         sband,
4081                                         nla_data(tb[NL80211_TXRATE_VHT]),
4082                                         mask->control[band].vht_mcs))
4083                                 return -EINVAL;
4084                 }
4085                 if (tb[NL80211_TXRATE_GI]) {
4086                         mask->control[band].gi =
4087                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
4088                         if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
4089                                 return -EINVAL;
4090                 }
4091
4092                 if (mask->control[band].legacy == 0) {
4093                         /* don't allow empty legacy rates if HT or VHT
4094                          * are not even supported.
4095                          */
4096                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
4097                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
4098                                 return -EINVAL;
4099
4100                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
4101                                 if (mask->control[band].ht_mcs[i])
4102                                         goto out;
4103
4104                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
4105                                 if (mask->control[band].vht_mcs[i])
4106                                         goto out;
4107
4108                         /* legacy and mcs rates may not be both empty */
4109                         return -EINVAL;
4110                 }
4111         }
4112
4113 out:
4114         return 0;
4115 }
4116
4117 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
4118                                    enum nl80211_band band,
4119                                    struct cfg80211_bitrate_mask *beacon_rate)
4120 {
4121         u32 count_ht, count_vht, i;
4122         u32 rate = beacon_rate->control[band].legacy;
4123
4124         /* Allow only one rate */
4125         if (hweight32(rate) > 1)
4126                 return -EINVAL;
4127
4128         count_ht = 0;
4129         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
4130                 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
4131                         return -EINVAL;
4132                 } else if (beacon_rate->control[band].ht_mcs[i]) {
4133                         count_ht++;
4134                         if (count_ht > 1)
4135                                 return -EINVAL;
4136                 }
4137                 if (count_ht && rate)
4138                         return -EINVAL;
4139         }
4140
4141         count_vht = 0;
4142         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
4143                 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
4144                         return -EINVAL;
4145                 } else if (beacon_rate->control[band].vht_mcs[i]) {
4146                         count_vht++;
4147                         if (count_vht > 1)
4148                                 return -EINVAL;
4149                 }
4150                 if (count_vht && rate)
4151                         return -EINVAL;
4152         }
4153
4154         if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht))
4155                 return -EINVAL;
4156
4157         if (rate &&
4158             !wiphy_ext_feature_isset(&rdev->wiphy,
4159                                      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
4160                 return -EINVAL;
4161         if (count_ht &&
4162             !wiphy_ext_feature_isset(&rdev->wiphy,
4163                                      NL80211_EXT_FEATURE_BEACON_RATE_HT))
4164                 return -EINVAL;
4165         if (count_vht &&
4166             !wiphy_ext_feature_isset(&rdev->wiphy,
4167                                      NL80211_EXT_FEATURE_BEACON_RATE_VHT))
4168                 return -EINVAL;
4169
4170         return 0;
4171 }
4172
4173 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
4174                                 struct nlattr *attrs[],
4175                                 struct cfg80211_beacon_data *bcn)
4176 {
4177         bool haveinfo = false;
4178         int err;
4179
4180         memset(bcn, 0, sizeof(*bcn));
4181
4182         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
4183                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
4184                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
4185                 if (!bcn->head_len)
4186                         return -EINVAL;
4187                 haveinfo = true;
4188         }
4189
4190         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
4191                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
4192                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
4193                 haveinfo = true;
4194         }
4195
4196         if (!haveinfo)
4197                 return -EINVAL;
4198
4199         if (attrs[NL80211_ATTR_IE]) {
4200                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
4201                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
4202         }
4203
4204         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
4205                 bcn->proberesp_ies =
4206                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4207                 bcn->proberesp_ies_len =
4208                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4209         }
4210
4211         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
4212                 bcn->assocresp_ies =
4213                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4214                 bcn->assocresp_ies_len =
4215                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4216         }
4217
4218         if (attrs[NL80211_ATTR_PROBE_RESP]) {
4219                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
4220                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
4221         }
4222
4223         if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
4224                 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
4225
4226                 err = nla_parse_nested(tb, NL80211_FTM_RESP_ATTR_MAX,
4227                                        attrs[NL80211_ATTR_FTM_RESPONDER],
4228                                        NULL, NULL);
4229                 if (err)
4230                         return err;
4231
4232                 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
4233                     wiphy_ext_feature_isset(&rdev->wiphy,
4234                                             NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
4235                         bcn->ftm_responder = 1;
4236                 else
4237                         return -EOPNOTSUPP;
4238
4239                 if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
4240                         bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
4241                         bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
4242                 }
4243
4244                 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
4245                         bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
4246                         bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
4247                 }
4248         } else {
4249                 bcn->ftm_responder = -1;
4250         }
4251
4252         return 0;
4253 }
4254
4255 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
4256                                             const u8 *rates)
4257 {
4258         int i;
4259
4260         if (!rates)
4261                 return;
4262
4263         for (i = 0; i < rates[1]; i++) {
4264                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
4265                         params->ht_required = true;
4266                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
4267                         params->vht_required = true;
4268         }
4269 }
4270
4271 /*
4272  * Since the nl80211 API didn't include, from the beginning, attributes about
4273  * HT/VHT requirements/capabilities, we parse them out of the IEs for the
4274  * benefit of drivers that rebuild IEs in the firmware.
4275  */
4276 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
4277 {
4278         const struct cfg80211_beacon_data *bcn = &params->beacon;
4279         size_t ies_len = bcn->tail_len;
4280         const u8 *ies = bcn->tail;
4281         const u8 *rates;
4282         const u8 *cap;
4283
4284         rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len);
4285         nl80211_check_ap_rate_selectors(params, rates);
4286
4287         rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
4288         nl80211_check_ap_rate_selectors(params, rates);
4289
4290         cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len);
4291         if (cap && cap[1] >= sizeof(*params->ht_cap))
4292                 params->ht_cap = (void *)(cap + 2);
4293         cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
4294         if (cap && cap[1] >= sizeof(*params->vht_cap))
4295                 params->vht_cap = (void *)(cap + 2);
4296         cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
4297         if (cap && cap[1] >= sizeof(*params->he_cap) + 1)
4298                 params->he_cap = (void *)(cap + 3);
4299 }
4300
4301 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
4302                                    struct cfg80211_ap_settings *params)
4303 {
4304         struct wireless_dev *wdev;
4305         bool ret = false;
4306
4307         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
4308                 if (wdev->iftype != NL80211_IFTYPE_AP &&
4309                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
4310                         continue;
4311
4312                 if (!wdev->preset_chandef.chan)
4313                         continue;
4314
4315                 params->chandef = wdev->preset_chandef;
4316                 ret = true;
4317                 break;
4318         }
4319
4320         return ret;
4321 }
4322
4323 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
4324                                     enum nl80211_auth_type auth_type,
4325                                     enum nl80211_commands cmd)
4326 {
4327         if (auth_type > NL80211_AUTHTYPE_MAX)
4328                 return false;
4329
4330         switch (cmd) {
4331         case NL80211_CMD_AUTHENTICATE:
4332                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
4333                     auth_type == NL80211_AUTHTYPE_SAE)
4334                         return false;
4335                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
4336                                              NL80211_EXT_FEATURE_FILS_STA) &&
4337                     (auth_type == NL80211_AUTHTYPE_FILS_SK ||
4338                      auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4339                      auth_type == NL80211_AUTHTYPE_FILS_PK))
4340                         return false;
4341                 return true;
4342         case NL80211_CMD_CONNECT:
4343                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
4344                     auth_type == NL80211_AUTHTYPE_SAE)
4345                         return false;
4346
4347                 /* FILS with SK PFS or PK not supported yet */
4348                 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4349                     auth_type == NL80211_AUTHTYPE_FILS_PK)
4350                         return false;
4351                 if (!wiphy_ext_feature_isset(
4352                             &rdev->wiphy,
4353                             NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
4354                     auth_type == NL80211_AUTHTYPE_FILS_SK)
4355                         return false;
4356                 return true;
4357         case NL80211_CMD_START_AP:
4358                 /* SAE not supported yet */
4359                 if (auth_type == NL80211_AUTHTYPE_SAE)
4360                         return false;
4361                 /* FILS not supported yet */
4362                 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
4363                     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4364                     auth_type == NL80211_AUTHTYPE_FILS_PK)
4365                         return false;
4366                 return true;
4367         default:
4368                 return false;
4369         }
4370 }
4371
4372 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
4373 {
4374         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4375         struct net_device *dev = info->user_ptr[1];
4376         struct wireless_dev *wdev = dev->ieee80211_ptr;
4377         struct cfg80211_ap_settings params;
4378         int err;
4379
4380         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4381             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4382                 return -EOPNOTSUPP;
4383
4384         if (!rdev->ops->start_ap)
4385                 return -EOPNOTSUPP;
4386
4387         if (wdev->beacon_interval)
4388                 return -EALREADY;
4389
4390         memset(&params, 0, sizeof(params));
4391
4392         /* these are required for START_AP */
4393         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
4394             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
4395             !info->attrs[NL80211_ATTR_BEACON_HEAD])
4396                 return -EINVAL;
4397
4398         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon);
4399         if (err)
4400                 return err;
4401
4402         params.beacon_interval =
4403                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
4404         params.dtim_period =
4405                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
4406
4407         err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
4408                                            params.beacon_interval);
4409         if (err)
4410                 return err;
4411
4412         /*
4413          * In theory, some of these attributes should be required here
4414          * but since they were not used when the command was originally
4415          * added, keep them optional for old user space programs to let
4416          * them continue to work with drivers that do not need the
4417          * additional information -- drivers must check!
4418          */
4419         if (info->attrs[NL80211_ATTR_SSID]) {
4420                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4421                 params.ssid_len =
4422                         nla_len(info->attrs[NL80211_ATTR_SSID]);
4423                 if (params.ssid_len == 0 ||
4424                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
4425                         return -EINVAL;
4426         }
4427
4428         if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
4429                 params.hidden_ssid = nla_get_u32(
4430                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
4431
4432         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
4433
4434         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4435                 params.auth_type = nla_get_u32(
4436                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
4437                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
4438                                              NL80211_CMD_START_AP))
4439                         return -EINVAL;
4440         } else
4441                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4442
4443         err = nl80211_crypto_settings(rdev, info, &params.crypto,
4444                                       NL80211_MAX_NR_CIPHER_SUITES);
4445         if (err)
4446                 return err;
4447
4448         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
4449                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
4450                         return -EOPNOTSUPP;
4451                 params.inactivity_timeout = nla_get_u16(
4452                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
4453         }
4454
4455         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4456                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4457                         return -EINVAL;
4458                 params.p2p_ctwindow =
4459                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4460                 if (params.p2p_ctwindow != 0 &&
4461                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4462                         return -EINVAL;
4463         }
4464
4465         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4466                 u8 tmp;
4467
4468                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4469                         return -EINVAL;
4470                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4471                 params.p2p_opp_ps = tmp;
4472                 if (params.p2p_opp_ps != 0 &&
4473                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4474                         return -EINVAL;
4475         }
4476
4477         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4478                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
4479                 if (err)
4480                         return err;
4481         } else if (wdev->preset_chandef.chan) {
4482                 params.chandef = wdev->preset_chandef;
4483         } else if (!nl80211_get_ap_channel(rdev, &params))
4484                 return -EINVAL;
4485
4486         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
4487                                            wdev->iftype))
4488                 return -EINVAL;
4489
4490         if (info->attrs[NL80211_ATTR_TX_RATES]) {
4491                 err = nl80211_parse_tx_bitrate_mask(info, &params.beacon_rate);
4492                 if (err)
4493                         return err;
4494
4495                 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
4496                                               &params.beacon_rate);
4497                 if (err)
4498                         return err;
4499         }
4500
4501         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
4502                 params.smps_mode =
4503                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
4504                 switch (params.smps_mode) {
4505                 case NL80211_SMPS_OFF:
4506                         break;
4507                 case NL80211_SMPS_STATIC:
4508                         if (!(rdev->wiphy.features &
4509                               NL80211_FEATURE_STATIC_SMPS))
4510                                 return -EINVAL;
4511                         break;
4512                 case NL80211_SMPS_DYNAMIC:
4513                         if (!(rdev->wiphy.features &
4514                               NL80211_FEATURE_DYNAMIC_SMPS))
4515                                 return -EINVAL;
4516                         break;
4517                 default:
4518                         return -EINVAL;
4519                 }
4520         } else {
4521                 params.smps_mode = NL80211_SMPS_OFF;
4522         }
4523
4524         params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
4525         if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
4526                 return -EOPNOTSUPP;
4527
4528         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
4529                 params.acl = parse_acl_data(&rdev->wiphy, info);
4530                 if (IS_ERR(params.acl))
4531                         return PTR_ERR(params.acl);
4532         }
4533
4534         nl80211_calculate_ap_params(&params);
4535
4536         if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
4537                 params.flags |= AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
4538
4539         wdev_lock(wdev);
4540         err = rdev_start_ap(rdev, dev, &params);
4541         if (!err) {
4542                 wdev->preset_chandef = params.chandef;
4543                 wdev->beacon_interval = params.beacon_interval;
4544                 wdev->chandef = params.chandef;
4545                 wdev->ssid_len = params.ssid_len;
4546                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
4547
4548                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4549                         wdev->conn_owner_nlportid = info->snd_portid;
4550         }
4551         wdev_unlock(wdev);
4552
4553         kfree(params.acl);
4554
4555         return err;
4556 }
4557
4558 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
4559 {
4560         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4561         struct net_device *dev = info->user_ptr[1];
4562         struct wireless_dev *wdev = dev->ieee80211_ptr;
4563         struct cfg80211_beacon_data params;
4564         int err;
4565
4566         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4567             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4568                 return -EOPNOTSUPP;
4569
4570         if (!rdev->ops->change_beacon)
4571                 return -EOPNOTSUPP;
4572
4573         if (!wdev->beacon_interval)
4574                 return -EINVAL;
4575
4576         err = nl80211_parse_beacon(rdev, info->attrs, &params);
4577         if (err)
4578                 return err;
4579
4580         wdev_lock(wdev);
4581         err = rdev_change_beacon(rdev, dev, &params);
4582         wdev_unlock(wdev);
4583
4584         return err;
4585 }
4586
4587 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
4588 {
4589         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4590         struct net_device *dev = info->user_ptr[1];
4591
4592         return cfg80211_stop_ap(rdev, dev, false);
4593 }
4594
4595 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
4596         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
4597         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
4598         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
4599         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
4600         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
4601         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
4602 };
4603
4604 static int parse_station_flags(struct genl_info *info,
4605                                enum nl80211_iftype iftype,
4606                                struct station_parameters *params)
4607 {
4608         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
4609         struct nlattr *nla;
4610         int flag;
4611
4612         /*
4613          * Try parsing the new attribute first so userspace
4614          * can specify both for older kernels.
4615          */
4616         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
4617         if (nla) {
4618                 struct nl80211_sta_flag_update *sta_flags;
4619
4620                 sta_flags = nla_data(nla);
4621                 params->sta_flags_mask = sta_flags->mask;
4622                 params->sta_flags_set = sta_flags->set;
4623                 params->sta_flags_set &= params->sta_flags_mask;
4624                 if ((params->sta_flags_mask |
4625                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
4626                         return -EINVAL;
4627                 return 0;
4628         }
4629
4630         /* if present, parse the old attribute */
4631
4632         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
4633         if (!nla)
4634                 return 0;
4635
4636         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX, nla,
4637                              sta_flags_policy, info->extack))
4638                 return -EINVAL;
4639
4640         /*
4641          * Only allow certain flags for interface types so that
4642          * other attributes are silently ignored. Remember that
4643          * this is backward compatibility code with old userspace
4644          * and shouldn't be hit in other cases anyway.
4645          */
4646         switch (iftype) {
4647         case NL80211_IFTYPE_AP:
4648         case NL80211_IFTYPE_AP_VLAN:
4649         case NL80211_IFTYPE_P2P_GO:
4650                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4651                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4652                                          BIT(NL80211_STA_FLAG_WME) |
4653                                          BIT(NL80211_STA_FLAG_MFP);
4654                 break;
4655         case NL80211_IFTYPE_P2P_CLIENT:
4656         case NL80211_IFTYPE_STATION:
4657                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4658                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
4659                 break;
4660         case NL80211_IFTYPE_MESH_POINT:
4661                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4662                                          BIT(NL80211_STA_FLAG_MFP) |
4663                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
4664                 break;
4665         default:
4666                 return -EINVAL;
4667         }
4668
4669         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
4670                 if (flags[flag]) {
4671                         params->sta_flags_set |= (1<<flag);
4672
4673                         /* no longer support new API additions in old API */
4674                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
4675                                 return -EINVAL;
4676                 }
4677         }
4678
4679         return 0;
4680 }
4681
4682 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
4683 {
4684         struct nlattr *rate;
4685         u32 bitrate;
4686         u16 bitrate_compat;
4687         enum nl80211_rate_info rate_flg;
4688
4689         rate = nla_nest_start(msg, attr);
4690         if (!rate)
4691                 return false;
4692
4693         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
4694         bitrate = cfg80211_calculate_bitrate(info);
4695         /* report 16-bit bitrate only if we can */
4696         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
4697         if (bitrate > 0 &&
4698             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
4699                 return false;
4700         if (bitrate_compat > 0 &&
4701             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
4702                 return false;
4703
4704         switch (info->bw) {
4705         case RATE_INFO_BW_5:
4706                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
4707                 break;
4708         case RATE_INFO_BW_10:
4709                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
4710                 break;
4711         default:
4712                 WARN_ON(1);
4713                 /* fall through */
4714         case RATE_INFO_BW_20:
4715                 rate_flg = 0;
4716                 break;
4717         case RATE_INFO_BW_40:
4718                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
4719                 break;
4720         case RATE_INFO_BW_80:
4721                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
4722                 break;
4723         case RATE_INFO_BW_160:
4724                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
4725                 break;
4726         case RATE_INFO_BW_HE_RU:
4727                 rate_flg = 0;
4728                 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
4729         }
4730
4731         if (rate_flg && nla_put_flag(msg, rate_flg))
4732                 return false;
4733
4734         if (info->flags & RATE_INFO_FLAGS_MCS) {
4735                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
4736                         return false;
4737                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4738                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4739                         return false;
4740         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
4741                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
4742                         return false;
4743                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
4744                         return false;
4745                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4746                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4747                         return false;
4748         } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
4749                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
4750                         return false;
4751                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
4752                         return false;
4753                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
4754                         return false;
4755                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
4756                         return false;
4757                 if (info->bw == RATE_INFO_BW_HE_RU &&
4758                     nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
4759                                info->he_ru_alloc))
4760                         return false;
4761         }
4762
4763         nla_nest_end(msg, rate);
4764         return true;
4765 }
4766
4767 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
4768                                int id)
4769 {
4770         void *attr;
4771         int i = 0;
4772
4773         if (!mask)
4774                 return true;
4775
4776         attr = nla_nest_start(msg, id);
4777         if (!attr)
4778                 return false;
4779
4780         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
4781                 if (!(mask & BIT(i)))
4782                         continue;
4783
4784                 if (nla_put_u8(msg, i, signal[i]))
4785                         return false;
4786         }
4787
4788         nla_nest_end(msg, attr);
4789
4790         return true;
4791 }
4792
4793 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
4794                                 u32 seq, int flags,
4795                                 struct cfg80211_registered_device *rdev,
4796                                 struct net_device *dev,
4797                                 const u8 *mac_addr, struct station_info *sinfo)
4798 {
4799         void *hdr;
4800         struct nlattr *sinfoattr, *bss_param;
4801
4802         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
4803         if (!hdr)
4804                 return -1;
4805
4806         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4807             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
4808             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
4809                 goto nla_put_failure;
4810
4811         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
4812         if (!sinfoattr)
4813                 goto nla_put_failure;
4814
4815 #define PUT_SINFO(attr, memb, type) do {                                \
4816         BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
4817         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
4818             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
4819                              sinfo->memb))                              \
4820                 goto nla_put_failure;                                   \
4821         } while (0)
4822 #define PUT_SINFO_U64(attr, memb) do {                                  \
4823         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
4824             nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
4825                               sinfo->memb, NL80211_STA_INFO_PAD))       \
4826                 goto nla_put_failure;                                   \
4827         } while (0)
4828
4829         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
4830         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
4831
4832         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
4833                              BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
4834             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
4835                         (u32)sinfo->rx_bytes))
4836                 goto nla_put_failure;
4837
4838         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
4839                              BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
4840             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
4841                         (u32)sinfo->tx_bytes))
4842                 goto nla_put_failure;
4843
4844         PUT_SINFO_U64(RX_BYTES64, rx_bytes);
4845         PUT_SINFO_U64(TX_BYTES64, tx_bytes);
4846         PUT_SINFO(LLID, llid, u16);
4847         PUT_SINFO(PLID, plid, u16);
4848         PUT_SINFO(PLINK_STATE, plink_state, u8);
4849         PUT_SINFO_U64(RX_DURATION, rx_duration);
4850         PUT_SINFO_U64(TX_DURATION, tx_duration);
4851
4852         if (wiphy_ext_feature_isset(&rdev->wiphy,
4853                                     NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
4854                 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
4855
4856         switch (rdev->wiphy.signal_type) {
4857         case CFG80211_SIGNAL_TYPE_MBM:
4858                 PUT_SINFO(SIGNAL, signal, u8);
4859                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
4860                 break;
4861         default:
4862                 break;
4863         }
4864         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
4865                 if (!nl80211_put_signal(msg, sinfo->chains,
4866                                         sinfo->chain_signal,
4867                                         NL80211_STA_INFO_CHAIN_SIGNAL))
4868                         goto nla_put_failure;
4869         }
4870         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
4871                 if (!nl80211_put_signal(msg, sinfo->chains,
4872                                         sinfo->chain_signal_avg,
4873                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
4874                         goto nla_put_failure;
4875         }
4876         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
4877                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
4878                                           NL80211_STA_INFO_TX_BITRATE))
4879                         goto nla_put_failure;
4880         }
4881         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
4882                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
4883                                           NL80211_STA_INFO_RX_BITRATE))
4884                         goto nla_put_failure;
4885         }
4886
4887         PUT_SINFO(RX_PACKETS, rx_packets, u32);
4888         PUT_SINFO(TX_PACKETS, tx_packets, u32);
4889         PUT_SINFO(TX_RETRIES, tx_retries, u32);
4890         PUT_SINFO(TX_FAILED, tx_failed, u32);
4891         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
4892         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
4893         PUT_SINFO(LOCAL_PM, local_pm, u32);
4894         PUT_SINFO(PEER_PM, peer_pm, u32);
4895         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
4896         PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8);
4897
4898         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
4899                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
4900                 if (!bss_param)
4901                         goto nla_put_failure;
4902
4903                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
4904                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
4905                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
4906                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
4907                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
4908                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
4909                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
4910                                sinfo->bss_param.dtim_period) ||
4911                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
4912                                 sinfo->bss_param.beacon_interval))
4913                         goto nla_put_failure;
4914
4915                 nla_nest_end(msg, bss_param);
4916         }
4917         if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
4918             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
4919                     sizeof(struct nl80211_sta_flag_update),
4920                     &sinfo->sta_flags))
4921                 goto nla_put_failure;
4922
4923         PUT_SINFO_U64(T_OFFSET, t_offset);
4924         PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
4925         PUT_SINFO_U64(BEACON_RX, rx_beacon);
4926         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
4927         PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
4928         PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
4929         if (wiphy_ext_feature_isset(&rdev->wiphy,
4930                                     NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
4931                 PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
4932                 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
4933         }
4934
4935 #undef PUT_SINFO
4936 #undef PUT_SINFO_U64
4937
4938         if (sinfo->pertid) {
4939                 struct nlattr *tidsattr;
4940                 int tid;
4941
4942                 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS);
4943                 if (!tidsattr)
4944                         goto nla_put_failure;
4945
4946                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
4947                         struct cfg80211_tid_stats *tidstats;
4948                         struct nlattr *tidattr;
4949
4950                         tidstats = &sinfo->pertid[tid];
4951
4952                         if (!tidstats->filled)
4953                                 continue;
4954
4955                         tidattr = nla_nest_start(msg, tid + 1);
4956                         if (!tidattr)
4957                                 goto nla_put_failure;
4958
4959 #define PUT_TIDVAL_U64(attr, memb) do {                                 \
4960         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
4961             nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,          \
4962                               tidstats->memb, NL80211_TID_STATS_PAD))   \
4963                 goto nla_put_failure;                                   \
4964         } while (0)
4965
4966                         PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
4967                         PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
4968                         PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
4969                         PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
4970
4971 #undef PUT_TIDVAL_U64
4972                         if ((tidstats->filled &
4973                              BIT(NL80211_TID_STATS_TXQ_STATS)) &&
4974                             !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
4975                                                    NL80211_TID_STATS_TXQ_STATS))
4976                                 goto nla_put_failure;
4977
4978                         nla_nest_end(msg, tidattr);
4979                 }
4980
4981                 nla_nest_end(msg, tidsattr);
4982         }
4983
4984         nla_nest_end(msg, sinfoattr);
4985
4986         if (sinfo->assoc_req_ies_len &&
4987             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
4988                     sinfo->assoc_req_ies))
4989                 goto nla_put_failure;
4990
4991         cfg80211_sinfo_release_content(sinfo);
4992         genlmsg_end(msg, hdr);
4993         return 0;
4994
4995  nla_put_failure:
4996         cfg80211_sinfo_release_content(sinfo);
4997         genlmsg_cancel(msg, hdr);
4998         return -EMSGSIZE;
4999 }
5000
5001 static int nl80211_dump_station(struct sk_buff *skb,
5002                                 struct netlink_callback *cb)
5003 {
5004         struct station_info sinfo;
5005         struct cfg80211_registered_device *rdev;
5006         struct wireless_dev *wdev;
5007         u8 mac_addr[ETH_ALEN];
5008         int sta_idx = cb->args[2];
5009         int err;
5010
5011         rtnl_lock();
5012         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
5013         if (err)
5014                 goto out_err;
5015
5016         if (!wdev->netdev) {
5017                 err = -EINVAL;
5018                 goto out_err;
5019         }
5020
5021         if (!rdev->ops->dump_station) {
5022                 err = -EOPNOTSUPP;
5023                 goto out_err;
5024         }
5025
5026         while (1) {
5027                 memset(&sinfo, 0, sizeof(sinfo));
5028                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
5029                                         mac_addr, &sinfo);
5030                 if (err == -ENOENT)
5031                         break;
5032                 if (err)
5033                         goto out_err;
5034
5035                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
5036                                 NETLINK_CB(cb->skb).portid,
5037                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5038                                 rdev, wdev->netdev, mac_addr,
5039                                 &sinfo) < 0)
5040                         goto out;
5041
5042                 sta_idx++;
5043         }
5044
5045  out:
5046         cb->args[2] = sta_idx;
5047         err = skb->len;
5048  out_err:
5049         rtnl_unlock();
5050
5051         return err;
5052 }
5053
5054 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
5055 {
5056         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5057         struct net_device *dev = info->user_ptr[1];
5058         struct station_info sinfo;
5059         struct sk_buff *msg;
5060         u8 *mac_addr = NULL;
5061         int err;
5062
5063         memset(&sinfo, 0, sizeof(sinfo));
5064
5065         if (!info->attrs[NL80211_ATTR_MAC])
5066                 return -EINVAL;
5067
5068         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5069
5070         if (!rdev->ops->get_station)
5071                 return -EOPNOTSUPP;
5072
5073         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
5074         if (err)
5075                 return err;
5076
5077         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5078         if (!msg) {
5079                 cfg80211_sinfo_release_content(&sinfo);
5080                 return -ENOMEM;
5081         }
5082
5083         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
5084                                  info->snd_portid, info->snd_seq, 0,
5085                                  rdev, dev, mac_addr, &sinfo) < 0) {
5086                 nlmsg_free(msg);
5087                 return -ENOBUFS;
5088         }
5089
5090         return genlmsg_reply(msg, info);
5091 }
5092
5093 int cfg80211_check_station_change(struct wiphy *wiphy,
5094                                   struct station_parameters *params,
5095                                   enum cfg80211_station_type statype)
5096 {
5097         if (params->listen_interval != -1 &&
5098             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
5099                 return -EINVAL;
5100
5101         if (params->support_p2p_ps != -1 &&
5102             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
5103                 return -EINVAL;
5104
5105         if (params->aid &&
5106             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
5107             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
5108                 return -EINVAL;
5109
5110         /* When you run into this, adjust the code below for the new flag */
5111         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
5112
5113         switch (statype) {
5114         case CFG80211_STA_MESH_PEER_KERNEL:
5115         case CFG80211_STA_MESH_PEER_USER:
5116                 /*
5117                  * No ignoring the TDLS flag here -- the userspace mesh
5118                  * code doesn't have the bug of including TDLS in the
5119                  * mask everywhere.
5120                  */
5121                 if (params->sta_flags_mask &
5122                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5123                                   BIT(NL80211_STA_FLAG_MFP) |
5124                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
5125                         return -EINVAL;
5126                 break;
5127         case CFG80211_STA_TDLS_PEER_SETUP:
5128         case CFG80211_STA_TDLS_PEER_ACTIVE:
5129                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
5130                         return -EINVAL;
5131                 /* ignore since it can't change */
5132                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5133                 break;
5134         default:
5135                 /* disallow mesh-specific things */
5136                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
5137                         return -EINVAL;
5138                 if (params->local_pm)
5139                         return -EINVAL;
5140                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
5141                         return -EINVAL;
5142         }
5143
5144         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
5145             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
5146                 /* TDLS can't be set, ... */
5147                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
5148                         return -EINVAL;
5149                 /*
5150                  * ... but don't bother the driver with it. This works around
5151                  * a hostapd/wpa_supplicant issue -- it always includes the
5152                  * TLDS_PEER flag in the mask even for AP mode.
5153                  */
5154                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5155         }
5156
5157         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
5158             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
5159                 /* reject other things that can't change */
5160                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
5161                         return -EINVAL;
5162                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
5163                         return -EINVAL;
5164                 if (params->supported_rates)
5165                         return -EINVAL;
5166                 if (params->ext_capab || params->ht_capa || params->vht_capa ||
5167                     params->he_capa)
5168                         return -EINVAL;
5169         }
5170
5171         if (statype != CFG80211_STA_AP_CLIENT &&
5172             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
5173                 if (params->vlan)
5174                         return -EINVAL;
5175         }
5176
5177         switch (statype) {
5178         case CFG80211_STA_AP_MLME_CLIENT:
5179                 /* Use this only for authorizing/unauthorizing a station */
5180                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
5181                         return -EOPNOTSUPP;
5182                 break;
5183         case CFG80211_STA_AP_CLIENT:
5184         case CFG80211_STA_AP_CLIENT_UNASSOC:
5185                 /* accept only the listed bits */
5186                 if (params->sta_flags_mask &
5187                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
5188                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5189                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
5190                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
5191                                   BIT(NL80211_STA_FLAG_WME) |
5192                                   BIT(NL80211_STA_FLAG_MFP)))
5193                         return -EINVAL;
5194
5195                 /* but authenticated/associated only if driver handles it */
5196                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5197                     params->sta_flags_mask &
5198                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5199                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
5200                         return -EINVAL;
5201                 break;
5202         case CFG80211_STA_IBSS:
5203         case CFG80211_STA_AP_STA:
5204                 /* reject any changes other than AUTHORIZED */
5205                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
5206                         return -EINVAL;
5207                 break;
5208         case CFG80211_STA_TDLS_PEER_SETUP:
5209                 /* reject any changes other than AUTHORIZED or WME */
5210                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
5211                                                BIT(NL80211_STA_FLAG_WME)))
5212                         return -EINVAL;
5213                 /* force (at least) rates when authorizing */
5214                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
5215                     !params->supported_rates)
5216                         return -EINVAL;
5217                 break;
5218         case CFG80211_STA_TDLS_PEER_ACTIVE:
5219                 /* reject any changes */
5220                 return -EINVAL;
5221         case CFG80211_STA_MESH_PEER_KERNEL:
5222                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
5223                         return -EINVAL;
5224                 break;
5225         case CFG80211_STA_MESH_PEER_USER:
5226                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
5227                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
5228                         return -EINVAL;
5229                 break;
5230         }
5231
5232         /*
5233          * Older kernel versions ignored this attribute entirely, so don't
5234          * reject attempts to update it but mark it as unused instead so the
5235          * driver won't look at the data.
5236          */
5237         if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
5238             statype != CFG80211_STA_TDLS_PEER_SETUP)
5239                 params->opmode_notif_used = false;
5240
5241         return 0;
5242 }
5243 EXPORT_SYMBOL(cfg80211_check_station_change);
5244
5245 /*
5246  * Get vlan interface making sure it is running and on the right wiphy.
5247  */
5248 static struct net_device *get_vlan(struct genl_info *info,
5249                                    struct cfg80211_registered_device *rdev)
5250 {
5251         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
5252         struct net_device *v;
5253         int ret;
5254
5255         if (!vlanattr)
5256                 return NULL;
5257
5258         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
5259         if (!v)
5260                 return ERR_PTR(-ENODEV);
5261
5262         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
5263                 ret = -EINVAL;
5264                 goto error;
5265         }
5266
5267         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5268             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5269             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
5270                 ret = -EINVAL;
5271                 goto error;
5272         }
5273
5274         if (!netif_running(v)) {
5275                 ret = -ENETDOWN;
5276                 goto error;
5277         }
5278
5279         return v;
5280  error:
5281         dev_put(v);
5282         return ERR_PTR(ret);
5283 }
5284
5285 static const struct nla_policy
5286 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
5287         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
5288         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
5289 };
5290
5291 static int nl80211_parse_sta_wme(struct genl_info *info,
5292                                  struct station_parameters *params)
5293 {
5294         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
5295         struct nlattr *nla;
5296         int err;
5297
5298         /* parse WME attributes if present */
5299         if (!info->attrs[NL80211_ATTR_STA_WME])
5300                 return 0;
5301
5302         nla = info->attrs[NL80211_ATTR_STA_WME];
5303         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
5304                                nl80211_sta_wme_policy, info->extack);
5305         if (err)
5306                 return err;
5307
5308         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
5309                 params->uapsd_queues = nla_get_u8(
5310                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
5311         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
5312                 return -EINVAL;
5313
5314         if (tb[NL80211_STA_WME_MAX_SP])
5315                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
5316
5317         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
5318                 return -EINVAL;
5319
5320         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
5321
5322         return 0;
5323 }
5324
5325 static int nl80211_parse_sta_channel_info(struct genl_info *info,
5326                                       struct station_parameters *params)
5327 {
5328         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
5329                 params->supported_channels =
5330                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
5331                 params->supported_channels_len =
5332                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
5333                 /*
5334                  * Need to include at least one (first channel, number of
5335                  * channels) tuple for each subband, and must have proper
5336                  * tuples for the rest of the data as well.
5337                  */
5338                 if (params->supported_channels_len < 2)
5339                         return -EINVAL;
5340                 if (params->supported_channels_len % 2)
5341                         return -EINVAL;
5342         }
5343
5344         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
5345                 params->supported_oper_classes =
5346                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
5347                 params->supported_oper_classes_len =
5348                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
5349                 /*
5350                  * The value of the Length field of the Supported Operating
5351                  * Classes element is between 2 and 253.
5352                  */
5353                 if (params->supported_oper_classes_len < 2 ||
5354                     params->supported_oper_classes_len > 253)
5355                         return -EINVAL;
5356         }
5357         return 0;
5358 }
5359
5360 static int nl80211_set_station_tdls(struct genl_info *info,
5361                                     struct station_parameters *params)
5362 {
5363         int err;
5364         /* Dummy STA entry gets updated once the peer capabilities are known */
5365         if (info->attrs[NL80211_ATTR_PEER_AID])
5366                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5367         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5368                 params->ht_capa =
5369                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5370         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5371                 params->vht_capa =
5372                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5373         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
5374                 params->he_capa =
5375                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5376                 params->he_capa_len =
5377                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5378
5379                 if (params->he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN)
5380                         return -EINVAL;
5381         }
5382
5383         err = nl80211_parse_sta_channel_info(info, params);
5384         if (err)
5385                 return err;
5386
5387         return nl80211_parse_sta_wme(info, params);
5388 }
5389
5390 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
5391 {
5392         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5393         struct net_device *dev = info->user_ptr[1];
5394         struct station_parameters params;
5395         u8 *mac_addr;
5396         int err;
5397
5398         memset(&params, 0, sizeof(params));
5399
5400         if (!rdev->ops->change_station)
5401                 return -EOPNOTSUPP;
5402
5403         /*
5404          * AID and listen_interval properties can be set only for unassociated
5405          * station. Include these parameters here and will check them in
5406          * cfg80211_check_station_change().
5407          */
5408         if (info->attrs[NL80211_ATTR_STA_AID])
5409                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5410
5411         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5412                 params.listen_interval =
5413                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5414         else
5415                 params.listen_interval = -1;
5416
5417         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
5418                 params.support_p2p_ps =
5419                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5420         else
5421                 params.support_p2p_ps = -1;
5422
5423         if (!info->attrs[NL80211_ATTR_MAC])
5424                 return -EINVAL;
5425
5426         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5427
5428         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
5429                 params.supported_rates =
5430                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5431                 params.supported_rates_len =
5432                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5433         }
5434
5435         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5436                 params.capability =
5437                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5438                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5439         }
5440
5441         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5442                 params.ext_capab =
5443                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5444                 params.ext_capab_len =
5445                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5446         }
5447
5448         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5449                 return -EINVAL;
5450
5451         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
5452                 params.plink_action =
5453                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5454
5455         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
5456                 params.plink_state =
5457                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
5458                 if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
5459                         params.peer_aid = nla_get_u16(
5460                                 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
5461                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
5462         }
5463
5464         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
5465                 params.local_pm = nla_get_u32(
5466                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
5467
5468         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5469                 params.opmode_notif_used = true;
5470                 params.opmode_notif =
5471                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5472         }
5473
5474         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
5475                 params.airtime_weight =
5476                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
5477
5478         if (params.airtime_weight &&
5479             !wiphy_ext_feature_isset(&rdev->wiphy,
5480                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
5481                 return -EOPNOTSUPP;
5482
5483         /* Include parameters for TDLS peer (will check later) */
5484         err = nl80211_set_station_tdls(info, &params);
5485         if (err)
5486                 return err;
5487
5488         params.vlan = get_vlan(info, rdev);
5489         if (IS_ERR(params.vlan))
5490                 return PTR_ERR(params.vlan);
5491
5492         switch (dev->ieee80211_ptr->iftype) {
5493         case NL80211_IFTYPE_AP:
5494         case NL80211_IFTYPE_AP_VLAN:
5495         case NL80211_IFTYPE_P2P_GO:
5496         case NL80211_IFTYPE_P2P_CLIENT:
5497         case NL80211_IFTYPE_STATION:
5498         case NL80211_IFTYPE_ADHOC:
5499         case NL80211_IFTYPE_MESH_POINT:
5500                 break;
5501         default:
5502                 err = -EOPNOTSUPP;
5503                 goto out_put_vlan;
5504         }
5505
5506         /* driver will call cfg80211_check_station_change() */
5507         err = rdev_change_station(rdev, dev, mac_addr, &params);
5508
5509  out_put_vlan:
5510         if (params.vlan)
5511                 dev_put(params.vlan);
5512
5513         return err;
5514 }
5515
5516 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
5517 {
5518         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5519         int err;
5520         struct net_device *dev = info->user_ptr[1];
5521         struct station_parameters params;
5522         u8 *mac_addr = NULL;
5523         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5524                          BIT(NL80211_STA_FLAG_ASSOCIATED);
5525
5526         memset(&params, 0, sizeof(params));
5527
5528         if (!rdev->ops->add_station)
5529                 return -EOPNOTSUPP;
5530
5531         if (!info->attrs[NL80211_ATTR_MAC])
5532                 return -EINVAL;
5533
5534         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5535                 return -EINVAL;
5536
5537         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
5538                 return -EINVAL;
5539
5540         if (!info->attrs[NL80211_ATTR_STA_AID] &&
5541             !info->attrs[NL80211_ATTR_PEER_AID])
5542                 return -EINVAL;
5543
5544         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5545         params.supported_rates =
5546                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5547         params.supported_rates_len =
5548                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5549         params.listen_interval =
5550                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5551
5552         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
5553                 params.support_p2p_ps =
5554                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5555         } else {
5556                 /*
5557                  * if not specified, assume it's supported for P2P GO interface,
5558                  * and is NOT supported for AP interface
5559                  */
5560                 params.support_p2p_ps =
5561                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
5562         }
5563
5564         if (info->attrs[NL80211_ATTR_PEER_AID])
5565                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5566         else
5567                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5568
5569         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5570                 params.capability =
5571                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5572                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5573         }
5574
5575         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5576                 params.ext_capab =
5577                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5578                 params.ext_capab_len =
5579                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5580         }
5581
5582         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5583                 params.ht_capa =
5584                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5585
5586         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5587                 params.vht_capa =
5588                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5589
5590         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
5591                 params.he_capa =
5592                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5593                 params.he_capa_len =
5594                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5595
5596                 /* max len is validated in nla policy */
5597                 if (params.he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN)
5598                         return -EINVAL;
5599         }
5600
5601         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5602                 params.opmode_notif_used = true;
5603                 params.opmode_notif =
5604                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5605         }
5606
5607         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
5608                 params.plink_action =
5609                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5610
5611         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
5612                 params.airtime_weight =
5613                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
5614
5615         if (params.airtime_weight &&
5616             !wiphy_ext_feature_isset(&rdev->wiphy,
5617                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
5618                 return -EOPNOTSUPP;
5619
5620         err = nl80211_parse_sta_channel_info(info, &params);
5621         if (err)
5622                 return err;
5623
5624         err = nl80211_parse_sta_wme(info, &params);
5625         if (err)
5626                 return err;
5627
5628         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5629                 return -EINVAL;
5630
5631         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
5632          * as userspace might just pass through the capabilities from the IEs
5633          * directly, rather than enforcing this restriction and returning an
5634          * error in this case.
5635          */
5636         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
5637                 params.ht_capa = NULL;
5638                 params.vht_capa = NULL;
5639
5640                 /* HE requires WME */
5641                 if (params.he_capa_len)
5642                         return -EINVAL;
5643         }
5644
5645         /* When you run into this, adjust the code below for the new flag */
5646         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
5647
5648         switch (dev->ieee80211_ptr->iftype) {
5649         case NL80211_IFTYPE_AP:
5650         case NL80211_IFTYPE_AP_VLAN:
5651         case NL80211_IFTYPE_P2P_GO:
5652                 /* ignore WME attributes if iface/sta is not capable */
5653                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
5654                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
5655                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5656
5657                 /* TDLS peers cannot be added */
5658                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5659                     info->attrs[NL80211_ATTR_PEER_AID])
5660                         return -EINVAL;
5661                 /* but don't bother the driver with it */
5662                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5663
5664                 /* allow authenticated/associated only if driver handles it */
5665                 if (!(rdev->wiphy.features &
5666                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5667                     params.sta_flags_mask & auth_assoc)
5668                         return -EINVAL;
5669
5670                 /* Older userspace, or userspace wanting to be compatible with
5671                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
5672                  * and assoc flags in the mask, but assumes the station will be
5673                  * added as associated anyway since this was the required driver
5674                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
5675                  * introduced.
5676                  * In order to not bother drivers with this quirk in the API
5677                  * set the flags in both the mask and set for new stations in
5678                  * this case.
5679                  */
5680                 if (!(params.sta_flags_mask & auth_assoc)) {
5681                         params.sta_flags_mask |= auth_assoc;
5682                         params.sta_flags_set |= auth_assoc;
5683                 }
5684
5685                 /* must be last in here for error handling */
5686                 params.vlan = get_vlan(info, rdev);
5687                 if (IS_ERR(params.vlan))
5688                         return PTR_ERR(params.vlan);
5689                 break;
5690         case NL80211_IFTYPE_MESH_POINT:
5691                 /* ignore uAPSD data */
5692                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5693
5694                 /* associated is disallowed */
5695                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
5696                         return -EINVAL;
5697                 /* TDLS peers cannot be added */
5698                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5699                     info->attrs[NL80211_ATTR_PEER_AID])
5700                         return -EINVAL;
5701                 break;
5702         case NL80211_IFTYPE_STATION:
5703         case NL80211_IFTYPE_P2P_CLIENT:
5704                 /* ignore uAPSD data */
5705                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5706
5707                 /* these are disallowed */
5708                 if (params.sta_flags_mask &
5709                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
5710                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
5711                         return -EINVAL;
5712                 /* Only TDLS peers can be added */
5713                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
5714                         return -EINVAL;
5715                 /* Can only add if TDLS ... */
5716                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
5717                         return -EOPNOTSUPP;
5718                 /* ... with external setup is supported */
5719                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
5720                         return -EOPNOTSUPP;
5721                 /*
5722                  * Older wpa_supplicant versions always mark the TDLS peer
5723                  * as authorized, but it shouldn't yet be.
5724                  */
5725                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
5726                 break;
5727         default:
5728                 return -EOPNOTSUPP;
5729         }
5730
5731         /* be aware of params.vlan when changing code here */
5732
5733         err = rdev_add_station(rdev, dev, mac_addr, &params);
5734
5735         if (params.vlan)
5736                 dev_put(params.vlan);
5737         return err;
5738 }
5739
5740 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
5741 {
5742         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5743         struct net_device *dev = info->user_ptr[1];
5744         struct station_del_parameters params;
5745
5746         memset(&params, 0, sizeof(params));
5747
5748         if (info->attrs[NL80211_ATTR_MAC])
5749                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
5750
5751         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5752             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5753             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5754             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5755                 return -EINVAL;
5756
5757         if (!rdev->ops->del_station)
5758                 return -EOPNOTSUPP;
5759
5760         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
5761                 params.subtype =
5762                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
5763                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
5764                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
5765                         return -EINVAL;
5766         } else {
5767                 /* Default to Deauthentication frame */
5768                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
5769         }
5770
5771         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
5772                 params.reason_code =
5773                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5774                 if (params.reason_code == 0)
5775                         return -EINVAL; /* 0 is reserved */
5776         } else {
5777                 /* Default to reason code 2 */
5778                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
5779         }
5780
5781         return rdev_del_station(rdev, dev, &params);
5782 }
5783
5784 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
5785                                 int flags, struct net_device *dev,
5786                                 u8 *dst, u8 *next_hop,
5787                                 struct mpath_info *pinfo)
5788 {
5789         void *hdr;
5790         struct nlattr *pinfoattr;
5791
5792         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
5793         if (!hdr)
5794                 return -1;
5795
5796         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5797             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
5798             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
5799             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
5800                 goto nla_put_failure;
5801
5802         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
5803         if (!pinfoattr)
5804                 goto nla_put_failure;
5805         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
5806             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
5807                         pinfo->frame_qlen))
5808                 goto nla_put_failure;
5809         if (((pinfo->filled & MPATH_INFO_SN) &&
5810              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
5811             ((pinfo->filled & MPATH_INFO_METRIC) &&
5812              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
5813                          pinfo->metric)) ||
5814             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
5815              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
5816                          pinfo->exptime)) ||
5817             ((pinfo->filled & MPATH_INFO_FLAGS) &&
5818              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
5819                         pinfo->flags)) ||
5820             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
5821              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
5822                          pinfo->discovery_timeout)) ||
5823             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
5824              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
5825                         pinfo->discovery_retries)) ||
5826             ((pinfo->filled & MPATH_INFO_HOP_COUNT) &&
5827              nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT,
5828                         pinfo->hop_count)) ||
5829             ((pinfo->filled & MPATH_INFO_PATH_CHANGE) &&
5830              nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE,
5831                          pinfo->path_change_count)))
5832                 goto nla_put_failure;
5833
5834         nla_nest_end(msg, pinfoattr);
5835
5836         genlmsg_end(msg, hdr);
5837         return 0;
5838
5839  nla_put_failure:
5840         genlmsg_cancel(msg, hdr);
5841         return -EMSGSIZE;
5842 }
5843
5844 static int nl80211_dump_mpath(struct sk_buff *skb,
5845                               struct netlink_callback *cb)
5846 {
5847         struct mpath_info pinfo;
5848         struct cfg80211_registered_device *rdev;
5849         struct wireless_dev *wdev;
5850         u8 dst[ETH_ALEN];
5851         u8 next_hop[ETH_ALEN];
5852         int path_idx = cb->args[2];
5853         int err;
5854
5855         rtnl_lock();
5856         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
5857         if (err)
5858                 goto out_err;
5859
5860         if (!rdev->ops->dump_mpath) {
5861                 err = -EOPNOTSUPP;
5862                 goto out_err;
5863         }
5864
5865         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5866                 err = -EOPNOTSUPP;
5867                 goto out_err;
5868         }
5869
5870         while (1) {
5871                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
5872                                       next_hop, &pinfo);
5873                 if (err == -ENOENT)
5874                         break;
5875                 if (err)
5876                         goto out_err;
5877
5878                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5879                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
5880                                        wdev->netdev, dst, next_hop,
5881                                        &pinfo) < 0)
5882                         goto out;
5883
5884                 path_idx++;
5885         }
5886
5887  out:
5888         cb->args[2] = path_idx;
5889         err = skb->len;
5890  out_err:
5891         rtnl_unlock();
5892         return err;
5893 }
5894
5895 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
5896 {
5897         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5898         int err;
5899         struct net_device *dev = info->user_ptr[1];
5900         struct mpath_info pinfo;
5901         struct sk_buff *msg;
5902         u8 *dst = NULL;
5903         u8 next_hop[ETH_ALEN];
5904
5905         memset(&pinfo, 0, sizeof(pinfo));
5906
5907         if (!info->attrs[NL80211_ATTR_MAC])
5908                 return -EINVAL;
5909
5910         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5911
5912         if (!rdev->ops->get_mpath)
5913                 return -EOPNOTSUPP;
5914
5915         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5916                 return -EOPNOTSUPP;
5917
5918         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
5919         if (err)
5920                 return err;
5921
5922         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5923         if (!msg)
5924                 return -ENOMEM;
5925
5926         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5927                                  dev, dst, next_hop, &pinfo) < 0) {
5928                 nlmsg_free(msg);
5929                 return -ENOBUFS;
5930         }
5931
5932         return genlmsg_reply(msg, info);
5933 }
5934
5935 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
5936 {
5937         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5938         struct net_device *dev = info->user_ptr[1];
5939         u8 *dst = NULL;
5940         u8 *next_hop = NULL;
5941
5942         if (!info->attrs[NL80211_ATTR_MAC])
5943                 return -EINVAL;
5944
5945         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5946                 return -EINVAL;
5947
5948         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5949         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5950
5951         if (!rdev->ops->change_mpath)
5952                 return -EOPNOTSUPP;
5953
5954         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5955                 return -EOPNOTSUPP;
5956
5957         return rdev_change_mpath(rdev, dev, dst, next_hop);
5958 }
5959
5960 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
5961 {
5962         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5963         struct net_device *dev = info->user_ptr[1];
5964         u8 *dst = NULL;
5965         u8 *next_hop = NULL;
5966
5967         if (!info->attrs[NL80211_ATTR_MAC])
5968                 return -EINVAL;
5969
5970         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5971                 return -EINVAL;
5972
5973         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5974         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5975
5976         if (!rdev->ops->add_mpath)
5977                 return -EOPNOTSUPP;
5978
5979         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5980                 return -EOPNOTSUPP;
5981
5982         return rdev_add_mpath(rdev, dev, dst, next_hop);
5983 }
5984
5985 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
5986 {
5987         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5988         struct net_device *dev = info->user_ptr[1];
5989         u8 *dst = NULL;
5990
5991         if (info->attrs[NL80211_ATTR_MAC])
5992                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5993
5994         if (!rdev->ops->del_mpath)
5995                 return -EOPNOTSUPP;
5996
5997         return rdev_del_mpath(rdev, dev, dst);
5998 }
5999
6000 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
6001 {
6002         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6003         int err;
6004         struct net_device *dev = info->user_ptr[1];
6005         struct mpath_info pinfo;
6006         struct sk_buff *msg;
6007         u8 *dst = NULL;
6008         u8 mpp[ETH_ALEN];
6009
6010         memset(&pinfo, 0, sizeof(pinfo));
6011
6012         if (!info->attrs[NL80211_ATTR_MAC])
6013                 return -EINVAL;
6014
6015         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6016
6017         if (!rdev->ops->get_mpp)
6018                 return -EOPNOTSUPP;
6019
6020         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6021                 return -EOPNOTSUPP;
6022
6023         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
6024         if (err)
6025                 return err;
6026
6027         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6028         if (!msg)
6029                 return -ENOMEM;
6030
6031         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
6032                                dev, dst, mpp, &pinfo) < 0) {
6033                 nlmsg_free(msg);
6034                 return -ENOBUFS;
6035         }
6036
6037         return genlmsg_reply(msg, info);
6038 }
6039
6040 static int nl80211_dump_mpp(struct sk_buff *skb,
6041                             struct netlink_callback *cb)
6042 {
6043         struct mpath_info pinfo;
6044         struct cfg80211_registered_device *rdev;
6045         struct wireless_dev *wdev;
6046         u8 dst[ETH_ALEN];
6047         u8 mpp[ETH_ALEN];
6048         int path_idx = cb->args[2];
6049         int err;
6050
6051         rtnl_lock();
6052         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
6053         if (err)
6054                 goto out_err;
6055
6056         if (!rdev->ops->dump_mpp) {
6057                 err = -EOPNOTSUPP;
6058                 goto out_err;
6059         }
6060
6061         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
6062                 err = -EOPNOTSUPP;
6063                 goto out_err;
6064         }
6065
6066         while (1) {
6067                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
6068                                     mpp, &pinfo);
6069                 if (err == -ENOENT)
6070                         break;
6071                 if (err)
6072                         goto out_err;
6073
6074                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
6075                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
6076                                        wdev->netdev, dst, mpp,
6077                                        &pinfo) < 0)
6078                         goto out;
6079
6080                 path_idx++;
6081         }
6082
6083  out:
6084         cb->args[2] = path_idx;
6085         err = skb->len;
6086  out_err:
6087         rtnl_unlock();
6088         return err;
6089 }
6090
6091 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
6092 {
6093         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6094         struct net_device *dev = info->user_ptr[1];
6095         struct wireless_dev *wdev = dev->ieee80211_ptr;
6096         struct bss_parameters params;
6097         int err;
6098
6099         memset(&params, 0, sizeof(params));
6100         /* default to not changing parameters */
6101         params.use_cts_prot = -1;
6102         params.use_short_preamble = -1;
6103         params.use_short_slot_time = -1;
6104         params.ap_isolate = -1;
6105         params.ht_opmode = -1;
6106         params.p2p_ctwindow = -1;
6107         params.p2p_opp_ps = -1;
6108
6109         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
6110                 params.use_cts_prot =
6111                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
6112         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
6113                 params.use_short_preamble =
6114                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
6115         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
6116                 params.use_short_slot_time =
6117                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
6118         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6119                 params.basic_rates =
6120                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6121                 params.basic_rates_len =
6122                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6123         }
6124         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
6125                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
6126         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
6127                 params.ht_opmode =
6128                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
6129
6130         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
6131                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6132                         return -EINVAL;
6133                 params.p2p_ctwindow =
6134                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
6135                 if (params.p2p_ctwindow != 0 &&
6136                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
6137                         return -EINVAL;
6138         }
6139
6140         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
6141                 u8 tmp;
6142
6143                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6144                         return -EINVAL;
6145                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
6146                 params.p2p_opp_ps = tmp;
6147                 if (params.p2p_opp_ps &&
6148                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
6149                         return -EINVAL;
6150         }
6151
6152         if (!rdev->ops->change_bss)
6153                 return -EOPNOTSUPP;
6154
6155         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6156             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6157                 return -EOPNOTSUPP;
6158
6159         wdev_lock(wdev);
6160         err = rdev_change_bss(rdev, dev, &params);
6161         wdev_unlock(wdev);
6162
6163         return err;
6164 }
6165
6166 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
6167 {
6168         char *data = NULL;
6169         bool is_indoor;
6170         enum nl80211_user_reg_hint_type user_reg_hint_type;
6171         u32 owner_nlportid;
6172
6173         /*
6174          * You should only get this when cfg80211 hasn't yet initialized
6175          * completely when built-in to the kernel right between the time
6176          * window between nl80211_init() and regulatory_init(), if that is
6177          * even possible.
6178          */
6179         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
6180                 return -EINPROGRESS;
6181
6182         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
6183                 user_reg_hint_type =
6184                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
6185         else
6186                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
6187
6188         switch (user_reg_hint_type) {
6189         case NL80211_USER_REG_HINT_USER:
6190         case NL80211_USER_REG_HINT_CELL_BASE:
6191                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6192                         return -EINVAL;
6193
6194                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6195                 return regulatory_hint_user(data, user_reg_hint_type);
6196         case NL80211_USER_REG_HINT_INDOOR:
6197                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
6198                         owner_nlportid = info->snd_portid;
6199                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
6200                 } else {
6201                         owner_nlportid = 0;
6202                         is_indoor = true;
6203                 }
6204
6205                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
6206         default:
6207                 return -EINVAL;
6208         }
6209 }
6210
6211 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
6212 {
6213         return reg_reload_regdb();
6214 }
6215
6216 static int nl80211_get_mesh_config(struct sk_buff *skb,
6217                                    struct genl_info *info)
6218 {
6219         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6220         struct net_device *dev = info->user_ptr[1];
6221         struct wireless_dev *wdev = dev->ieee80211_ptr;
6222         struct mesh_config cur_params;
6223         int err = 0;
6224         void *hdr;
6225         struct nlattr *pinfoattr;
6226         struct sk_buff *msg;
6227
6228         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6229                 return -EOPNOTSUPP;
6230
6231         if (!rdev->ops->get_mesh_config)
6232                 return -EOPNOTSUPP;
6233
6234         wdev_lock(wdev);
6235         /* If not connected, get default parameters */
6236         if (!wdev->mesh_id_len)
6237                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
6238         else
6239                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
6240         wdev_unlock(wdev);
6241
6242         if (err)
6243                 return err;
6244
6245         /* Draw up a netlink message to send back */
6246         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6247         if (!msg)
6248                 return -ENOMEM;
6249         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6250                              NL80211_CMD_GET_MESH_CONFIG);
6251         if (!hdr)
6252                 goto out;
6253         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
6254         if (!pinfoattr)
6255                 goto nla_put_failure;
6256         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6257             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
6258                         cur_params.dot11MeshRetryTimeout) ||
6259             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
6260                         cur_params.dot11MeshConfirmTimeout) ||
6261             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
6262                         cur_params.dot11MeshHoldingTimeout) ||
6263             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
6264                         cur_params.dot11MeshMaxPeerLinks) ||
6265             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
6266                        cur_params.dot11MeshMaxRetries) ||
6267             nla_put_u8(msg, NL80211_MESHCONF_TTL,
6268                        cur_params.dot11MeshTTL) ||
6269             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
6270                        cur_params.element_ttl) ||
6271             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
6272                        cur_params.auto_open_plinks) ||
6273             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
6274                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
6275             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
6276                        cur_params.dot11MeshHWMPmaxPREQretries) ||
6277             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
6278                         cur_params.path_refresh_time) ||
6279             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
6280                         cur_params.min_discovery_timeout) ||
6281             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
6282                         cur_params.dot11MeshHWMPactivePathTimeout) ||
6283             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
6284                         cur_params.dot11MeshHWMPpreqMinInterval) ||
6285             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
6286                         cur_params.dot11MeshHWMPperrMinInterval) ||
6287             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
6288                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
6289             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
6290                        cur_params.dot11MeshHWMPRootMode) ||
6291             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
6292                         cur_params.dot11MeshHWMPRannInterval) ||
6293             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
6294                        cur_params.dot11MeshGateAnnouncementProtocol) ||
6295             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
6296                        cur_params.dot11MeshForwarding) ||
6297             nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
6298                         cur_params.rssi_threshold) ||
6299             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
6300                         cur_params.ht_opmode) ||
6301             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6302                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
6303             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6304                         cur_params.dot11MeshHWMProotInterval) ||
6305             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6306                         cur_params.dot11MeshHWMPconfirmationInterval) ||
6307             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
6308                         cur_params.power_mode) ||
6309             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
6310                         cur_params.dot11MeshAwakeWindowDuration) ||
6311             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
6312                         cur_params.plink_timeout) ||
6313             nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE,
6314                        cur_params.dot11MeshConnectedToMeshGate))
6315                 goto nla_put_failure;
6316         nla_nest_end(msg, pinfoattr);
6317         genlmsg_end(msg, hdr);
6318         return genlmsg_reply(msg, info);
6319
6320  nla_put_failure:
6321  out:
6322         nlmsg_free(msg);
6323         return -ENOBUFS;
6324 }
6325
6326 static const struct nla_policy
6327 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
6328         [NL80211_MESHCONF_RETRY_TIMEOUT] =
6329                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
6330         [NL80211_MESHCONF_CONFIRM_TIMEOUT] =
6331                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
6332         [NL80211_MESHCONF_HOLDING_TIMEOUT] =
6333                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
6334         [NL80211_MESHCONF_MAX_PEER_LINKS] =
6335                 NLA_POLICY_RANGE(NLA_U16, 0, 255),
6336         [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
6337         [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
6338         [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
6339         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
6340         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
6341                 NLA_POLICY_RANGE(NLA_U32, 1, 255),
6342         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
6343         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
6344         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
6345         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
6346         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
6347                 NLA_POLICY_MIN(NLA_U16, 1),
6348         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
6349                 NLA_POLICY_MIN(NLA_U16, 1),
6350         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
6351                 NLA_POLICY_MIN(NLA_U16, 1),
6352         [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
6353         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
6354                 NLA_POLICY_MIN(NLA_U16, 1),
6355         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
6356         [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
6357         [NL80211_MESHCONF_RSSI_THRESHOLD] =
6358                 NLA_POLICY_RANGE(NLA_S32, -255, 0),
6359         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
6360         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
6361         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
6362                 NLA_POLICY_MIN(NLA_U16, 1),
6363         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
6364                 NLA_POLICY_MIN(NLA_U16, 1),
6365         [NL80211_MESHCONF_POWER_MODE] =
6366                 NLA_POLICY_RANGE(NLA_U32,
6367                                  NL80211_MESH_POWER_ACTIVE,
6368                                  NL80211_MESH_POWER_MAX),
6369         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
6370         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
6371         [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
6372 };
6373
6374 static const struct nla_policy
6375         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
6376         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
6377         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
6378         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
6379         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
6380         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
6381         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
6382         [NL80211_MESH_SETUP_IE] =
6383                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
6384                                        IEEE80211_MAX_DATA_LEN),
6385         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
6386 };
6387
6388 static int nl80211_parse_mesh_config(struct genl_info *info,
6389                                      struct mesh_config *cfg,
6390                                      u32 *mask_out)
6391 {
6392         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
6393         u32 mask = 0;
6394         u16 ht_opmode;
6395
6396 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn)       \
6397 do {                                                                    \
6398         if (tb[attr]) {                                                 \
6399                 cfg->param = fn(tb[attr]);                              \
6400                 mask |= BIT((attr) - 1);                                \
6401         }                                                               \
6402 } while (0)
6403
6404         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
6405                 return -EINVAL;
6406         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
6407                              info->attrs[NL80211_ATTR_MESH_CONFIG],
6408                              nl80211_meshconf_params_policy, info->extack))
6409                 return -EINVAL;
6410
6411         /* This makes sure that there aren't more than 32 mesh config
6412          * parameters (otherwise our bitfield scheme would not work.) */
6413         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
6414
6415         /* Fill in the params struct */
6416         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
6417                                   NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
6418         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
6419                                   NL80211_MESHCONF_CONFIRM_TIMEOUT,
6420                                   nla_get_u16);
6421         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
6422                                   NL80211_MESHCONF_HOLDING_TIMEOUT,
6423                                   nla_get_u16);
6424         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
6425                                   NL80211_MESHCONF_MAX_PEER_LINKS,
6426                                   nla_get_u16);
6427         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
6428                                   NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
6429         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
6430                                   NL80211_MESHCONF_TTL, nla_get_u8);
6431         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
6432                                   NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
6433         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
6434                                   NL80211_MESHCONF_AUTO_OPEN_PLINKS,
6435                                   nla_get_u8);
6436         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
6437                                   mask,
6438                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
6439                                   nla_get_u32);
6440         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
6441                                   NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
6442                                   nla_get_u8);
6443         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
6444                                   NL80211_MESHCONF_PATH_REFRESH_TIME,
6445                                   nla_get_u32);
6446         if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
6447             (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
6448                 return -EINVAL;
6449         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
6450                                   NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
6451                                   nla_get_u16);
6452         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
6453                                   mask,
6454                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
6455                                   nla_get_u32);
6456         if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
6457             (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
6458              cfg->dot11MeshHWMPactivePathTimeout > 65535))
6459                 return -EINVAL;
6460         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
6461                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
6462                                   nla_get_u16);
6463         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
6464                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
6465                                   nla_get_u16);
6466         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6467                                   dot11MeshHWMPnetDiameterTraversalTime, mask,
6468                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
6469                                   nla_get_u16);
6470         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
6471                                   NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
6472         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
6473                                   NL80211_MESHCONF_HWMP_RANN_INTERVAL,
6474                                   nla_get_u16);
6475         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
6476                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
6477                                   nla_get_u8);
6478         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
6479                                   NL80211_MESHCONF_FORWARDING, nla_get_u8);
6480         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
6481                                   NL80211_MESHCONF_RSSI_THRESHOLD,
6482                                   nla_get_s32);
6483         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask,
6484                                   NL80211_MESHCONF_CONNECTED_TO_GATE,
6485                                   nla_get_u8);
6486         /*
6487          * Check HT operation mode based on
6488          * IEEE 802.11-2016 9.4.2.57 HT Operation element.
6489          */
6490         if (tb[NL80211_MESHCONF_HT_OPMODE]) {
6491                 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
6492
6493                 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
6494                                   IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
6495                                   IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
6496                         return -EINVAL;
6497
6498                 /* NON_HT_STA bit is reserved, but some programs set it */
6499                 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
6500
6501                 cfg->ht_opmode = ht_opmode;
6502                 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
6503         }
6504         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6505                                   dot11MeshHWMPactivePathToRootTimeout, mask,
6506                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6507                                   nla_get_u32);
6508         if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
6509             (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
6510              cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
6511                 return -EINVAL;
6512         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
6513                                   NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6514                                   nla_get_u16);
6515         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
6516                                   mask,
6517                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6518                                   nla_get_u16);
6519         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
6520                                   NL80211_MESHCONF_POWER_MODE, nla_get_u32);
6521         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
6522                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
6523         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
6524                                   NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
6525         if (mask_out)
6526                 *mask_out = mask;
6527
6528         return 0;
6529
6530 #undef FILL_IN_MESH_PARAM_IF_SET
6531 }
6532
6533 static int nl80211_parse_mesh_setup(struct genl_info *info,
6534                                      struct mesh_setup *setup)
6535 {
6536         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6537         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
6538
6539         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
6540                 return -EINVAL;
6541         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
6542                              info->attrs[NL80211_ATTR_MESH_SETUP],
6543                              nl80211_mesh_setup_params_policy, info->extack))
6544                 return -EINVAL;
6545
6546         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
6547                 setup->sync_method =
6548                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
6549                  IEEE80211_SYNC_METHOD_VENDOR :
6550                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
6551
6552         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
6553                 setup->path_sel_proto =
6554                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
6555                  IEEE80211_PATH_PROTOCOL_VENDOR :
6556                  IEEE80211_PATH_PROTOCOL_HWMP;
6557
6558         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
6559                 setup->path_metric =
6560                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
6561                  IEEE80211_PATH_METRIC_VENDOR :
6562                  IEEE80211_PATH_METRIC_AIRTIME;
6563
6564         if (tb[NL80211_MESH_SETUP_IE]) {
6565                 struct nlattr *ieattr =
6566                         tb[NL80211_MESH_SETUP_IE];
6567                 setup->ie = nla_data(ieattr);
6568                 setup->ie_len = nla_len(ieattr);
6569         }
6570         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
6571             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
6572                 return -EINVAL;
6573         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
6574         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
6575         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
6576         if (setup->is_secure)
6577                 setup->user_mpm = true;
6578
6579         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
6580                 if (!setup->user_mpm)
6581                         return -EINVAL;
6582                 setup->auth_id =
6583                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
6584         }
6585
6586         return 0;
6587 }
6588
6589 static int nl80211_update_mesh_config(struct sk_buff *skb,
6590                                       struct genl_info *info)
6591 {
6592         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6593         struct net_device *dev = info->user_ptr[1];
6594         struct wireless_dev *wdev = dev->ieee80211_ptr;
6595         struct mesh_config cfg;
6596         u32 mask;
6597         int err;
6598
6599         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6600                 return -EOPNOTSUPP;
6601
6602         if (!rdev->ops->update_mesh_config)
6603                 return -EOPNOTSUPP;
6604
6605         err = nl80211_parse_mesh_config(info, &cfg, &mask);
6606         if (err)
6607                 return err;
6608
6609         wdev_lock(wdev);
6610         if (!wdev->mesh_id_len)
6611                 err = -ENOLINK;
6612
6613         if (!err)
6614                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
6615
6616         wdev_unlock(wdev);
6617
6618         return err;
6619 }
6620
6621 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
6622                               struct sk_buff *msg)
6623 {
6624         struct nlattr *nl_reg_rules;
6625         unsigned int i;
6626
6627         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
6628             (regdom->dfs_region &&
6629              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
6630                 goto nla_put_failure;
6631
6632         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
6633         if (!nl_reg_rules)
6634                 goto nla_put_failure;
6635
6636         for (i = 0; i < regdom->n_reg_rules; i++) {
6637                 struct nlattr *nl_reg_rule;
6638                 const struct ieee80211_reg_rule *reg_rule;
6639                 const struct ieee80211_freq_range *freq_range;
6640                 const struct ieee80211_power_rule *power_rule;
6641                 unsigned int max_bandwidth_khz;
6642
6643                 reg_rule = &regdom->reg_rules[i];
6644                 freq_range = &reg_rule->freq_range;
6645                 power_rule = &reg_rule->power_rule;
6646
6647                 nl_reg_rule = nla_nest_start(msg, i);
6648                 if (!nl_reg_rule)
6649                         goto nla_put_failure;
6650
6651                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
6652                 if (!max_bandwidth_khz)
6653                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
6654                                                                   reg_rule);
6655
6656                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
6657                                 reg_rule->flags) ||
6658                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
6659                                 freq_range->start_freq_khz) ||
6660                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
6661                                 freq_range->end_freq_khz) ||
6662                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
6663                                 max_bandwidth_khz) ||
6664                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
6665                                 power_rule->max_antenna_gain) ||
6666                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
6667                                 power_rule->max_eirp) ||
6668                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
6669                                 reg_rule->dfs_cac_ms))
6670                         goto nla_put_failure;
6671
6672                 nla_nest_end(msg, nl_reg_rule);
6673         }
6674
6675         nla_nest_end(msg, nl_reg_rules);
6676         return 0;
6677
6678 nla_put_failure:
6679         return -EMSGSIZE;
6680 }
6681
6682 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
6683 {
6684         const struct ieee80211_regdomain *regdom = NULL;
6685         struct cfg80211_registered_device *rdev;
6686         struct wiphy *wiphy = NULL;
6687         struct sk_buff *msg;
6688         void *hdr;
6689
6690         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6691         if (!msg)
6692                 return -ENOBUFS;
6693
6694         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6695                              NL80211_CMD_GET_REG);
6696         if (!hdr)
6697                 goto put_failure;
6698
6699         if (info->attrs[NL80211_ATTR_WIPHY]) {
6700                 bool self_managed;
6701
6702                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
6703                 if (IS_ERR(rdev)) {
6704                         nlmsg_free(msg);
6705                         return PTR_ERR(rdev);
6706                 }
6707
6708                 wiphy = &rdev->wiphy;
6709                 self_managed = wiphy->regulatory_flags &
6710                                REGULATORY_WIPHY_SELF_MANAGED;
6711                 regdom = get_wiphy_regdom(wiphy);
6712
6713                 /* a self-managed-reg device must have a private regdom */
6714                 if (WARN_ON(!regdom && self_managed)) {
6715                         nlmsg_free(msg);
6716                         return -EINVAL;
6717                 }
6718
6719                 if (regdom &&
6720                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6721                         goto nla_put_failure;
6722         }
6723
6724         if (!wiphy && reg_last_request_cell_base() &&
6725             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6726                         NL80211_USER_REG_HINT_CELL_BASE))
6727                 goto nla_put_failure;
6728
6729         rcu_read_lock();
6730
6731         if (!regdom)
6732                 regdom = rcu_dereference(cfg80211_regdomain);
6733
6734         if (nl80211_put_regdom(regdom, msg))
6735                 goto nla_put_failure_rcu;
6736
6737         rcu_read_unlock();
6738
6739         genlmsg_end(msg, hdr);
6740         return genlmsg_reply(msg, info);
6741
6742 nla_put_failure_rcu:
6743         rcu_read_unlock();
6744 nla_put_failure:
6745 put_failure:
6746         nlmsg_free(msg);
6747         return -EMSGSIZE;
6748 }
6749
6750 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
6751                                u32 seq, int flags, struct wiphy *wiphy,
6752                                const struct ieee80211_regdomain *regdom)
6753 {
6754         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6755                                    NL80211_CMD_GET_REG);
6756
6757         if (!hdr)
6758                 return -1;
6759
6760         genl_dump_check_consistent(cb, hdr);
6761
6762         if (nl80211_put_regdom(regdom, msg))
6763                 goto nla_put_failure;
6764
6765         if (!wiphy && reg_last_request_cell_base() &&
6766             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6767                         NL80211_USER_REG_HINT_CELL_BASE))
6768                 goto nla_put_failure;
6769
6770         if (wiphy &&
6771             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6772                 goto nla_put_failure;
6773
6774         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
6775             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
6776                 goto nla_put_failure;
6777
6778         genlmsg_end(msg, hdr);
6779         return 0;
6780
6781 nla_put_failure:
6782         genlmsg_cancel(msg, hdr);
6783         return -EMSGSIZE;
6784 }
6785
6786 static int nl80211_get_reg_dump(struct sk_buff *skb,
6787                                 struct netlink_callback *cb)
6788 {
6789         const struct ieee80211_regdomain *regdom = NULL;
6790         struct cfg80211_registered_device *rdev;
6791         int err, reg_idx, start = cb->args[2];
6792
6793         rtnl_lock();
6794
6795         if (cfg80211_regdomain && start == 0) {
6796                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6797                                           NLM_F_MULTI, NULL,
6798                                           rtnl_dereference(cfg80211_regdomain));
6799                 if (err < 0)
6800                         goto out_err;
6801         }
6802
6803         /* the global regdom is idx 0 */
6804         reg_idx = 1;
6805         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
6806                 regdom = get_wiphy_regdom(&rdev->wiphy);
6807                 if (!regdom)
6808                         continue;
6809
6810                 if (++reg_idx <= start)
6811                         continue;
6812
6813                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6814                                           NLM_F_MULTI, &rdev->wiphy, regdom);
6815                 if (err < 0) {
6816                         reg_idx--;
6817                         break;
6818                 }
6819         }
6820
6821         cb->args[2] = reg_idx;
6822         err = skb->len;
6823 out_err:
6824         rtnl_unlock();
6825         return err;
6826 }
6827
6828 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
6829 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
6830         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
6831         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
6832         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
6833         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
6834         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
6835         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
6836         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
6837 };
6838
6839 static int parse_reg_rule(struct nlattr *tb[],
6840         struct ieee80211_reg_rule *reg_rule)
6841 {
6842         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
6843         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
6844
6845         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
6846                 return -EINVAL;
6847         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
6848                 return -EINVAL;
6849         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
6850                 return -EINVAL;
6851         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
6852                 return -EINVAL;
6853         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
6854                 return -EINVAL;
6855
6856         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
6857
6858         freq_range->start_freq_khz =
6859                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
6860         freq_range->end_freq_khz =
6861                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
6862         freq_range->max_bandwidth_khz =
6863                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
6864
6865         power_rule->max_eirp =
6866                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
6867
6868         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
6869                 power_rule->max_antenna_gain =
6870                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
6871
6872         if (tb[NL80211_ATTR_DFS_CAC_TIME])
6873                 reg_rule->dfs_cac_ms =
6874                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
6875
6876         return 0;
6877 }
6878
6879 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
6880 {
6881         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
6882         struct nlattr *nl_reg_rule;
6883         char *alpha2;
6884         int rem_reg_rules, r;
6885         u32 num_rules = 0, rule_idx = 0, size_of_regd;
6886         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
6887         struct ieee80211_regdomain *rd;
6888
6889         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6890                 return -EINVAL;
6891
6892         if (!info->attrs[NL80211_ATTR_REG_RULES])
6893                 return -EINVAL;
6894
6895         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6896
6897         if (info->attrs[NL80211_ATTR_DFS_REGION])
6898                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
6899
6900         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6901                             rem_reg_rules) {
6902                 num_rules++;
6903                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
6904                         return -EINVAL;
6905         }
6906
6907         if (!reg_is_valid_request(alpha2))
6908                 return -EINVAL;
6909
6910         size_of_regd = sizeof(struct ieee80211_regdomain) +
6911                        num_rules * sizeof(struct ieee80211_reg_rule);
6912
6913         rd = kzalloc(size_of_regd, GFP_KERNEL);
6914         if (!rd)
6915                 return -ENOMEM;
6916
6917         rd->n_reg_rules = num_rules;
6918         rd->alpha2[0] = alpha2[0];
6919         rd->alpha2[1] = alpha2[1];
6920
6921         /*
6922          * Disable DFS master mode if the DFS region was
6923          * not supported or known on this kernel.
6924          */
6925         if (reg_supported_dfs_region(dfs_region))
6926                 rd->dfs_region = dfs_region;
6927
6928         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6929                             rem_reg_rules) {
6930                 r = nla_parse_nested(tb, NL80211_REG_RULE_ATTR_MAX,
6931                                      nl_reg_rule, reg_rule_policy,
6932                                      info->extack);
6933                 if (r)
6934                         goto bad_reg;
6935                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
6936                 if (r)
6937                         goto bad_reg;
6938
6939                 rule_idx++;
6940
6941                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
6942                         r = -EINVAL;
6943                         goto bad_reg;
6944                 }
6945         }
6946
6947         /* set_regdom takes ownership of rd */
6948         return set_regdom(rd, REGD_SOURCE_CRDA);
6949  bad_reg:
6950         kfree(rd);
6951         return r;
6952 }
6953 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
6954
6955 static int validate_scan_freqs(struct nlattr *freqs)
6956 {
6957         struct nlattr *attr1, *attr2;
6958         int n_channels = 0, tmp1, tmp2;
6959
6960         nla_for_each_nested(attr1, freqs, tmp1)
6961                 if (nla_len(attr1) != sizeof(u32))
6962                         return 0;
6963
6964         nla_for_each_nested(attr1, freqs, tmp1) {
6965                 n_channels++;
6966                 /*
6967                  * Some hardware has a limited channel list for
6968                  * scanning, and it is pretty much nonsensical
6969                  * to scan for a channel twice, so disallow that
6970                  * and don't require drivers to check that the
6971                  * channel list they get isn't longer than what
6972                  * they can scan, as long as they can scan all
6973                  * the channels they registered at once.
6974                  */
6975                 nla_for_each_nested(attr2, freqs, tmp2)
6976                         if (attr1 != attr2 &&
6977                             nla_get_u32(attr1) == nla_get_u32(attr2))
6978                                 return 0;
6979         }
6980
6981         return n_channels;
6982 }
6983
6984 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
6985 {
6986         return b < NUM_NL80211_BANDS && wiphy->bands[b];
6987 }
6988
6989 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
6990                             struct cfg80211_bss_selection *bss_select)
6991 {
6992         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
6993         struct nlattr *nest;
6994         int err;
6995         bool found = false;
6996         int i;
6997
6998         /* only process one nested attribute */
6999         nest = nla_data(nla);
7000         if (!nla_ok(nest, nla_len(nest)))
7001                 return -EINVAL;
7002
7003         err = nla_parse_nested(attr, NL80211_BSS_SELECT_ATTR_MAX, nest,
7004                                nl80211_bss_select_policy, NULL);
7005         if (err)
7006                 return err;
7007
7008         /* only one attribute may be given */
7009         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
7010                 if (attr[i]) {
7011                         if (found)
7012                                 return -EINVAL;
7013                         found = true;
7014                 }
7015         }
7016
7017         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
7018
7019         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
7020                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
7021
7022         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
7023                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
7024                 bss_select->param.band_pref =
7025                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
7026                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
7027                         return -EINVAL;
7028         }
7029
7030         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
7031                 struct nl80211_bss_select_rssi_adjust *adj_param;
7032
7033                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
7034                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
7035                 bss_select->param.adjust.band = adj_param->band;
7036                 bss_select->param.adjust.delta = adj_param->delta;
7037                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
7038                         return -EINVAL;
7039         }
7040
7041         /* user-space did not provide behaviour attribute */
7042         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
7043                 return -EINVAL;
7044
7045         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
7046                 return -EINVAL;
7047
7048         return 0;
7049 }
7050
7051 int nl80211_parse_random_mac(struct nlattr **attrs,
7052                              u8 *mac_addr, u8 *mac_addr_mask)
7053 {
7054         int i;
7055
7056         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
7057                 eth_zero_addr(mac_addr);
7058                 eth_zero_addr(mac_addr_mask);
7059                 mac_addr[0] = 0x2;
7060                 mac_addr_mask[0] = 0x3;
7061
7062                 return 0;
7063         }
7064
7065         /* need both or none */
7066         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
7067                 return -EINVAL;
7068
7069         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
7070         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
7071
7072         /* don't allow or configure an mcast address */
7073         if (!is_multicast_ether_addr(mac_addr_mask) ||
7074             is_multicast_ether_addr(mac_addr))
7075                 return -EINVAL;
7076
7077         /*
7078          * allow users to pass a MAC address that has bits set outside
7079          * of the mask, but don't bother drivers with having to deal
7080          * with such bits
7081          */
7082         for (i = 0; i < ETH_ALEN; i++)
7083                 mac_addr[i] &= mac_addr_mask[i];
7084
7085         return 0;
7086 }
7087
7088 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev)
7089 {
7090         ASSERT_WDEV_LOCK(wdev);
7091
7092         if (!cfg80211_beaconing_iface_active(wdev))
7093                 return true;
7094
7095         if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR))
7096                 return true;
7097
7098         return regulatory_pre_cac_allowed(wdev->wiphy);
7099 }
7100
7101 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
7102                                     enum nl80211_ext_feature_index feat)
7103 {
7104         if (!(flags & flag))
7105                 return true;
7106         if (wiphy_ext_feature_isset(wiphy, feat))
7107                 return true;
7108         return false;
7109 }
7110
7111 static int
7112 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
7113                          void *request, struct nlattr **attrs,
7114                          bool is_sched_scan)
7115 {
7116         u8 *mac_addr, *mac_addr_mask;
7117         u32 *flags;
7118         enum nl80211_feature_flags randomness_flag;
7119
7120         if (!attrs[NL80211_ATTR_SCAN_FLAGS])
7121                 return 0;
7122
7123         if (is_sched_scan) {
7124                 struct cfg80211_sched_scan_request *req = request;
7125
7126                 randomness_flag = wdev ?
7127                                   NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
7128                                   NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
7129                 flags = &req->flags;
7130                 mac_addr = req->mac_addr;
7131                 mac_addr_mask = req->mac_addr_mask;
7132         } else {
7133                 struct cfg80211_scan_request *req = request;
7134
7135                 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
7136                 flags = &req->flags;
7137                 mac_addr = req->mac_addr;
7138                 mac_addr_mask = req->mac_addr_mask;
7139         }
7140
7141         *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
7142
7143         if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
7144              !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
7145             !nl80211_check_scan_feat(wiphy, *flags,
7146                                      NL80211_SCAN_FLAG_LOW_SPAN,
7147                                      NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
7148             !nl80211_check_scan_feat(wiphy, *flags,
7149                                      NL80211_SCAN_FLAG_LOW_POWER,
7150                                      NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
7151             !nl80211_check_scan_feat(wiphy, *flags,
7152                                      NL80211_SCAN_FLAG_HIGH_ACCURACY,
7153                                      NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
7154             !nl80211_check_scan_feat(wiphy, *flags,
7155                                      NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
7156                                      NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
7157             !nl80211_check_scan_feat(wiphy, *flags,
7158                                      NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
7159                                      NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
7160             !nl80211_check_scan_feat(wiphy, *flags,
7161                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
7162                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
7163             !nl80211_check_scan_feat(wiphy, *flags,
7164                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
7165                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
7166             !nl80211_check_scan_feat(wiphy, *flags,
7167                                      NL80211_SCAN_FLAG_RANDOM_SN,
7168                                      NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
7169             !nl80211_check_scan_feat(wiphy, *flags,
7170                                      NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
7171                                      NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
7172                 return -EOPNOTSUPP;
7173
7174         if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
7175                 int err;
7176
7177                 if (!(wiphy->features & randomness_flag) ||
7178                     (wdev && wdev->current_bss))
7179                         return -EOPNOTSUPP;
7180
7181                 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
7182                 if (err)
7183                         return err;
7184         }
7185
7186         return 0;
7187 }
7188
7189 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
7190 {
7191         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7192         struct wireless_dev *wdev = info->user_ptr[1];
7193         struct cfg80211_scan_request *request;
7194         struct nlattr *attr;
7195         struct wiphy *wiphy;
7196         int err, tmp, n_ssids = 0, n_channels, i;
7197         size_t ie_len;
7198
7199         wiphy = &rdev->wiphy;
7200
7201         if (wdev->iftype == NL80211_IFTYPE_NAN)
7202                 return -EOPNOTSUPP;
7203
7204         if (!rdev->ops->scan)
7205                 return -EOPNOTSUPP;
7206
7207         if (rdev->scan_req || rdev->scan_msg) {
7208                 err = -EBUSY;
7209                 goto unlock;
7210         }
7211
7212         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7213                 n_channels = validate_scan_freqs(
7214                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7215                 if (!n_channels) {
7216                         err = -EINVAL;
7217                         goto unlock;
7218                 }
7219         } else {
7220                 n_channels = ieee80211_get_num_supported_channels(wiphy);
7221         }
7222
7223         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
7224                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
7225                         n_ssids++;
7226
7227         if (n_ssids > wiphy->max_scan_ssids) {
7228                 err = -EINVAL;
7229                 goto unlock;
7230         }
7231
7232         if (info->attrs[NL80211_ATTR_IE])
7233                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7234         else
7235                 ie_len = 0;
7236
7237         if (ie_len > wiphy->max_scan_ie_len) {
7238                 err = -EINVAL;
7239                 goto unlock;
7240         }
7241
7242         request = kzalloc(sizeof(*request)
7243                         + sizeof(*request->ssids) * n_ssids
7244                         + sizeof(*request->channels) * n_channels
7245                         + ie_len, GFP_KERNEL);
7246         if (!request) {
7247                 err = -ENOMEM;
7248                 goto unlock;
7249         }
7250
7251         if (n_ssids)
7252                 request->ssids = (void *)&request->channels[n_channels];
7253         request->n_ssids = n_ssids;
7254         if (ie_len) {
7255                 if (n_ssids)
7256                         request->ie = (void *)(request->ssids + n_ssids);
7257                 else
7258                         request->ie = (void *)(request->channels + n_channels);
7259         }
7260
7261         i = 0;
7262         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7263                 /* user specified, bail out if channel not found */
7264                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
7265                         struct ieee80211_channel *chan;
7266
7267                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7268
7269                         if (!chan) {
7270                                 err = -EINVAL;
7271                                 goto out_free;
7272                         }
7273
7274                         /* ignore disabled channels */
7275                         if (chan->flags & IEEE80211_CHAN_DISABLED)
7276                                 continue;
7277
7278                         request->channels[i] = chan;
7279                         i++;
7280                 }
7281         } else {
7282                 enum nl80211_band band;
7283
7284                 /* all channels */
7285                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7286                         int j;
7287
7288                         if (!wiphy->bands[band])
7289                                 continue;
7290                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7291                                 struct ieee80211_channel *chan;
7292
7293                                 chan = &wiphy->bands[band]->channels[j];
7294
7295                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
7296                                         continue;
7297
7298                                 request->channels[i] = chan;
7299                                 i++;
7300                         }
7301                 }
7302         }
7303
7304         if (!i) {
7305                 err = -EINVAL;
7306                 goto out_free;
7307         }
7308
7309         request->n_channels = i;
7310
7311         wdev_lock(wdev);
7312         if (!cfg80211_off_channel_oper_allowed(wdev)) {
7313                 struct ieee80211_channel *chan;
7314
7315                 if (request->n_channels != 1) {
7316                         wdev_unlock(wdev);
7317                         err = -EBUSY;
7318                         goto out_free;
7319                 }
7320
7321                 chan = request->channels[0];
7322                 if (chan->center_freq != wdev->chandef.chan->center_freq) {
7323                         wdev_unlock(wdev);
7324                         err = -EBUSY;
7325                         goto out_free;
7326                 }
7327         }
7328         wdev_unlock(wdev);
7329
7330         i = 0;
7331         if (n_ssids) {
7332                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
7333                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7334                                 err = -EINVAL;
7335                                 goto out_free;
7336                         }
7337                         request->ssids[i].ssid_len = nla_len(attr);
7338                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
7339                         i++;
7340                 }
7341         }
7342
7343         if (info->attrs[NL80211_ATTR_IE]) {
7344                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7345                 memcpy((void *)request->ie,
7346                        nla_data(info->attrs[NL80211_ATTR_IE]),
7347                        request->ie_len);
7348         }
7349
7350         for (i = 0; i < NUM_NL80211_BANDS; i++)
7351                 if (wiphy->bands[i])
7352                         request->rates[i] =
7353                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
7354
7355         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
7356                 nla_for_each_nested(attr,
7357                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
7358                                     tmp) {
7359                         enum nl80211_band band = nla_type(attr);
7360
7361                         if (band < 0 || band >= NUM_NL80211_BANDS) {
7362                                 err = -EINVAL;
7363                                 goto out_free;
7364                         }
7365
7366                         if (!wiphy->bands[band])
7367                                 continue;
7368
7369                         err = ieee80211_get_ratemask(wiphy->bands[band],
7370                                                      nla_data(attr),
7371                                                      nla_len(attr),
7372                                                      &request->rates[band]);
7373                         if (err)
7374                                 goto out_free;
7375                 }
7376         }
7377
7378         if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
7379                 if (!wiphy_ext_feature_isset(wiphy,
7380                                         NL80211_EXT_FEATURE_SET_SCAN_DWELL)) {
7381                         err = -EOPNOTSUPP;
7382                         goto out_free;
7383                 }
7384
7385                 request->duration =
7386                         nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
7387                 request->duration_mandatory =
7388                         nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
7389         }
7390
7391         err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
7392                                        false);
7393         if (err)
7394                 goto out_free;
7395
7396         request->no_cck =
7397                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7398
7399         /* Initial implementation used NL80211_ATTR_MAC to set the specific
7400          * BSSID to scan for. This was problematic because that same attribute
7401          * was already used for another purpose (local random MAC address). The
7402          * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
7403          * compatibility with older userspace components, also use the
7404          * NL80211_ATTR_MAC value here if it can be determined to be used for
7405          * the specific BSSID use case instead of the random MAC address
7406          * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
7407          */
7408         if (info->attrs[NL80211_ATTR_BSSID])
7409                 memcpy(request->bssid,
7410                        nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
7411         else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
7412                  info->attrs[NL80211_ATTR_MAC])
7413                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
7414                        ETH_ALEN);
7415         else
7416                 eth_broadcast_addr(request->bssid);
7417
7418         request->wdev = wdev;
7419         request->wiphy = &rdev->wiphy;
7420         request->scan_start = jiffies;
7421
7422         rdev->scan_req = request;
7423         err = rdev_scan(rdev, request);
7424
7425         if (!err) {
7426                 nl80211_send_scan_start(rdev, wdev);
7427                 if (wdev->netdev)
7428                         dev_hold(wdev->netdev);
7429         } else {
7430  out_free:
7431                 rdev->scan_req = NULL;
7432                 kfree(request);
7433         }
7434
7435  unlock:
7436         return err;
7437 }
7438
7439 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
7440 {
7441         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7442         struct wireless_dev *wdev = info->user_ptr[1];
7443
7444         if (!rdev->ops->abort_scan)
7445                 return -EOPNOTSUPP;
7446
7447         if (rdev->scan_msg)
7448                 return 0;
7449
7450         if (!rdev->scan_req)
7451                 return -ENOENT;
7452
7453         rdev_abort_scan(rdev, wdev);
7454         return 0;
7455 }
7456
7457 static int
7458 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
7459                                struct cfg80211_sched_scan_request *request,
7460                                struct nlattr **attrs)
7461 {
7462         int tmp, err, i = 0;
7463         struct nlattr *attr;
7464
7465         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7466                 u32 interval;
7467
7468                 /*
7469                  * If scan plans are not specified,
7470                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
7471                  * case one scan plan will be set with the specified scan
7472                  * interval and infinite number of iterations.
7473                  */
7474                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
7475                 if (!interval)
7476                         return -EINVAL;
7477
7478                 request->scan_plans[0].interval =
7479                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
7480                 if (!request->scan_plans[0].interval)
7481                         return -EINVAL;
7482
7483                 if (request->scan_plans[0].interval >
7484                     wiphy->max_sched_scan_plan_interval)
7485                         request->scan_plans[0].interval =
7486                                 wiphy->max_sched_scan_plan_interval;
7487
7488                 return 0;
7489         }
7490
7491         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
7492                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
7493
7494                 if (WARN_ON(i >= n_plans))
7495                         return -EINVAL;
7496
7497                 err = nla_parse_nested(plan, NL80211_SCHED_SCAN_PLAN_MAX,
7498                                        attr, nl80211_plan_policy, NULL);
7499                 if (err)
7500                         return err;
7501
7502                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
7503                         return -EINVAL;
7504
7505                 request->scan_plans[i].interval =
7506                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
7507                 if (!request->scan_plans[i].interval ||
7508                     request->scan_plans[i].interval >
7509                     wiphy->max_sched_scan_plan_interval)
7510                         return -EINVAL;
7511
7512                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
7513                         request->scan_plans[i].iterations =
7514                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
7515                         if (!request->scan_plans[i].iterations ||
7516                             (request->scan_plans[i].iterations >
7517                              wiphy->max_sched_scan_plan_iterations))
7518                                 return -EINVAL;
7519                 } else if (i < n_plans - 1) {
7520                         /*
7521                          * All scan plans but the last one must specify
7522                          * a finite number of iterations
7523                          */
7524                         return -EINVAL;
7525                 }
7526
7527                 i++;
7528         }
7529
7530         /*
7531          * The last scan plan must not specify the number of
7532          * iterations, it is supposed to run infinitely
7533          */
7534         if (request->scan_plans[n_plans - 1].iterations)
7535                 return  -EINVAL;
7536
7537         return 0;
7538 }
7539
7540 static struct cfg80211_sched_scan_request *
7541 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
7542                          struct nlattr **attrs, int max_match_sets)
7543 {
7544         struct cfg80211_sched_scan_request *request;
7545         struct nlattr *attr;
7546         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
7547         enum nl80211_band band;
7548         size_t ie_len;
7549         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
7550         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
7551
7552         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7553                 n_channels = validate_scan_freqs(
7554                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7555                 if (!n_channels)
7556                         return ERR_PTR(-EINVAL);
7557         } else {
7558                 n_channels = ieee80211_get_num_supported_channels(wiphy);
7559         }
7560
7561         if (attrs[NL80211_ATTR_SCAN_SSIDS])
7562                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7563                                     tmp)
7564                         n_ssids++;
7565
7566         if (n_ssids > wiphy->max_sched_scan_ssids)
7567                 return ERR_PTR(-EINVAL);
7568
7569         /*
7570          * First, count the number of 'real' matchsets. Due to an issue with
7571          * the old implementation, matchsets containing only the RSSI attribute
7572          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
7573          * RSSI for all matchsets, rather than their own matchset for reporting
7574          * all APs with a strong RSSI. This is needed to be compatible with
7575          * older userspace that treated a matchset with only the RSSI as the
7576          * global RSSI for all other matchsets - if there are other matchsets.
7577          */
7578         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7579                 nla_for_each_nested(attr,
7580                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7581                                     tmp) {
7582                         struct nlattr *rssi;
7583
7584                         err = nla_parse_nested(tb,
7585                                                NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7586                                                attr, nl80211_match_policy,
7587                                                NULL);
7588                         if (err)
7589                                 return ERR_PTR(err);
7590
7591                         /* SSID and BSSID are mutually exclusive */
7592                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
7593                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
7594                                 return ERR_PTR(-EINVAL);
7595
7596                         /* add other standalone attributes here */
7597                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
7598                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
7599                                 n_match_sets++;
7600                                 continue;
7601                         }
7602                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7603                         if (rssi)
7604                                 default_match_rssi = nla_get_s32(rssi);
7605                 }
7606         }
7607
7608         /* However, if there's no other matchset, add the RSSI one */
7609         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
7610                 n_match_sets = 1;
7611
7612         if (n_match_sets > max_match_sets)
7613                 return ERR_PTR(-EINVAL);
7614
7615         if (attrs[NL80211_ATTR_IE])
7616                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
7617         else
7618                 ie_len = 0;
7619
7620         if (ie_len > wiphy->max_sched_scan_ie_len)
7621                 return ERR_PTR(-EINVAL);
7622
7623         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7624                 /*
7625                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
7626                  * each scan plan already specifies its own interval
7627                  */
7628                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7629                         return ERR_PTR(-EINVAL);
7630
7631                 nla_for_each_nested(attr,
7632                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
7633                         n_plans++;
7634         } else {
7635                 /*
7636                  * The scan interval attribute is kept for backward
7637                  * compatibility. If no scan plans are specified and sched scan
7638                  * interval is specified, one scan plan will be set with this
7639                  * scan interval and infinite number of iterations.
7640                  */
7641                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7642                         return ERR_PTR(-EINVAL);
7643
7644                 n_plans = 1;
7645         }
7646
7647         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
7648                 return ERR_PTR(-EINVAL);
7649
7650         if (!wiphy_ext_feature_isset(
7651                     wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
7652             (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
7653              attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
7654                 return ERR_PTR(-EINVAL);
7655
7656         request = kzalloc(sizeof(*request)
7657                         + sizeof(*request->ssids) * n_ssids
7658                         + sizeof(*request->match_sets) * n_match_sets
7659                         + sizeof(*request->scan_plans) * n_plans
7660                         + sizeof(*request->channels) * n_channels
7661                         + ie_len, GFP_KERNEL);
7662         if (!request)
7663                 return ERR_PTR(-ENOMEM);
7664
7665         if (n_ssids)
7666                 request->ssids = (void *)&request->channels[n_channels];
7667         request->n_ssids = n_ssids;
7668         if (ie_len) {
7669                 if (n_ssids)
7670                         request->ie = (void *)(request->ssids + n_ssids);
7671                 else
7672                         request->ie = (void *)(request->channels + n_channels);
7673         }
7674
7675         if (n_match_sets) {
7676                 if (request->ie)
7677                         request->match_sets = (void *)(request->ie + ie_len);
7678                 else if (n_ssids)
7679                         request->match_sets =
7680                                 (void *)(request->ssids + n_ssids);
7681                 else
7682                         request->match_sets =
7683                                 (void *)(request->channels + n_channels);
7684         }
7685         request->n_match_sets = n_match_sets;
7686
7687         if (n_match_sets)
7688                 request->scan_plans = (void *)(request->match_sets +
7689                                                n_match_sets);
7690         else if (request->ie)
7691                 request->scan_plans = (void *)(request->ie + ie_len);
7692         else if (n_ssids)
7693                 request->scan_plans = (void *)(request->ssids + n_ssids);
7694         else
7695                 request->scan_plans = (void *)(request->channels + n_channels);
7696
7697         request->n_scan_plans = n_plans;
7698
7699         i = 0;
7700         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7701                 /* user specified, bail out if channel not found */
7702                 nla_for_each_nested(attr,
7703                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
7704                                     tmp) {
7705                         struct ieee80211_channel *chan;
7706
7707                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7708
7709                         if (!chan) {
7710                                 err = -EINVAL;
7711                                 goto out_free;
7712                         }
7713
7714                         /* ignore disabled channels */
7715                         if (chan->flags & IEEE80211_CHAN_DISABLED)
7716                                 continue;
7717
7718                         request->channels[i] = chan;
7719                         i++;
7720                 }
7721         } else {
7722                 /* all channels */
7723                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7724                         int j;
7725
7726                         if (!wiphy->bands[band])
7727                                 continue;
7728                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7729                                 struct ieee80211_channel *chan;
7730
7731                                 chan = &wiphy->bands[band]->channels[j];
7732
7733                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
7734                                         continue;
7735
7736                                 request->channels[i] = chan;
7737                                 i++;
7738                         }
7739                 }
7740         }
7741
7742         if (!i) {
7743                 err = -EINVAL;
7744                 goto out_free;
7745         }
7746
7747         request->n_channels = i;
7748
7749         i = 0;
7750         if (n_ssids) {
7751                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7752                                     tmp) {
7753                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7754                                 err = -EINVAL;
7755                                 goto out_free;
7756                         }
7757                         request->ssids[i].ssid_len = nla_len(attr);
7758                         memcpy(request->ssids[i].ssid, nla_data(attr),
7759                                nla_len(attr));
7760                         i++;
7761                 }
7762         }
7763
7764         i = 0;
7765         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7766                 nla_for_each_nested(attr,
7767                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7768                                     tmp) {
7769                         struct nlattr *ssid, *bssid, *rssi;
7770
7771                         err = nla_parse_nested(tb,
7772                                                NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7773                                                attr, nl80211_match_policy,
7774                                                NULL);
7775                         if (err)
7776                                 goto out_free;
7777                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
7778                         bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
7779                         if (ssid || bssid) {
7780                                 if (WARN_ON(i >= n_match_sets)) {
7781                                         /* this indicates a programming error,
7782                                          * the loop above should have verified
7783                                          * things properly
7784                                          */
7785                                         err = -EINVAL;
7786                                         goto out_free;
7787                                 }
7788
7789                                 if (ssid) {
7790                                         if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
7791                                                 err = -EINVAL;
7792                                                 goto out_free;
7793                                         }
7794                                         memcpy(request->match_sets[i].ssid.ssid,
7795                                                nla_data(ssid), nla_len(ssid));
7796                                         request->match_sets[i].ssid.ssid_len =
7797                                                 nla_len(ssid);
7798                                 }
7799                                 if (bssid) {
7800                                         if (nla_len(bssid) != ETH_ALEN) {
7801                                                 err = -EINVAL;
7802                                                 goto out_free;
7803                                         }
7804                                         memcpy(request->match_sets[i].bssid,
7805                                                nla_data(bssid), ETH_ALEN);
7806                                 }
7807
7808                                 /* special attribute - old implementation w/a */
7809                                 request->match_sets[i].rssi_thold =
7810                                         default_match_rssi;
7811                                 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7812                                 if (rssi)
7813                                         request->match_sets[i].rssi_thold =
7814                                                 nla_get_s32(rssi);
7815                         }
7816                         i++;
7817                 }
7818
7819                 /* there was no other matchset, so the RSSI one is alone */
7820                 if (i == 0 && n_match_sets)
7821                         request->match_sets[0].rssi_thold = default_match_rssi;
7822
7823                 request->min_rssi_thold = INT_MAX;
7824                 for (i = 0; i < n_match_sets; i++)
7825                         request->min_rssi_thold =
7826                                 min(request->match_sets[i].rssi_thold,
7827                                     request->min_rssi_thold);
7828         } else {
7829                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
7830         }
7831
7832         if (ie_len) {
7833                 request->ie_len = ie_len;
7834                 memcpy((void *)request->ie,
7835                        nla_data(attrs[NL80211_ATTR_IE]),
7836                        request->ie_len);
7837         }
7838
7839         err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
7840         if (err)
7841                 goto out_free;
7842
7843         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
7844                 request->delay =
7845                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
7846
7847         if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
7848                 request->relative_rssi = nla_get_s8(
7849                         attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
7850                 request->relative_rssi_set = true;
7851         }
7852
7853         if (request->relative_rssi_set &&
7854             attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
7855                 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
7856
7857                 rssi_adjust = nla_data(
7858                         attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
7859                 request->rssi_adjust.band = rssi_adjust->band;
7860                 request->rssi_adjust.delta = rssi_adjust->delta;
7861                 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
7862                         err = -EINVAL;
7863                         goto out_free;
7864                 }
7865         }
7866
7867         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
7868         if (err)
7869                 goto out_free;
7870
7871         request->scan_start = jiffies;
7872
7873         return request;
7874
7875 out_free:
7876         kfree(request);
7877         return ERR_PTR(err);
7878 }
7879
7880 static int nl80211_start_sched_scan(struct sk_buff *skb,
7881                                     struct genl_info *info)
7882 {
7883         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7884         struct net_device *dev = info->user_ptr[1];
7885         struct wireless_dev *wdev = dev->ieee80211_ptr;
7886         struct cfg80211_sched_scan_request *sched_scan_req;
7887         bool want_multi;
7888         int err;
7889
7890         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
7891                 return -EOPNOTSUPP;
7892
7893         want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
7894         err = cfg80211_sched_scan_req_possible(rdev, want_multi);
7895         if (err)
7896                 return err;
7897
7898         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
7899                                                   info->attrs,
7900                                                   rdev->wiphy.max_match_sets);
7901
7902         err = PTR_ERR_OR_ZERO(sched_scan_req);
7903         if (err)
7904                 goto out_err;
7905
7906         /* leave request id zero for legacy request
7907          * or if driver does not support multi-scheduled scan
7908          */
7909         if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1) {
7910                 while (!sched_scan_req->reqid)
7911                         sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
7912         }
7913
7914         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
7915         if (err)
7916                 goto out_free;
7917
7918         sched_scan_req->dev = dev;
7919         sched_scan_req->wiphy = &rdev->wiphy;
7920
7921         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
7922                 sched_scan_req->owner_nlportid = info->snd_portid;
7923
7924         cfg80211_add_sched_scan_req(rdev, sched_scan_req);
7925
7926         nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
7927         return 0;
7928
7929 out_free:
7930         kfree(sched_scan_req);
7931 out_err:
7932         return err;
7933 }
7934
7935 static int nl80211_stop_sched_scan(struct sk_buff *skb,
7936                                    struct genl_info *info)
7937 {
7938         struct cfg80211_sched_scan_request *req;
7939         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7940         u64 cookie;
7941
7942         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
7943                 return -EOPNOTSUPP;
7944
7945         if (info->attrs[NL80211_ATTR_COOKIE]) {
7946                 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7947                 return __cfg80211_stop_sched_scan(rdev, cookie, false);
7948         }
7949
7950         req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
7951                                      struct cfg80211_sched_scan_request,
7952                                      list);
7953         if (!req || req->reqid ||
7954             (req->owner_nlportid &&
7955              req->owner_nlportid != info->snd_portid))
7956                 return -ENOENT;
7957
7958         return cfg80211_stop_sched_scan_req(rdev, req, false);
7959 }
7960
7961 static int nl80211_start_radar_detection(struct sk_buff *skb,
7962                                          struct genl_info *info)
7963 {
7964         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7965         struct net_device *dev = info->user_ptr[1];
7966         struct wireless_dev *wdev = dev->ieee80211_ptr;
7967         struct wiphy *wiphy = wdev->wiphy;
7968         struct cfg80211_chan_def chandef;
7969         enum nl80211_dfs_regions dfs_region;
7970         unsigned int cac_time_ms;
7971         int err;
7972
7973         dfs_region = reg_get_dfs_region(wiphy);
7974         if (dfs_region == NL80211_DFS_UNSET)
7975                 return -EINVAL;
7976
7977         err = nl80211_parse_chandef(rdev, info, &chandef);
7978         if (err)
7979                 return err;
7980
7981         if (netif_carrier_ok(dev))
7982                 return -EBUSY;
7983
7984         if (wdev->cac_started)
7985                 return -EBUSY;
7986
7987         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
7988         if (err < 0)
7989                 return err;
7990
7991         if (err == 0)
7992                 return -EINVAL;
7993
7994         if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
7995                 return -EINVAL;
7996
7997         /* CAC start is offloaded to HW and can't be started manually */
7998         if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
7999                 return -EOPNOTSUPP;
8000
8001         if (!rdev->ops->start_radar_detection)
8002                 return -EOPNOTSUPP;
8003
8004         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
8005         if (WARN_ON(!cac_time_ms))
8006                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
8007
8008         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
8009         if (!err) {
8010                 wdev->chandef = chandef;
8011                 wdev->cac_started = true;
8012                 wdev->cac_start_time = jiffies;
8013                 wdev->cac_time_ms = cac_time_ms;
8014         }
8015         return err;
8016 }
8017
8018 static int nl80211_notify_radar_detection(struct sk_buff *skb,
8019                                           struct genl_info *info)
8020 {
8021         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8022         struct net_device *dev = info->user_ptr[1];
8023         struct wireless_dev *wdev = dev->ieee80211_ptr;
8024         struct wiphy *wiphy = wdev->wiphy;
8025         struct cfg80211_chan_def chandef;
8026         enum nl80211_dfs_regions dfs_region;
8027         int err;
8028
8029         dfs_region = reg_get_dfs_region(wiphy);
8030         if (dfs_region == NL80211_DFS_UNSET) {
8031                 GENL_SET_ERR_MSG(info,
8032                                  "DFS Region is not set. Unexpected Radar indication");
8033                 return -EINVAL;
8034         }
8035
8036         err = nl80211_parse_chandef(rdev, info, &chandef);
8037         if (err) {
8038                 GENL_SET_ERR_MSG(info, "Unable to extract chandef info");
8039                 return err;
8040         }
8041
8042         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
8043         if (err < 0) {
8044                 GENL_SET_ERR_MSG(info, "chandef is invalid");
8045                 return err;
8046         }
8047
8048         if (err == 0) {
8049                 GENL_SET_ERR_MSG(info,
8050                                  "Unexpected Radar indication for chandef/iftype");
8051                 return -EINVAL;
8052         }
8053
8054         /* Do not process this notification if radar is already detected
8055          * by kernel on this channel, and return success.
8056          */
8057         if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE)
8058                 return 0;
8059
8060         cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE);
8061
8062         cfg80211_sched_dfs_chan_update(rdev);
8063
8064         memcpy(&rdev->radar_chandef, &chandef, sizeof(chandef));
8065
8066         /* Propagate this notification to other radios as well */
8067         queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
8068
8069         return 0;
8070 }
8071
8072 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
8073 {
8074         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8075         struct net_device *dev = info->user_ptr[1];
8076         struct wireless_dev *wdev = dev->ieee80211_ptr;
8077         struct cfg80211_csa_settings params;
8078         /* csa_attrs is defined static to avoid waste of stack size - this
8079          * function is called under RTNL lock, so this should not be a problem.
8080          */
8081         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
8082         int err;
8083         bool need_new_beacon = false;
8084         bool need_handle_dfs_flag = true;
8085         int len, i;
8086         u32 cs_count;
8087
8088         if (!rdev->ops->channel_switch ||
8089             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
8090                 return -EOPNOTSUPP;
8091
8092         switch (dev->ieee80211_ptr->iftype) {
8093         case NL80211_IFTYPE_AP:
8094         case NL80211_IFTYPE_P2P_GO:
8095                 need_new_beacon = true;
8096                 /* For all modes except AP the handle_dfs flag needs to be
8097                  * supplied to tell the kernel that userspace will handle radar
8098                  * events when they happen. Otherwise a switch to a channel
8099                  * requiring DFS will be rejected.
8100                  */
8101                 need_handle_dfs_flag = false;
8102
8103                 /* useless if AP is not running */
8104                 if (!wdev->beacon_interval)
8105                         return -ENOTCONN;
8106                 break;
8107         case NL80211_IFTYPE_ADHOC:
8108                 if (!wdev->ssid_len)
8109                         return -ENOTCONN;
8110                 break;
8111         case NL80211_IFTYPE_MESH_POINT:
8112                 if (!wdev->mesh_id_len)
8113                         return -ENOTCONN;
8114                 break;
8115         default:
8116                 return -EOPNOTSUPP;
8117         }
8118
8119         memset(&params, 0, sizeof(params));
8120         params.beacon_csa.ftm_responder = -1;
8121
8122         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
8123             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
8124                 return -EINVAL;
8125
8126         /* only important for AP, IBSS and mesh create IEs internally */
8127         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
8128                 return -EINVAL;
8129
8130         /* Even though the attribute is u32, the specification says
8131          * u8, so let's make sure we don't overflow.
8132          */
8133         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
8134         if (cs_count > 255)
8135                 return -EINVAL;
8136
8137         params.count = cs_count;
8138
8139         if (!need_new_beacon)
8140                 goto skip_beacons;
8141
8142         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_after);
8143         if (err)
8144                 return err;
8145
8146         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
8147                                info->attrs[NL80211_ATTR_CSA_IES],
8148                                nl80211_policy, info->extack);
8149         if (err)
8150                 return err;
8151
8152         err = nl80211_parse_beacon(rdev, csa_attrs, &params.beacon_csa);
8153         if (err)
8154                 return err;
8155
8156         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
8157                 return -EINVAL;
8158
8159         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
8160         if (!len || (len % sizeof(u16)))
8161                 return -EINVAL;
8162
8163         params.n_counter_offsets_beacon = len / sizeof(u16);
8164         if (rdev->wiphy.max_num_csa_counters &&
8165             (params.n_counter_offsets_beacon >
8166              rdev->wiphy.max_num_csa_counters))
8167                 return -EINVAL;
8168
8169         params.counter_offsets_beacon =
8170                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
8171
8172         /* sanity checks - counters should fit and be the same */
8173         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
8174                 u16 offset = params.counter_offsets_beacon[i];
8175
8176                 if (offset >= params.beacon_csa.tail_len)
8177                         return -EINVAL;
8178
8179                 if (params.beacon_csa.tail[offset] != params.count)
8180                         return -EINVAL;
8181         }
8182
8183         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
8184                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
8185                 if (!len || (len % sizeof(u16)))
8186                         return -EINVAL;
8187
8188                 params.n_counter_offsets_presp = len / sizeof(u16);
8189                 if (rdev->wiphy.max_num_csa_counters &&
8190                     (params.n_counter_offsets_presp >
8191                      rdev->wiphy.max_num_csa_counters))
8192                         return -EINVAL;
8193
8194                 params.counter_offsets_presp =
8195                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
8196
8197                 /* sanity checks - counters should fit and be the same */
8198                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
8199                         u16 offset = params.counter_offsets_presp[i];
8200
8201                         if (offset >= params.beacon_csa.probe_resp_len)
8202                                 return -EINVAL;
8203
8204                         if (params.beacon_csa.probe_resp[offset] !=
8205                             params.count)
8206                                 return -EINVAL;
8207                 }
8208         }
8209
8210 skip_beacons:
8211         err = nl80211_parse_chandef(rdev, info, &params.chandef);
8212         if (err)
8213                 return err;
8214
8215         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
8216                                            wdev->iftype))
8217                 return -EINVAL;
8218
8219         err = cfg80211_chandef_dfs_required(wdev->wiphy,
8220                                             &params.chandef,
8221                                             wdev->iftype);
8222         if (err < 0)
8223                 return err;
8224
8225         if (err > 0) {
8226                 params.radar_required = true;
8227                 if (need_handle_dfs_flag &&
8228                     !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
8229                         return -EINVAL;
8230                 }
8231         }
8232
8233         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
8234                 params.block_tx = true;
8235
8236         wdev_lock(wdev);
8237         err = rdev_channel_switch(rdev, dev, &params);
8238         wdev_unlock(wdev);
8239
8240         return err;
8241 }
8242
8243 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
8244                             u32 seq, int flags,
8245                             struct cfg80211_registered_device *rdev,
8246                             struct wireless_dev *wdev,
8247                             struct cfg80211_internal_bss *intbss)
8248 {
8249         struct cfg80211_bss *res = &intbss->pub;
8250         const struct cfg80211_bss_ies *ies;
8251         void *hdr;
8252         struct nlattr *bss;
8253
8254         ASSERT_WDEV_LOCK(wdev);
8255
8256         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
8257                              NL80211_CMD_NEW_SCAN_RESULTS);
8258         if (!hdr)
8259                 return -1;
8260
8261         genl_dump_check_consistent(cb, hdr);
8262
8263         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
8264                 goto nla_put_failure;
8265         if (wdev->netdev &&
8266             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
8267                 goto nla_put_failure;
8268         if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
8269                               NL80211_ATTR_PAD))
8270                 goto nla_put_failure;
8271
8272         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
8273         if (!bss)
8274                 goto nla_put_failure;
8275         if ((!is_zero_ether_addr(res->bssid) &&
8276              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
8277                 goto nla_put_failure;
8278
8279         rcu_read_lock();
8280         /* indicate whether we have probe response data or not */
8281         if (rcu_access_pointer(res->proberesp_ies) &&
8282             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
8283                 goto fail_unlock_rcu;
8284
8285         /* this pointer prefers to be pointed to probe response data
8286          * but is always valid
8287          */
8288         ies = rcu_dereference(res->ies);
8289         if (ies) {
8290                 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
8291                                       NL80211_BSS_PAD))
8292                         goto fail_unlock_rcu;
8293                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
8294                                         ies->len, ies->data))
8295                         goto fail_unlock_rcu;
8296         }
8297
8298         /* and this pointer is always (unless driver didn't know) beacon data */
8299         ies = rcu_dereference(res->beacon_ies);
8300         if (ies && ies->from_beacon) {
8301                 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
8302                                       NL80211_BSS_PAD))
8303                         goto fail_unlock_rcu;
8304                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
8305                                         ies->len, ies->data))
8306                         goto fail_unlock_rcu;
8307         }
8308         rcu_read_unlock();
8309
8310         if (res->beacon_interval &&
8311             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
8312                 goto nla_put_failure;
8313         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
8314             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
8315             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
8316             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
8317                         jiffies_to_msecs(jiffies - intbss->ts)))
8318                 goto nla_put_failure;
8319
8320         if (intbss->parent_tsf &&
8321             (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
8322                                intbss->parent_tsf, NL80211_BSS_PAD) ||
8323              nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
8324                      intbss->parent_bssid)))
8325                 goto nla_put_failure;
8326
8327         if (intbss->ts_boottime &&
8328             nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
8329                               intbss->ts_boottime, NL80211_BSS_PAD))
8330                 goto nla_put_failure;
8331
8332         if (!nl80211_put_signal(msg, intbss->pub.chains,
8333                                 intbss->pub.chain_signal,
8334                                 NL80211_BSS_CHAIN_SIGNAL))
8335                 goto nla_put_failure;
8336
8337         switch (rdev->wiphy.signal_type) {
8338         case CFG80211_SIGNAL_TYPE_MBM:
8339                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
8340                         goto nla_put_failure;
8341                 break;
8342         case CFG80211_SIGNAL_TYPE_UNSPEC:
8343                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
8344                         goto nla_put_failure;
8345                 break;
8346         default:
8347                 break;
8348         }
8349
8350         switch (wdev->iftype) {
8351         case NL80211_IFTYPE_P2P_CLIENT:
8352         case NL80211_IFTYPE_STATION:
8353                 if (intbss == wdev->current_bss &&
8354                     nla_put_u32(msg, NL80211_BSS_STATUS,
8355                                 NL80211_BSS_STATUS_ASSOCIATED))
8356                         goto nla_put_failure;
8357                 break;
8358         case NL80211_IFTYPE_ADHOC:
8359                 if (intbss == wdev->current_bss &&
8360                     nla_put_u32(msg, NL80211_BSS_STATUS,
8361                                 NL80211_BSS_STATUS_IBSS_JOINED))
8362                         goto nla_put_failure;
8363                 break;
8364         default:
8365                 break;
8366         }
8367
8368         nla_nest_end(msg, bss);
8369
8370         genlmsg_end(msg, hdr);
8371         return 0;
8372
8373  fail_unlock_rcu:
8374         rcu_read_unlock();
8375  nla_put_failure:
8376         genlmsg_cancel(msg, hdr);
8377         return -EMSGSIZE;
8378 }
8379
8380 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
8381 {
8382         struct cfg80211_registered_device *rdev;
8383         struct cfg80211_internal_bss *scan;
8384         struct wireless_dev *wdev;
8385         int start = cb->args[2], idx = 0;
8386         int err;
8387
8388         rtnl_lock();
8389         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
8390         if (err) {
8391                 rtnl_unlock();
8392                 return err;
8393         }
8394
8395         wdev_lock(wdev);
8396         spin_lock_bh(&rdev->bss_lock);
8397
8398         /*
8399          * dump_scan will be called multiple times to break up the scan results
8400          * into multiple messages.  It is unlikely that any more bss-es will be
8401          * expired after the first call, so only call only call this on the
8402          * first dump_scan invocation.
8403          */
8404         if (start == 0)
8405                 cfg80211_bss_expire(rdev);
8406
8407         cb->seq = rdev->bss_generation;
8408
8409         list_for_each_entry(scan, &rdev->bss_list, list) {
8410                 if (++idx <= start)
8411                         continue;
8412                 if (nl80211_send_bss(skb, cb,
8413                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8414                                 rdev, wdev, scan) < 0) {
8415                         idx--;
8416                         break;
8417                 }
8418         }
8419
8420         spin_unlock_bh(&rdev->bss_lock);
8421         wdev_unlock(wdev);
8422
8423         cb->args[2] = idx;
8424         rtnl_unlock();
8425
8426         return skb->len;
8427 }
8428
8429 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
8430                                int flags, struct net_device *dev,
8431                                bool allow_radio_stats,
8432                                struct survey_info *survey)
8433 {
8434         void *hdr;
8435         struct nlattr *infoattr;
8436
8437         /* skip radio stats if userspace didn't request them */
8438         if (!survey->channel && !allow_radio_stats)
8439                 return 0;
8440
8441         hdr = nl80211hdr_put(msg, portid, seq, flags,
8442                              NL80211_CMD_NEW_SURVEY_RESULTS);
8443         if (!hdr)
8444                 return -ENOMEM;
8445
8446         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
8447                 goto nla_put_failure;
8448
8449         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
8450         if (!infoattr)
8451                 goto nla_put_failure;
8452
8453         if (survey->channel &&
8454             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
8455                         survey->channel->center_freq))
8456                 goto nla_put_failure;
8457
8458         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
8459             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
8460                 goto nla_put_failure;
8461         if ((survey->filled & SURVEY_INFO_IN_USE) &&
8462             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
8463                 goto nla_put_failure;
8464         if ((survey->filled & SURVEY_INFO_TIME) &&
8465             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
8466                         survey->time, NL80211_SURVEY_INFO_PAD))
8467                 goto nla_put_failure;
8468         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
8469             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
8470                               survey->time_busy, NL80211_SURVEY_INFO_PAD))
8471                 goto nla_put_failure;
8472         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
8473             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
8474                               survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
8475                 goto nla_put_failure;
8476         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
8477             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
8478                               survey->time_rx, NL80211_SURVEY_INFO_PAD))
8479                 goto nla_put_failure;
8480         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
8481             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
8482                               survey->time_tx, NL80211_SURVEY_INFO_PAD))
8483                 goto nla_put_failure;
8484         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
8485             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
8486                               survey->time_scan, NL80211_SURVEY_INFO_PAD))
8487                 goto nla_put_failure;
8488
8489         nla_nest_end(msg, infoattr);
8490
8491         genlmsg_end(msg, hdr);
8492         return 0;
8493
8494  nla_put_failure:
8495         genlmsg_cancel(msg, hdr);
8496         return -EMSGSIZE;
8497 }
8498
8499 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
8500 {
8501         struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
8502         struct survey_info survey;
8503         struct cfg80211_registered_device *rdev;
8504         struct wireless_dev *wdev;
8505         int survey_idx = cb->args[2];
8506         int res;
8507         bool radio_stats;
8508
8509         rtnl_lock();
8510         res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
8511         if (res)
8512                 goto out_err;
8513
8514         /* prepare_wdev_dump parsed the attributes */
8515         radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
8516
8517         if (!wdev->netdev) {
8518                 res = -EINVAL;
8519                 goto out_err;
8520         }
8521
8522         if (!rdev->ops->dump_survey) {
8523                 res = -EOPNOTSUPP;
8524                 goto out_err;
8525         }
8526
8527         while (1) {
8528                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
8529                 if (res == -ENOENT)
8530                         break;
8531                 if (res)
8532                         goto out_err;
8533
8534                 /* don't send disabled channels, but do send non-channel data */
8535                 if (survey.channel &&
8536                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
8537                         survey_idx++;
8538                         continue;
8539                 }
8540
8541                 if (nl80211_send_survey(skb,
8542                                 NETLINK_CB(cb->skb).portid,
8543                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8544                                 wdev->netdev, radio_stats, &survey) < 0)
8545                         goto out;
8546                 survey_idx++;
8547         }
8548
8549  out:
8550         cb->args[2] = survey_idx;
8551         res = skb->len;
8552  out_err:
8553         rtnl_unlock();
8554         return res;
8555 }
8556
8557 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
8558 {
8559         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
8560                                   NL80211_WPA_VERSION_2));
8561 }
8562
8563 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
8564 {
8565         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8566         struct net_device *dev = info->user_ptr[1];
8567         struct ieee80211_channel *chan;
8568         const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL;
8569         int err, ssid_len, ie_len = 0, auth_data_len = 0;
8570         enum nl80211_auth_type auth_type;
8571         struct key_parse key;
8572         bool local_state_change;
8573
8574         if (!info->attrs[NL80211_ATTR_MAC])
8575                 return -EINVAL;
8576
8577         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
8578                 return -EINVAL;
8579
8580         if (!info->attrs[NL80211_ATTR_SSID])
8581                 return -EINVAL;
8582
8583         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
8584                 return -EINVAL;
8585
8586         err = nl80211_parse_key(info, &key);
8587         if (err)
8588                 return err;
8589
8590         if (key.idx >= 0) {
8591                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
8592                         return -EINVAL;
8593                 if (!key.p.key || !key.p.key_len)
8594                         return -EINVAL;
8595                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
8596                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
8597                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
8598                      key.p.key_len != WLAN_KEY_LEN_WEP104))
8599                         return -EINVAL;
8600                 if (key.idx > 3)
8601                         return -EINVAL;
8602         } else {
8603                 key.p.key_len = 0;
8604                 key.p.key = NULL;
8605         }
8606
8607         if (key.idx >= 0) {
8608                 int i;
8609                 bool ok = false;
8610
8611                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
8612                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
8613                                 ok = true;
8614                                 break;
8615                         }
8616                 }
8617                 if (!ok)
8618                         return -EINVAL;
8619         }
8620
8621         if (!rdev->ops->auth)
8622                 return -EOPNOTSUPP;
8623
8624         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8625             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8626                 return -EOPNOTSUPP;
8627
8628         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8629         chan = nl80211_get_valid_chan(&rdev->wiphy,
8630                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8631         if (!chan)
8632                 return -EINVAL;
8633
8634         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8635         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8636
8637         if (info->attrs[NL80211_ATTR_IE]) {
8638                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8639                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8640         }
8641
8642         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8643         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
8644                 return -EINVAL;
8645
8646         if ((auth_type == NL80211_AUTHTYPE_SAE ||
8647              auth_type == NL80211_AUTHTYPE_FILS_SK ||
8648              auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
8649              auth_type == NL80211_AUTHTYPE_FILS_PK) &&
8650             !info->attrs[NL80211_ATTR_AUTH_DATA])
8651                 return -EINVAL;
8652
8653         if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
8654                 if (auth_type != NL80211_AUTHTYPE_SAE &&
8655                     auth_type != NL80211_AUTHTYPE_FILS_SK &&
8656                     auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
8657                     auth_type != NL80211_AUTHTYPE_FILS_PK)
8658                         return -EINVAL;
8659                 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
8660                 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
8661                 /* need to include at least Auth Transaction and Status Code */
8662                 if (auth_data_len < 4)
8663                         return -EINVAL;
8664         }
8665
8666         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8667
8668         /*
8669          * Since we no longer track auth state, ignore
8670          * requests to only change local state.
8671          */
8672         if (local_state_change)
8673                 return 0;
8674
8675         wdev_lock(dev->ieee80211_ptr);
8676         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
8677                                  ssid, ssid_len, ie, ie_len,
8678                                  key.p.key, key.p.key_len, key.idx,
8679                                  auth_data, auth_data_len);
8680         wdev_unlock(dev->ieee80211_ptr);
8681         return err;
8682 }
8683
8684 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
8685                                      struct genl_info *info)
8686 {
8687         if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8688                 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
8689                 return -EINVAL;
8690         }
8691
8692         if (!rdev->ops->tx_control_port ||
8693             !wiphy_ext_feature_isset(&rdev->wiphy,
8694                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
8695                 return -EOPNOTSUPP;
8696
8697         return 0;
8698 }
8699
8700 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
8701                                    struct genl_info *info,
8702                                    struct cfg80211_crypto_settings *settings,
8703                                    int cipher_limit)
8704 {
8705         memset(settings, 0, sizeof(*settings));
8706
8707         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
8708
8709         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
8710                 u16 proto;
8711
8712                 proto = nla_get_u16(
8713                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
8714                 settings->control_port_ethertype = cpu_to_be16(proto);
8715                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
8716                     proto != ETH_P_PAE)
8717                         return -EINVAL;
8718                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
8719                         settings->control_port_no_encrypt = true;
8720         } else
8721                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
8722
8723         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
8724                 int r = validate_pae_over_nl80211(rdev, info);
8725
8726                 if (r < 0)
8727                         return r;
8728
8729                 settings->control_port_over_nl80211 = true;
8730         }
8731
8732         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
8733                 void *data;
8734                 int len, i;
8735
8736                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8737                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8738                 settings->n_ciphers_pairwise = len / sizeof(u32);
8739
8740                 if (len % sizeof(u32))
8741                         return -EINVAL;
8742
8743                 if (settings->n_ciphers_pairwise > cipher_limit)
8744                         return -EINVAL;
8745
8746                 memcpy(settings->ciphers_pairwise, data, len);
8747
8748                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
8749                         if (!cfg80211_supported_cipher_suite(
8750                                         &rdev->wiphy,
8751                                         settings->ciphers_pairwise[i]))
8752                                 return -EINVAL;
8753         }
8754
8755         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
8756                 settings->cipher_group =
8757                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
8758                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
8759                                                      settings->cipher_group))
8760                         return -EINVAL;
8761         }
8762
8763         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
8764                 settings->wpa_versions =
8765                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
8766                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
8767                         return -EINVAL;
8768         }
8769
8770         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
8771                 void *data;
8772                 int len;
8773
8774                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
8775                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
8776                 settings->n_akm_suites = len / sizeof(u32);
8777
8778                 if (len % sizeof(u32))
8779                         return -EINVAL;
8780
8781                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
8782                         return -EINVAL;
8783
8784                 memcpy(settings->akm_suites, data, len);
8785         }
8786
8787         if (info->attrs[NL80211_ATTR_PMK]) {
8788                 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
8789                         return -EINVAL;
8790                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8791                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK))
8792                         return -EINVAL;
8793                 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
8794         }
8795
8796         return 0;
8797 }
8798
8799 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
8800 {
8801         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8802         struct net_device *dev = info->user_ptr[1];
8803         struct ieee80211_channel *chan;
8804         struct cfg80211_assoc_request req = {};
8805         const u8 *bssid, *ssid;
8806         int err, ssid_len = 0;
8807
8808         if (dev->ieee80211_ptr->conn_owner_nlportid &&
8809             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
8810                 return -EPERM;
8811
8812         if (!info->attrs[NL80211_ATTR_MAC] ||
8813             !info->attrs[NL80211_ATTR_SSID] ||
8814             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
8815                 return -EINVAL;
8816
8817         if (!rdev->ops->assoc)
8818                 return -EOPNOTSUPP;
8819
8820         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8821             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8822                 return -EOPNOTSUPP;
8823
8824         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8825
8826         chan = nl80211_get_valid_chan(&rdev->wiphy,
8827                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8828         if (!chan)
8829                 return -EINVAL;
8830
8831         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8832         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8833
8834         if (info->attrs[NL80211_ATTR_IE]) {
8835                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8836                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8837         }
8838
8839         if (info->attrs[NL80211_ATTR_USE_MFP]) {
8840                 enum nl80211_mfp mfp =
8841                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
8842                 if (mfp == NL80211_MFP_REQUIRED)
8843                         req.use_mfp = true;
8844                 else if (mfp != NL80211_MFP_NO)
8845                         return -EINVAL;
8846         }
8847
8848         if (info->attrs[NL80211_ATTR_PREV_BSSID])
8849                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
8850
8851         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
8852                 req.flags |= ASSOC_REQ_DISABLE_HT;
8853
8854         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8855                 memcpy(&req.ht_capa_mask,
8856                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8857                        sizeof(req.ht_capa_mask));
8858
8859         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8860                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8861                         return -EINVAL;
8862                 memcpy(&req.ht_capa,
8863                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8864                        sizeof(req.ht_capa));
8865         }
8866
8867         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
8868                 req.flags |= ASSOC_REQ_DISABLE_VHT;
8869
8870         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8871                 memcpy(&req.vht_capa_mask,
8872                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
8873                        sizeof(req.vht_capa_mask));
8874
8875         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
8876                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8877                         return -EINVAL;
8878                 memcpy(&req.vht_capa,
8879                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
8880                        sizeof(req.vht_capa));
8881         }
8882
8883         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
8884                 if (!((rdev->wiphy.features &
8885                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
8886                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
8887                     !wiphy_ext_feature_isset(&rdev->wiphy,
8888                                              NL80211_EXT_FEATURE_RRM))
8889                         return -EINVAL;
8890                 req.flags |= ASSOC_REQ_USE_RRM;
8891         }
8892
8893         if (info->attrs[NL80211_ATTR_FILS_KEK]) {
8894                 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
8895                 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
8896                 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
8897                         return -EINVAL;
8898                 req.fils_nonces =
8899                         nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
8900         }
8901
8902         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
8903         if (!err) {
8904                 wdev_lock(dev->ieee80211_ptr);
8905
8906                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
8907                                           ssid, ssid_len, &req);
8908
8909                 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8910                         dev->ieee80211_ptr->conn_owner_nlportid =
8911                                 info->snd_portid;
8912                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
8913                                bssid, ETH_ALEN);
8914                 }
8915
8916                 wdev_unlock(dev->ieee80211_ptr);
8917         }
8918
8919         return err;
8920 }
8921
8922 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
8923 {
8924         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8925         struct net_device *dev = info->user_ptr[1];
8926         const u8 *ie = NULL, *bssid;
8927         int ie_len = 0, err;
8928         u16 reason_code;
8929         bool local_state_change;
8930
8931         if (dev->ieee80211_ptr->conn_owner_nlportid &&
8932             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
8933                 return -EPERM;
8934
8935         if (!info->attrs[NL80211_ATTR_MAC])
8936                 return -EINVAL;
8937
8938         if (!info->attrs[NL80211_ATTR_REASON_CODE])
8939                 return -EINVAL;
8940
8941         if (!rdev->ops->deauth)
8942                 return -EOPNOTSUPP;
8943
8944         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8945             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8946                 return -EOPNOTSUPP;
8947
8948         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8949
8950         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8951         if (reason_code == 0) {
8952                 /* Reason Code 0 is reserved */
8953                 return -EINVAL;
8954         }
8955
8956         if (info->attrs[NL80211_ATTR_IE]) {
8957                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8958                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8959         }
8960
8961         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8962
8963         wdev_lock(dev->ieee80211_ptr);
8964         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
8965                                    local_state_change);
8966         wdev_unlock(dev->ieee80211_ptr);
8967         return err;
8968 }
8969
8970 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
8971 {
8972         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8973         struct net_device *dev = info->user_ptr[1];
8974         const u8 *ie = NULL, *bssid;
8975         int ie_len = 0, err;
8976         u16 reason_code;
8977         bool local_state_change;
8978
8979         if (dev->ieee80211_ptr->conn_owner_nlportid &&
8980             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
8981                 return -EPERM;
8982
8983         if (!info->attrs[NL80211_ATTR_MAC])
8984                 return -EINVAL;
8985
8986         if (!info->attrs[NL80211_ATTR_REASON_CODE])
8987                 return -EINVAL;
8988
8989         if (!rdev->ops->disassoc)
8990                 return -EOPNOTSUPP;
8991
8992         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8993             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8994                 return -EOPNOTSUPP;
8995
8996         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8997
8998         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8999         if (reason_code == 0) {
9000                 /* Reason Code 0 is reserved */
9001                 return -EINVAL;
9002         }
9003
9004         if (info->attrs[NL80211_ATTR_IE]) {
9005                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9006                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9007         }
9008
9009         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
9010
9011         wdev_lock(dev->ieee80211_ptr);
9012         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
9013                                      local_state_change);
9014         wdev_unlock(dev->ieee80211_ptr);
9015         return err;
9016 }
9017
9018 static bool
9019 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
9020                          int mcast_rate[NUM_NL80211_BANDS],
9021                          int rateval)
9022 {
9023         struct wiphy *wiphy = &rdev->wiphy;
9024         bool found = false;
9025         int band, i;
9026
9027         for (band = 0; band < NUM_NL80211_BANDS; band++) {
9028                 struct ieee80211_supported_band *sband;
9029
9030                 sband = wiphy->bands[band];
9031                 if (!sband)
9032                         continue;
9033
9034                 for (i = 0; i < sband->n_bitrates; i++) {
9035                         if (sband->bitrates[i].bitrate == rateval) {
9036                                 mcast_rate[band] = i + 1;
9037                                 found = true;
9038                                 break;
9039                         }
9040                 }
9041         }
9042
9043         return found;
9044 }
9045
9046 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
9047 {
9048         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9049         struct net_device *dev = info->user_ptr[1];
9050         struct cfg80211_ibss_params ibss;
9051         struct wiphy *wiphy;
9052         struct cfg80211_cached_keys *connkeys = NULL;
9053         int err;
9054
9055         memset(&ibss, 0, sizeof(ibss));
9056
9057         if (!info->attrs[NL80211_ATTR_SSID] ||
9058             !nla_len(info->attrs[NL80211_ATTR_SSID]))
9059                 return -EINVAL;
9060
9061         ibss.beacon_interval = 100;
9062
9063         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
9064                 ibss.beacon_interval =
9065                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
9066
9067         err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
9068                                            ibss.beacon_interval);
9069         if (err)
9070                 return err;
9071
9072         if (!rdev->ops->join_ibss)
9073                 return -EOPNOTSUPP;
9074
9075         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
9076                 return -EOPNOTSUPP;
9077
9078         wiphy = &rdev->wiphy;
9079
9080         if (info->attrs[NL80211_ATTR_MAC]) {
9081                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9082
9083                 if (!is_valid_ether_addr(ibss.bssid))
9084                         return -EINVAL;
9085         }
9086         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9087         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9088
9089         if (info->attrs[NL80211_ATTR_IE]) {
9090                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9091                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9092         }
9093
9094         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
9095         if (err)
9096                 return err;
9097
9098         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
9099                                      NL80211_IFTYPE_ADHOC))
9100                 return -EINVAL;
9101
9102         switch (ibss.chandef.width) {
9103         case NL80211_CHAN_WIDTH_5:
9104         case NL80211_CHAN_WIDTH_10:
9105         case NL80211_CHAN_WIDTH_20_NOHT:
9106                 break;
9107         case NL80211_CHAN_WIDTH_20:
9108         case NL80211_CHAN_WIDTH_40:
9109                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
9110                         return -EINVAL;
9111                 break;
9112         case NL80211_CHAN_WIDTH_80:
9113         case NL80211_CHAN_WIDTH_80P80:
9114         case NL80211_CHAN_WIDTH_160:
9115                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
9116                         return -EINVAL;
9117                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
9118                                              NL80211_EXT_FEATURE_VHT_IBSS))
9119                         return -EINVAL;
9120                 break;
9121         default:
9122                 return -EINVAL;
9123         }
9124
9125         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
9126         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
9127
9128         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
9129                 u8 *rates =
9130                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9131                 int n_rates =
9132                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9133                 struct ieee80211_supported_band *sband =
9134                         wiphy->bands[ibss.chandef.chan->band];
9135
9136                 err = ieee80211_get_ratemask(sband, rates, n_rates,
9137                                              &ibss.basic_rates);
9138                 if (err)
9139                         return err;
9140         }
9141
9142         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9143                 memcpy(&ibss.ht_capa_mask,
9144                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
9145                        sizeof(ibss.ht_capa_mask));
9146
9147         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9148                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9149                         return -EINVAL;
9150                 memcpy(&ibss.ht_capa,
9151                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9152                        sizeof(ibss.ht_capa));
9153         }
9154
9155         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
9156             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
9157                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
9158                 return -EINVAL;
9159
9160         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
9161                 bool no_ht = false;
9162
9163                 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
9164                 if (IS_ERR(connkeys))
9165                         return PTR_ERR(connkeys);
9166
9167                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
9168                     no_ht) {
9169                         kzfree(connkeys);
9170                         return -EINVAL;
9171                 }
9172         }
9173
9174         ibss.control_port =
9175                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
9176
9177         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
9178                 int r = validate_pae_over_nl80211(rdev, info);
9179
9180                 if (r < 0) {
9181                         kzfree(connkeys);
9182                         return r;
9183                 }
9184
9185                 ibss.control_port_over_nl80211 = true;
9186         }
9187
9188         ibss.userspace_handles_dfs =
9189                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
9190
9191         wdev_lock(dev->ieee80211_ptr);
9192         err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
9193         if (err)
9194                 kzfree(connkeys);
9195         else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
9196                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
9197         wdev_unlock(dev->ieee80211_ptr);
9198
9199         return err;
9200 }
9201
9202 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
9203 {
9204         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9205         struct net_device *dev = info->user_ptr[1];
9206
9207         if (!rdev->ops->leave_ibss)
9208                 return -EOPNOTSUPP;
9209
9210         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
9211                 return -EOPNOTSUPP;
9212
9213         return cfg80211_leave_ibss(rdev, dev, false);
9214 }
9215
9216 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
9217 {
9218         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9219         struct net_device *dev = info->user_ptr[1];
9220         int mcast_rate[NUM_NL80211_BANDS];
9221         u32 nla_rate;
9222         int err;
9223
9224         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
9225             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
9226             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
9227                 return -EOPNOTSUPP;
9228
9229         if (!rdev->ops->set_mcast_rate)
9230                 return -EOPNOTSUPP;
9231
9232         memset(mcast_rate, 0, sizeof(mcast_rate));
9233
9234         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
9235                 return -EINVAL;
9236
9237         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
9238         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
9239                 return -EINVAL;
9240
9241         err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
9242
9243         return err;
9244 }
9245
9246 static struct sk_buff *
9247 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
9248                             struct wireless_dev *wdev, int approxlen,
9249                             u32 portid, u32 seq, enum nl80211_commands cmd,
9250                             enum nl80211_attrs attr,
9251                             const struct nl80211_vendor_cmd_info *info,
9252                             gfp_t gfp)
9253 {
9254         struct sk_buff *skb;
9255         void *hdr;
9256         struct nlattr *data;
9257
9258         skb = nlmsg_new(approxlen + 100, gfp);
9259         if (!skb)
9260                 return NULL;
9261
9262         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
9263         if (!hdr) {
9264                 kfree_skb(skb);
9265                 return NULL;
9266         }
9267
9268         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
9269                 goto nla_put_failure;
9270
9271         if (info) {
9272                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
9273                                 info->vendor_id))
9274                         goto nla_put_failure;
9275                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
9276                                 info->subcmd))
9277                         goto nla_put_failure;
9278         }
9279
9280         if (wdev) {
9281                 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
9282                                       wdev_id(wdev), NL80211_ATTR_PAD))
9283                         goto nla_put_failure;
9284                 if (wdev->netdev &&
9285                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
9286                                 wdev->netdev->ifindex))
9287                         goto nla_put_failure;
9288         }
9289
9290         data = nla_nest_start(skb, attr);
9291         if (!data)
9292                 goto nla_put_failure;
9293
9294         ((void **)skb->cb)[0] = rdev;
9295         ((void **)skb->cb)[1] = hdr;
9296         ((void **)skb->cb)[2] = data;
9297
9298         return skb;
9299
9300  nla_put_failure:
9301         kfree_skb(skb);
9302         return NULL;
9303 }
9304
9305 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
9306                                            struct wireless_dev *wdev,
9307                                            enum nl80211_commands cmd,
9308                                            enum nl80211_attrs attr,
9309                                            unsigned int portid,
9310                                            int vendor_event_idx,
9311                                            int approxlen, gfp_t gfp)
9312 {
9313         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
9314         const struct nl80211_vendor_cmd_info *info;
9315
9316         switch (cmd) {
9317         case NL80211_CMD_TESTMODE:
9318                 if (WARN_ON(vendor_event_idx != -1))
9319                         return NULL;
9320                 info = NULL;
9321                 break;
9322         case NL80211_CMD_VENDOR:
9323                 if (WARN_ON(vendor_event_idx < 0 ||
9324                             vendor_event_idx >= wiphy->n_vendor_events))
9325                         return NULL;
9326                 info = &wiphy->vendor_events[vendor_event_idx];
9327                 break;
9328         default:
9329                 WARN_ON(1);
9330                 return NULL;
9331         }
9332
9333         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0,
9334                                            cmd, attr, info, gfp);
9335 }
9336 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
9337
9338 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
9339 {
9340         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
9341         void *hdr = ((void **)skb->cb)[1];
9342         struct nlmsghdr *nlhdr = nlmsg_hdr(skb);
9343         struct nlattr *data = ((void **)skb->cb)[2];
9344         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
9345
9346         /* clear CB data for netlink core to own from now on */
9347         memset(skb->cb, 0, sizeof(skb->cb));
9348
9349         nla_nest_end(skb, data);
9350         genlmsg_end(skb, hdr);
9351
9352         if (nlhdr->nlmsg_pid) {
9353                 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb,
9354                                 nlhdr->nlmsg_pid);
9355         } else {
9356                 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
9357                         mcgrp = NL80211_MCGRP_VENDOR;
9358
9359                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
9360                                         skb, 0, mcgrp, gfp);
9361         }
9362 }
9363 EXPORT_SYMBOL(__cfg80211_send_event_skb);
9364
9365 #ifdef CONFIG_NL80211_TESTMODE
9366 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
9367 {
9368         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9369         struct wireless_dev *wdev =
9370                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
9371         int err;
9372
9373         if (!rdev->ops->testmode_cmd)
9374                 return -EOPNOTSUPP;
9375
9376         if (IS_ERR(wdev)) {
9377                 err = PTR_ERR(wdev);
9378                 if (err != -EINVAL)
9379                         return err;
9380                 wdev = NULL;
9381         } else if (wdev->wiphy != &rdev->wiphy) {
9382                 return -EINVAL;
9383         }
9384
9385         if (!info->attrs[NL80211_ATTR_TESTDATA])
9386                 return -EINVAL;
9387
9388         rdev->cur_cmd_info = info;
9389         err = rdev_testmode_cmd(rdev, wdev,
9390                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
9391                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
9392         rdev->cur_cmd_info = NULL;
9393
9394         return err;
9395 }
9396
9397 static int nl80211_testmode_dump(struct sk_buff *skb,
9398                                  struct netlink_callback *cb)
9399 {
9400         struct cfg80211_registered_device *rdev;
9401         int err;
9402         long phy_idx;
9403         void *data = NULL;
9404         int data_len = 0;
9405
9406         rtnl_lock();
9407
9408         if (cb->args[0]) {
9409                 /*
9410                  * 0 is a valid index, but not valid for args[0],
9411                  * so we need to offset by 1.
9412                  */
9413                 phy_idx = cb->args[0] - 1;
9414
9415                 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
9416                 if (!rdev) {
9417                         err = -ENOENT;
9418                         goto out_err;
9419                 }
9420         } else {
9421                 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
9422
9423                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
9424                                   attrbuf, nl80211_fam.maxattr,
9425                                   nl80211_policy, NULL);
9426                 if (err)
9427                         goto out_err;
9428
9429                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
9430                 if (IS_ERR(rdev)) {
9431                         err = PTR_ERR(rdev);
9432                         goto out_err;
9433                 }
9434                 phy_idx = rdev->wiphy_idx;
9435
9436                 if (attrbuf[NL80211_ATTR_TESTDATA])
9437                         cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
9438         }
9439
9440         if (cb->args[1]) {
9441                 data = nla_data((void *)cb->args[1]);
9442                 data_len = nla_len((void *)cb->args[1]);
9443         }
9444
9445         if (!rdev->ops->testmode_dump) {
9446                 err = -EOPNOTSUPP;
9447                 goto out_err;
9448         }
9449
9450         while (1) {
9451                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
9452                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
9453                                            NL80211_CMD_TESTMODE);
9454                 struct nlattr *tmdata;
9455
9456                 if (!hdr)
9457                         break;
9458
9459                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
9460                         genlmsg_cancel(skb, hdr);
9461                         break;
9462                 }
9463
9464                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
9465                 if (!tmdata) {
9466                         genlmsg_cancel(skb, hdr);
9467                         break;
9468                 }
9469                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
9470                 nla_nest_end(skb, tmdata);
9471
9472                 if (err == -ENOBUFS || err == -ENOENT) {
9473                         genlmsg_cancel(skb, hdr);
9474                         break;
9475                 } else if (err) {
9476                         genlmsg_cancel(skb, hdr);
9477                         goto out_err;
9478                 }
9479
9480                 genlmsg_end(skb, hdr);
9481         }
9482
9483         err = skb->len;
9484         /* see above */
9485         cb->args[0] = phy_idx + 1;
9486  out_err:
9487         rtnl_unlock();
9488         return err;
9489 }
9490 #endif
9491
9492 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
9493 {
9494         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9495         struct net_device *dev = info->user_ptr[1];
9496         struct cfg80211_connect_params connect;
9497         struct wiphy *wiphy;
9498         struct cfg80211_cached_keys *connkeys = NULL;
9499         int err;
9500
9501         memset(&connect, 0, sizeof(connect));
9502
9503         if (!info->attrs[NL80211_ATTR_SSID] ||
9504             !nla_len(info->attrs[NL80211_ATTR_SSID]))
9505                 return -EINVAL;
9506
9507         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
9508                 connect.auth_type =
9509                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9510                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
9511                                              NL80211_CMD_CONNECT))
9512                         return -EINVAL;
9513         } else
9514                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
9515
9516         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
9517
9518         if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
9519             !wiphy_ext_feature_isset(&rdev->wiphy,
9520                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
9521                 return -EINVAL;
9522         connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
9523
9524         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
9525                                       NL80211_MAX_NR_CIPHER_SUITES);
9526         if (err)
9527                 return err;
9528
9529         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9530             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9531                 return -EOPNOTSUPP;
9532
9533         wiphy = &rdev->wiphy;
9534
9535         connect.bg_scan_period = -1;
9536         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
9537                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
9538                 connect.bg_scan_period =
9539                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
9540         }
9541
9542         if (info->attrs[NL80211_ATTR_MAC])
9543                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9544         else if (info->attrs[NL80211_ATTR_MAC_HINT])
9545                 connect.bssid_hint =
9546                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
9547         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9548         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9549
9550         if (info->attrs[NL80211_ATTR_IE]) {
9551                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9552                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9553         }
9554
9555         if (info->attrs[NL80211_ATTR_USE_MFP]) {
9556                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
9557                 if (connect.mfp == NL80211_MFP_OPTIONAL &&
9558                     !wiphy_ext_feature_isset(&rdev->wiphy,
9559                                              NL80211_EXT_FEATURE_MFP_OPTIONAL))
9560                         return -EOPNOTSUPP;
9561         } else {
9562                 connect.mfp = NL80211_MFP_NO;
9563         }
9564
9565         if (info->attrs[NL80211_ATTR_PREV_BSSID])
9566                 connect.prev_bssid =
9567                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
9568
9569         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9570                 connect.channel = nl80211_get_valid_chan(
9571                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
9572                 if (!connect.channel)
9573                         return -EINVAL;
9574         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
9575                 connect.channel_hint = nl80211_get_valid_chan(
9576                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
9577                 if (!connect.channel_hint)
9578                         return -EINVAL;
9579         }
9580
9581         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
9582                 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
9583                 if (IS_ERR(connkeys))
9584                         return PTR_ERR(connkeys);
9585         }
9586
9587         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
9588                 connect.flags |= ASSOC_REQ_DISABLE_HT;
9589
9590         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9591                 memcpy(&connect.ht_capa_mask,
9592                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
9593                        sizeof(connect.ht_capa_mask));
9594
9595         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9596                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
9597                         kzfree(connkeys);
9598                         return -EINVAL;
9599                 }
9600                 memcpy(&connect.ht_capa,
9601                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9602                        sizeof(connect.ht_capa));
9603         }
9604
9605         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
9606                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
9607
9608         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
9609                 memcpy(&connect.vht_capa_mask,
9610                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
9611                        sizeof(connect.vht_capa_mask));
9612
9613         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
9614                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
9615                         kzfree(connkeys);
9616                         return -EINVAL;
9617                 }
9618                 memcpy(&connect.vht_capa,
9619                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
9620                        sizeof(connect.vht_capa));
9621         }
9622
9623         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
9624                 if (!((rdev->wiphy.features &
9625                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
9626                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
9627                     !wiphy_ext_feature_isset(&rdev->wiphy,
9628                                              NL80211_EXT_FEATURE_RRM)) {
9629                         kzfree(connkeys);
9630                         return -EINVAL;
9631                 }
9632                 connect.flags |= ASSOC_REQ_USE_RRM;
9633         }
9634
9635         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
9636         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
9637                 kzfree(connkeys);
9638                 return -EOPNOTSUPP;
9639         }
9640
9641         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
9642                 /* bss selection makes no sense if bssid is set */
9643                 if (connect.bssid) {
9644                         kzfree(connkeys);
9645                         return -EINVAL;
9646                 }
9647
9648                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
9649                                        wiphy, &connect.bss_select);
9650                 if (err) {
9651                         kzfree(connkeys);
9652                         return err;
9653                 }
9654         }
9655
9656         if (wiphy_ext_feature_isset(&rdev->wiphy,
9657                                     NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
9658             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
9659             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
9660             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
9661             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9662                 connect.fils_erp_username =
9663                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9664                 connect.fils_erp_username_len =
9665                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9666                 connect.fils_erp_realm =
9667                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9668                 connect.fils_erp_realm_len =
9669                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9670                 connect.fils_erp_next_seq_num =
9671                         nla_get_u16(
9672                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
9673                 connect.fils_erp_rrk =
9674                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9675                 connect.fils_erp_rrk_len =
9676                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9677         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
9678                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
9679                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
9680                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9681                 kzfree(connkeys);
9682                 return -EINVAL;
9683         }
9684
9685         if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
9686                 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9687                         kzfree(connkeys);
9688                         GENL_SET_ERR_MSG(info,
9689                                          "external auth requires connection ownership");
9690                         return -EINVAL;
9691                 }
9692                 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
9693         }
9694
9695         wdev_lock(dev->ieee80211_ptr);
9696
9697         err = cfg80211_connect(rdev, dev, &connect, connkeys,
9698                                connect.prev_bssid);
9699         if (err)
9700                 kzfree(connkeys);
9701
9702         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9703                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
9704                 if (connect.bssid)
9705                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
9706                                connect.bssid, ETH_ALEN);
9707                 else
9708                         memset(dev->ieee80211_ptr->disconnect_bssid,
9709                                0, ETH_ALEN);
9710         }
9711
9712         wdev_unlock(dev->ieee80211_ptr);
9713
9714         return err;
9715 }
9716
9717 static int nl80211_update_connect_params(struct sk_buff *skb,
9718                                          struct genl_info *info)
9719 {
9720         struct cfg80211_connect_params connect = {};
9721         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9722         struct net_device *dev = info->user_ptr[1];
9723         struct wireless_dev *wdev = dev->ieee80211_ptr;
9724         bool fils_sk_offload;
9725         u32 auth_type;
9726         u32 changed = 0;
9727         int ret;
9728
9729         if (!rdev->ops->update_connect_params)
9730                 return -EOPNOTSUPP;
9731
9732         if (info->attrs[NL80211_ATTR_IE]) {
9733                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9734                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9735                 changed |= UPDATE_ASSOC_IES;
9736         }
9737
9738         fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
9739                                                   NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
9740
9741         /*
9742          * when driver supports fils-sk offload all attributes must be
9743          * provided. So the else covers "fils-sk-not-all" and
9744          * "no-fils-sk-any".
9745          */
9746         if (fils_sk_offload &&
9747             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
9748             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
9749             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
9750             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9751                 connect.fils_erp_username =
9752                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9753                 connect.fils_erp_username_len =
9754                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9755                 connect.fils_erp_realm =
9756                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9757                 connect.fils_erp_realm_len =
9758                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9759                 connect.fils_erp_next_seq_num =
9760                         nla_get_u16(
9761                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
9762                 connect.fils_erp_rrk =
9763                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9764                 connect.fils_erp_rrk_len =
9765                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9766                 changed |= UPDATE_FILS_ERP_INFO;
9767         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
9768                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
9769                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
9770                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9771                 return -EINVAL;
9772         }
9773
9774         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
9775                 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9776                 if (!nl80211_valid_auth_type(rdev, auth_type,
9777                                              NL80211_CMD_CONNECT))
9778                         return -EINVAL;
9779
9780                 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
9781                     fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
9782                         return -EINVAL;
9783
9784                 connect.auth_type = auth_type;
9785                 changed |= UPDATE_AUTH_TYPE;
9786         }
9787
9788         wdev_lock(dev->ieee80211_ptr);
9789         if (!wdev->current_bss)
9790                 ret = -ENOLINK;
9791         else
9792                 ret = rdev_update_connect_params(rdev, dev, &connect, changed);
9793         wdev_unlock(dev->ieee80211_ptr);
9794
9795         return ret;
9796 }
9797
9798 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
9799 {
9800         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9801         struct net_device *dev = info->user_ptr[1];
9802         u16 reason;
9803         int ret;
9804
9805         if (dev->ieee80211_ptr->conn_owner_nlportid &&
9806             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9807                 return -EPERM;
9808
9809         if (!info->attrs[NL80211_ATTR_REASON_CODE])
9810                 reason = WLAN_REASON_DEAUTH_LEAVING;
9811         else
9812                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9813
9814         if (reason == 0)
9815                 return -EINVAL;
9816
9817         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9818             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9819                 return -EOPNOTSUPP;
9820
9821         wdev_lock(dev->ieee80211_ptr);
9822         ret = cfg80211_disconnect(rdev, dev, reason, true);
9823         wdev_unlock(dev->ieee80211_ptr);
9824         return ret;
9825 }
9826
9827 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
9828 {
9829         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9830         struct net *net;
9831         int err;
9832
9833         if (info->attrs[NL80211_ATTR_PID]) {
9834                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
9835
9836                 net = get_net_ns_by_pid(pid);
9837         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
9838                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
9839
9840                 net = get_net_ns_by_fd(fd);
9841         } else {
9842                 return -EINVAL;
9843         }
9844
9845         if (IS_ERR(net))
9846                 return PTR_ERR(net);
9847
9848         err = 0;
9849
9850         /* check if anything to do */
9851         if (!net_eq(wiphy_net(&rdev->wiphy), net))
9852                 err = cfg80211_switch_netns(rdev, net);
9853
9854         put_net(net);
9855         return err;
9856 }
9857
9858 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
9859 {
9860         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9861         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
9862                         struct cfg80211_pmksa *pmksa) = NULL;
9863         struct net_device *dev = info->user_ptr[1];
9864         struct cfg80211_pmksa pmksa;
9865
9866         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
9867
9868         if (!info->attrs[NL80211_ATTR_PMKID])
9869                 return -EINVAL;
9870
9871         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
9872
9873         if (info->attrs[NL80211_ATTR_MAC]) {
9874                 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9875         } else if (info->attrs[NL80211_ATTR_SSID] &&
9876                    info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
9877                    (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
9878                     info->attrs[NL80211_ATTR_PMK])) {
9879                 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9880                 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9881                 pmksa.cache_id =
9882                         nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
9883         } else {
9884                 return -EINVAL;
9885         }
9886         if (info->attrs[NL80211_ATTR_PMK]) {
9887                 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
9888                 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
9889         }
9890
9891         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9892             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
9893             !(dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP &&
9894               wiphy_ext_feature_isset(&rdev->wiphy,
9895                                       NL80211_EXT_FEATURE_AP_PMKSA_CACHING)))
9896                 return -EOPNOTSUPP;
9897
9898         switch (info->genlhdr->cmd) {
9899         case NL80211_CMD_SET_PMKSA:
9900                 rdev_ops = rdev->ops->set_pmksa;
9901                 break;
9902         case NL80211_CMD_DEL_PMKSA:
9903                 rdev_ops = rdev->ops->del_pmksa;
9904                 break;
9905         default:
9906                 WARN_ON(1);
9907                 break;
9908         }
9909
9910         if (!rdev_ops)
9911                 return -EOPNOTSUPP;
9912
9913         return rdev_ops(&rdev->wiphy, dev, &pmksa);
9914 }
9915
9916 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
9917 {
9918         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9919         struct net_device *dev = info->user_ptr[1];
9920
9921         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9922             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9923                 return -EOPNOTSUPP;
9924
9925         if (!rdev->ops->flush_pmksa)
9926                 return -EOPNOTSUPP;
9927
9928         return rdev_flush_pmksa(rdev, dev);
9929 }
9930
9931 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
9932 {
9933         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9934         struct net_device *dev = info->user_ptr[1];
9935         u8 action_code, dialog_token;
9936         u32 peer_capability = 0;
9937         u16 status_code;
9938         u8 *peer;
9939         bool initiator;
9940
9941         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
9942             !rdev->ops->tdls_mgmt)
9943                 return -EOPNOTSUPP;
9944
9945         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
9946             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
9947             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
9948             !info->attrs[NL80211_ATTR_IE] ||
9949             !info->attrs[NL80211_ATTR_MAC])
9950                 return -EINVAL;
9951
9952         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9953         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
9954         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
9955         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
9956         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
9957         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
9958                 peer_capability =
9959                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
9960
9961         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
9962                               dialog_token, status_code, peer_capability,
9963                               initiator,
9964                               nla_data(info->attrs[NL80211_ATTR_IE]),
9965                               nla_len(info->attrs[NL80211_ATTR_IE]));
9966 }
9967
9968 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
9969 {
9970         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9971         struct net_device *dev = info->user_ptr[1];
9972         enum nl80211_tdls_operation operation;
9973         u8 *peer;
9974
9975         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
9976             !rdev->ops->tdls_oper)
9977                 return -EOPNOTSUPP;
9978
9979         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
9980             !info->attrs[NL80211_ATTR_MAC])
9981                 return -EINVAL;
9982
9983         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
9984         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9985
9986         return rdev_tdls_oper(rdev, dev, peer, operation);
9987 }
9988
9989 static int nl80211_remain_on_channel(struct sk_buff *skb,
9990                                      struct genl_info *info)
9991 {
9992         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9993         struct wireless_dev *wdev = info->user_ptr[1];
9994         struct cfg80211_chan_def chandef;
9995         const struct cfg80211_chan_def *compat_chandef;
9996         struct sk_buff *msg;
9997         void *hdr;
9998         u64 cookie;
9999         u32 duration;
10000         int err;
10001
10002         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
10003             !info->attrs[NL80211_ATTR_DURATION])
10004                 return -EINVAL;
10005
10006         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
10007
10008         if (!rdev->ops->remain_on_channel ||
10009             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
10010                 return -EOPNOTSUPP;
10011
10012         /*
10013          * We should be on that channel for at least a minimum amount of
10014          * time (10ms) but no longer than the driver supports.
10015          */
10016         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
10017             duration > rdev->wiphy.max_remain_on_channel_duration)
10018                 return -EINVAL;
10019
10020         err = nl80211_parse_chandef(rdev, info, &chandef);
10021         if (err)
10022                 return err;
10023
10024         wdev_lock(wdev);
10025         if (!cfg80211_off_channel_oper_allowed(wdev) &&
10026             !cfg80211_chandef_identical(&wdev->chandef, &chandef)) {
10027                 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef,
10028                                                              &chandef);
10029                 if (compat_chandef != &chandef) {
10030                         wdev_unlock(wdev);
10031                         return -EBUSY;
10032                 }
10033         }
10034         wdev_unlock(wdev);
10035
10036         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10037         if (!msg)
10038                 return -ENOMEM;
10039
10040         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10041                              NL80211_CMD_REMAIN_ON_CHANNEL);
10042         if (!hdr) {
10043                 err = -ENOBUFS;
10044                 goto free_msg;
10045         }
10046
10047         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
10048                                      duration, &cookie);
10049
10050         if (err)
10051                 goto free_msg;
10052
10053         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
10054                               NL80211_ATTR_PAD))
10055                 goto nla_put_failure;
10056
10057         genlmsg_end(msg, hdr);
10058
10059         return genlmsg_reply(msg, info);
10060
10061  nla_put_failure:
10062         err = -ENOBUFS;
10063  free_msg:
10064         nlmsg_free(msg);
10065         return err;
10066 }
10067
10068 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
10069                                             struct genl_info *info)
10070 {
10071         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10072         struct wireless_dev *wdev = info->user_ptr[1];
10073         u64 cookie;
10074
10075         if (!info->attrs[NL80211_ATTR_COOKIE])
10076                 return -EINVAL;
10077
10078         if (!rdev->ops->cancel_remain_on_channel)
10079                 return -EOPNOTSUPP;
10080
10081         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
10082
10083         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
10084 }
10085
10086 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
10087                                        struct genl_info *info)
10088 {
10089         struct cfg80211_bitrate_mask mask;
10090         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10091         struct net_device *dev = info->user_ptr[1];
10092         int err;
10093
10094         if (!rdev->ops->set_bitrate_mask)
10095                 return -EOPNOTSUPP;
10096
10097         err = nl80211_parse_tx_bitrate_mask(info, &mask);
10098         if (err)
10099                 return err;
10100
10101         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
10102 }
10103
10104 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
10105 {
10106         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10107         struct wireless_dev *wdev = info->user_ptr[1];
10108         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
10109
10110         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
10111                 return -EINVAL;
10112
10113         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
10114                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
10115
10116         switch (wdev->iftype) {
10117         case NL80211_IFTYPE_STATION:
10118         case NL80211_IFTYPE_ADHOC:
10119         case NL80211_IFTYPE_P2P_CLIENT:
10120         case NL80211_IFTYPE_AP:
10121         case NL80211_IFTYPE_AP_VLAN:
10122         case NL80211_IFTYPE_MESH_POINT:
10123         case NL80211_IFTYPE_P2P_GO:
10124         case NL80211_IFTYPE_P2P_DEVICE:
10125                 break;
10126         case NL80211_IFTYPE_NAN:
10127         default:
10128                 return -EOPNOTSUPP;
10129         }
10130
10131         /* not much point in registering if we can't reply */
10132         if (!rdev->ops->mgmt_tx)
10133                 return -EOPNOTSUPP;
10134
10135         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
10136                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
10137                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
10138 }
10139
10140 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
10141 {
10142         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10143         struct wireless_dev *wdev = info->user_ptr[1];
10144         struct cfg80211_chan_def chandef;
10145         int err;
10146         void *hdr = NULL;
10147         u64 cookie;
10148         struct sk_buff *msg = NULL;
10149         struct cfg80211_mgmt_tx_params params = {
10150                 .dont_wait_for_ack =
10151                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
10152         };
10153
10154         if (!info->attrs[NL80211_ATTR_FRAME])
10155                 return -EINVAL;
10156
10157         if (!rdev->ops->mgmt_tx)
10158                 return -EOPNOTSUPP;
10159
10160         switch (wdev->iftype) {
10161         case NL80211_IFTYPE_P2P_DEVICE:
10162                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
10163                         return -EINVAL;
10164         case NL80211_IFTYPE_STATION:
10165         case NL80211_IFTYPE_ADHOC:
10166         case NL80211_IFTYPE_P2P_CLIENT:
10167         case NL80211_IFTYPE_AP:
10168         case NL80211_IFTYPE_AP_VLAN:
10169         case NL80211_IFTYPE_MESH_POINT:
10170         case NL80211_IFTYPE_P2P_GO:
10171                 break;
10172         case NL80211_IFTYPE_NAN:
10173         default:
10174                 return -EOPNOTSUPP;
10175         }
10176
10177         if (info->attrs[NL80211_ATTR_DURATION]) {
10178                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
10179                         return -EINVAL;
10180                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
10181
10182                 /*
10183                  * We should wait on the channel for at least a minimum amount
10184                  * of time (10ms) but no longer than the driver supports.
10185                  */
10186                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
10187                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
10188                         return -EINVAL;
10189         }
10190
10191         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
10192
10193         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
10194                 return -EINVAL;
10195
10196         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
10197
10198         /* get the channel if any has been specified, otherwise pass NULL to
10199          * the driver. The latter will use the current one
10200          */
10201         chandef.chan = NULL;
10202         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
10203                 err = nl80211_parse_chandef(rdev, info, &chandef);
10204                 if (err)
10205                         return err;
10206         }
10207
10208         if (!chandef.chan && params.offchan)
10209                 return -EINVAL;
10210
10211         wdev_lock(wdev);
10212         if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) {
10213                 wdev_unlock(wdev);
10214                 return -EBUSY;
10215         }
10216         wdev_unlock(wdev);
10217
10218         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
10219         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
10220
10221         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
10222                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
10223                 int i;
10224
10225                 if (len % sizeof(u16))
10226                         return -EINVAL;
10227
10228                 params.n_csa_offsets = len / sizeof(u16);
10229                 params.csa_offsets =
10230                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
10231
10232                 /* check that all the offsets fit the frame */
10233                 for (i = 0; i < params.n_csa_offsets; i++) {
10234                         if (params.csa_offsets[i] >= params.len)
10235                                 return -EINVAL;
10236                 }
10237         }
10238
10239         if (!params.dont_wait_for_ack) {
10240                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10241                 if (!msg)
10242                         return -ENOMEM;
10243
10244                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10245                                      NL80211_CMD_FRAME);
10246                 if (!hdr) {
10247                         err = -ENOBUFS;
10248                         goto free_msg;
10249                 }
10250         }
10251
10252         params.chan = chandef.chan;
10253         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
10254         if (err)
10255                 goto free_msg;
10256
10257         if (msg) {
10258                 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
10259                                       NL80211_ATTR_PAD))
10260                         goto nla_put_failure;
10261
10262                 genlmsg_end(msg, hdr);
10263                 return genlmsg_reply(msg, info);
10264         }
10265
10266         return 0;
10267
10268  nla_put_failure:
10269         err = -ENOBUFS;
10270  free_msg:
10271         nlmsg_free(msg);
10272         return err;
10273 }
10274
10275 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
10276 {
10277         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10278         struct wireless_dev *wdev = info->user_ptr[1];
10279         u64 cookie;
10280
10281         if (!info->attrs[NL80211_ATTR_COOKIE])
10282                 return -EINVAL;
10283
10284         if (!rdev->ops->mgmt_tx_cancel_wait)
10285                 return -EOPNOTSUPP;
10286
10287         switch (wdev->iftype) {
10288         case NL80211_IFTYPE_STATION:
10289         case NL80211_IFTYPE_ADHOC:
10290         case NL80211_IFTYPE_P2P_CLIENT:
10291         case NL80211_IFTYPE_AP:
10292         case NL80211_IFTYPE_AP_VLAN:
10293         case NL80211_IFTYPE_P2P_GO:
10294         case NL80211_IFTYPE_P2P_DEVICE:
10295                 break;
10296         case NL80211_IFTYPE_NAN:
10297         default:
10298                 return -EOPNOTSUPP;
10299         }
10300
10301         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
10302
10303         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
10304 }
10305
10306 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
10307 {
10308         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10309         struct wireless_dev *wdev;
10310         struct net_device *dev = info->user_ptr[1];
10311         u8 ps_state;
10312         bool state;
10313         int err;
10314
10315         if (!info->attrs[NL80211_ATTR_PS_STATE])
10316                 return -EINVAL;
10317
10318         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
10319
10320         wdev = dev->ieee80211_ptr;
10321
10322         if (!rdev->ops->set_power_mgmt)
10323                 return -EOPNOTSUPP;
10324
10325         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
10326
10327         if (state == wdev->ps)
10328                 return 0;
10329
10330         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
10331         if (!err)
10332                 wdev->ps = state;
10333         return err;
10334 }
10335
10336 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
10337 {
10338         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10339         enum nl80211_ps_state ps_state;
10340         struct wireless_dev *wdev;
10341         struct net_device *dev = info->user_ptr[1];
10342         struct sk_buff *msg;
10343         void *hdr;
10344         int err;
10345
10346         wdev = dev->ieee80211_ptr;
10347
10348         if (!rdev->ops->set_power_mgmt)
10349                 return -EOPNOTSUPP;
10350
10351         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10352         if (!msg)
10353                 return -ENOMEM;
10354
10355         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10356                              NL80211_CMD_GET_POWER_SAVE);
10357         if (!hdr) {
10358                 err = -ENOBUFS;
10359                 goto free_msg;
10360         }
10361
10362         if (wdev->ps)
10363                 ps_state = NL80211_PS_ENABLED;
10364         else
10365                 ps_state = NL80211_PS_DISABLED;
10366
10367         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
10368                 goto nla_put_failure;
10369
10370         genlmsg_end(msg, hdr);
10371         return genlmsg_reply(msg, info);
10372
10373  nla_put_failure:
10374         err = -ENOBUFS;
10375  free_msg:
10376         nlmsg_free(msg);
10377         return err;
10378 }
10379
10380 static const struct nla_policy
10381 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
10382         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
10383         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
10384         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
10385         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
10386         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
10387         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
10388         [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
10389 };
10390
10391 static int nl80211_set_cqm_txe(struct genl_info *info,
10392                                u32 rate, u32 pkts, u32 intvl)
10393 {
10394         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10395         struct net_device *dev = info->user_ptr[1];
10396         struct wireless_dev *wdev = dev->ieee80211_ptr;
10397
10398         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
10399                 return -EINVAL;
10400
10401         if (!rdev->ops->set_cqm_txe_config)
10402                 return -EOPNOTSUPP;
10403
10404         if (wdev->iftype != NL80211_IFTYPE_STATION &&
10405             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
10406                 return -EOPNOTSUPP;
10407
10408         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
10409 }
10410
10411 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
10412                                     struct net_device *dev)
10413 {
10414         struct wireless_dev *wdev = dev->ieee80211_ptr;
10415         s32 last, low, high;
10416         u32 hyst;
10417         int i, n, low_index;
10418         int err;
10419
10420         /* RSSI reporting disabled? */
10421         if (!wdev->cqm_config)
10422                 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
10423
10424         /*
10425          * Obtain current RSSI value if possible, if not and no RSSI threshold
10426          * event has been received yet, we should receive an event after a
10427          * connection is established and enough beacons received to calculate
10428          * the average.
10429          */
10430         if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss &&
10431             rdev->ops->get_station) {
10432                 struct station_info sinfo = {};
10433                 u8 *mac_addr;
10434
10435                 mac_addr = wdev->current_bss->pub.bssid;
10436
10437                 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
10438                 if (err)
10439                         return err;
10440
10441                 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
10442                         wdev->cqm_config->last_rssi_event_value =
10443                                 (s8) sinfo.rx_beacon_signal_avg;
10444         }
10445
10446         last = wdev->cqm_config->last_rssi_event_value;
10447         hyst = wdev->cqm_config->rssi_hyst;
10448         n = wdev->cqm_config->n_rssi_thresholds;
10449
10450         for (i = 0; i < n; i++)
10451                 if (last < wdev->cqm_config->rssi_thresholds[i])
10452                         break;
10453
10454         low_index = i - 1;
10455         if (low_index >= 0) {
10456                 low_index = array_index_nospec(low_index, n);
10457                 low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;
10458         } else {
10459                 low = S32_MIN;
10460         }
10461         if (i < n) {
10462                 i = array_index_nospec(i, n);
10463                 high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;
10464         } else {
10465                 high = S32_MAX;
10466         }
10467
10468         return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
10469 }
10470
10471 static int nl80211_set_cqm_rssi(struct genl_info *info,
10472                                 const s32 *thresholds, int n_thresholds,
10473                                 u32 hysteresis)
10474 {
10475         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10476         struct net_device *dev = info->user_ptr[1];
10477         struct wireless_dev *wdev = dev->ieee80211_ptr;
10478         int i, err;
10479         s32 prev = S32_MIN;
10480
10481         /* Check all values negative and sorted */
10482         for (i = 0; i < n_thresholds; i++) {
10483                 if (thresholds[i] > 0 || thresholds[i] <= prev)
10484                         return -EINVAL;
10485
10486                 prev = thresholds[i];
10487         }
10488
10489         if (wdev->iftype != NL80211_IFTYPE_STATION &&
10490             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
10491                 return -EOPNOTSUPP;
10492
10493         wdev_lock(wdev);
10494         cfg80211_cqm_config_free(wdev);
10495         wdev_unlock(wdev);
10496
10497         if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
10498                 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
10499                         return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
10500
10501                 return rdev_set_cqm_rssi_config(rdev, dev,
10502                                                 thresholds[0], hysteresis);
10503         }
10504
10505         if (!wiphy_ext_feature_isset(&rdev->wiphy,
10506                                      NL80211_EXT_FEATURE_CQM_RSSI_LIST))
10507                 return -EOPNOTSUPP;
10508
10509         if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
10510                 n_thresholds = 0;
10511
10512         wdev_lock(wdev);
10513         if (n_thresholds) {
10514                 struct cfg80211_cqm_config *cqm_config;
10515
10516                 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) +
10517                                      n_thresholds * sizeof(s32), GFP_KERNEL);
10518                 if (!cqm_config) {
10519                         err = -ENOMEM;
10520                         goto unlock;
10521                 }
10522
10523                 cqm_config->rssi_hyst = hysteresis;
10524                 cqm_config->n_rssi_thresholds = n_thresholds;
10525                 memcpy(cqm_config->rssi_thresholds, thresholds,
10526                        n_thresholds * sizeof(s32));
10527
10528                 wdev->cqm_config = cqm_config;
10529         }
10530
10531         err = cfg80211_cqm_rssi_update(rdev, dev);
10532
10533 unlock:
10534         wdev_unlock(wdev);
10535
10536         return err;
10537 }
10538
10539 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
10540 {
10541         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
10542         struct nlattr *cqm;
10543         int err;
10544
10545         cqm = info->attrs[NL80211_ATTR_CQM];
10546         if (!cqm)
10547                 return -EINVAL;
10548
10549         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
10550                                nl80211_attr_cqm_policy, info->extack);
10551         if (err)
10552                 return err;
10553
10554         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
10555             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
10556                 const s32 *thresholds =
10557                         nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
10558                 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
10559                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
10560
10561                 if (len % 4)
10562                         return -EINVAL;
10563
10564                 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
10565                                             hysteresis);
10566         }
10567
10568         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
10569             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
10570             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
10571                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
10572                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
10573                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
10574
10575                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
10576         }
10577
10578         return -EINVAL;
10579 }
10580
10581 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
10582 {
10583         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10584         struct net_device *dev = info->user_ptr[1];
10585         struct ocb_setup setup = {};
10586         int err;
10587
10588         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
10589         if (err)
10590                 return err;
10591
10592         return cfg80211_join_ocb(rdev, dev, &setup);
10593 }
10594
10595 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
10596 {
10597         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10598         struct net_device *dev = info->user_ptr[1];
10599
10600         return cfg80211_leave_ocb(rdev, dev);
10601 }
10602
10603 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
10604 {
10605         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10606         struct net_device *dev = info->user_ptr[1];
10607         struct mesh_config cfg;
10608         struct mesh_setup setup;
10609         int err;
10610
10611         /* start with default */
10612         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
10613         memcpy(&setup, &default_mesh_setup, sizeof(setup));
10614
10615         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
10616                 /* and parse parameters if given */
10617                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
10618                 if (err)
10619                         return err;
10620         }
10621
10622         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
10623             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
10624                 return -EINVAL;
10625
10626         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
10627         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
10628
10629         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
10630             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
10631                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
10632                         return -EINVAL;
10633
10634         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
10635                 setup.beacon_interval =
10636                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
10637
10638                 err = cfg80211_validate_beacon_int(rdev,
10639                                                    NL80211_IFTYPE_MESH_POINT,
10640                                                    setup.beacon_interval);
10641                 if (err)
10642                         return err;
10643         }
10644
10645         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
10646                 setup.dtim_period =
10647                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
10648                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
10649                         return -EINVAL;
10650         }
10651
10652         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
10653                 /* parse additional setup parameters if given */
10654                 err = nl80211_parse_mesh_setup(info, &setup);
10655                 if (err)
10656                         return err;
10657         }
10658
10659         if (setup.user_mpm)
10660                 cfg.auto_open_plinks = false;
10661
10662         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
10663                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
10664                 if (err)
10665                         return err;
10666         } else {
10667                 /* __cfg80211_join_mesh() will sort it out */
10668                 setup.chandef.chan = NULL;
10669         }
10670
10671         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
10672                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10673                 int n_rates =
10674                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10675                 struct ieee80211_supported_band *sband;
10676
10677                 if (!setup.chandef.chan)
10678                         return -EINVAL;
10679
10680                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
10681
10682                 err = ieee80211_get_ratemask(sband, rates, n_rates,
10683                                              &setup.basic_rates);
10684                 if (err)
10685                         return err;
10686         }
10687
10688         if (info->attrs[NL80211_ATTR_TX_RATES]) {
10689                 err = nl80211_parse_tx_bitrate_mask(info, &setup.beacon_rate);
10690                 if (err)
10691                         return err;
10692
10693                 if (!setup.chandef.chan)
10694                         return -EINVAL;
10695
10696                 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
10697                                               &setup.beacon_rate);
10698                 if (err)
10699                         return err;
10700         }
10701
10702         setup.userspace_handles_dfs =
10703                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
10704
10705         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
10706                 int r = validate_pae_over_nl80211(rdev, info);
10707
10708                 if (r < 0)
10709                         return r;
10710
10711                 setup.control_port_over_nl80211 = true;
10712         }
10713
10714         wdev_lock(dev->ieee80211_ptr);
10715         err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
10716         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
10717                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
10718         wdev_unlock(dev->ieee80211_ptr);
10719
10720         return err;
10721 }
10722
10723 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
10724 {
10725         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10726         struct net_device *dev = info->user_ptr[1];
10727
10728         return cfg80211_leave_mesh(rdev, dev);
10729 }
10730
10731 #ifdef CONFIG_PM
10732 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
10733                                         struct cfg80211_registered_device *rdev)
10734 {
10735         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
10736         struct nlattr *nl_pats, *nl_pat;
10737         int i, pat_len;
10738
10739         if (!wowlan->n_patterns)
10740                 return 0;
10741
10742         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
10743         if (!nl_pats)
10744                 return -ENOBUFS;
10745
10746         for (i = 0; i < wowlan->n_patterns; i++) {
10747                 nl_pat = nla_nest_start(msg, i + 1);
10748                 if (!nl_pat)
10749                         return -ENOBUFS;
10750                 pat_len = wowlan->patterns[i].pattern_len;
10751                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
10752                             wowlan->patterns[i].mask) ||
10753                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
10754                             wowlan->patterns[i].pattern) ||
10755                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
10756                                 wowlan->patterns[i].pkt_offset))
10757                         return -ENOBUFS;
10758                 nla_nest_end(msg, nl_pat);
10759         }
10760         nla_nest_end(msg, nl_pats);
10761
10762         return 0;
10763 }
10764
10765 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
10766                                    struct cfg80211_wowlan_tcp *tcp)
10767 {
10768         struct nlattr *nl_tcp;
10769
10770         if (!tcp)
10771                 return 0;
10772
10773         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
10774         if (!nl_tcp)
10775                 return -ENOBUFS;
10776
10777         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
10778             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
10779             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
10780             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
10781             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
10782             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
10783                     tcp->payload_len, tcp->payload) ||
10784             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
10785                         tcp->data_interval) ||
10786             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
10787                     tcp->wake_len, tcp->wake_data) ||
10788             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
10789                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
10790                 return -ENOBUFS;
10791
10792         if (tcp->payload_seq.len &&
10793             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
10794                     sizeof(tcp->payload_seq), &tcp->payload_seq))
10795                 return -ENOBUFS;
10796
10797         if (tcp->payload_tok.len &&
10798             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
10799                     sizeof(tcp->payload_tok) + tcp->tokens_size,
10800                     &tcp->payload_tok))
10801                 return -ENOBUFS;
10802
10803         nla_nest_end(msg, nl_tcp);
10804
10805         return 0;
10806 }
10807
10808 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
10809                                   struct cfg80211_sched_scan_request *req)
10810 {
10811         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
10812         int i;
10813
10814         if (!req)
10815                 return 0;
10816
10817         nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
10818         if (!nd)
10819                 return -ENOBUFS;
10820
10821         if (req->n_scan_plans == 1 &&
10822             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
10823                         req->scan_plans[0].interval * 1000))
10824                 return -ENOBUFS;
10825
10826         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
10827                 return -ENOBUFS;
10828
10829         if (req->relative_rssi_set) {
10830                 struct nl80211_bss_select_rssi_adjust rssi_adjust;
10831
10832                 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
10833                                req->relative_rssi))
10834                         return -ENOBUFS;
10835
10836                 rssi_adjust.band = req->rssi_adjust.band;
10837                 rssi_adjust.delta = req->rssi_adjust.delta;
10838                 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
10839                             sizeof(rssi_adjust), &rssi_adjust))
10840                         return -ENOBUFS;
10841         }
10842
10843         freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
10844         if (!freqs)
10845                 return -ENOBUFS;
10846
10847         for (i = 0; i < req->n_channels; i++) {
10848                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
10849                         return -ENOBUFS;
10850         }
10851
10852         nla_nest_end(msg, freqs);
10853
10854         if (req->n_match_sets) {
10855                 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
10856                 if (!matches)
10857                         return -ENOBUFS;
10858
10859                 for (i = 0; i < req->n_match_sets; i++) {
10860                         match = nla_nest_start(msg, i);
10861                         if (!match)
10862                                 return -ENOBUFS;
10863
10864                         if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
10865                                     req->match_sets[i].ssid.ssid_len,
10866                                     req->match_sets[i].ssid.ssid))
10867                                 return -ENOBUFS;
10868                         nla_nest_end(msg, match);
10869                 }
10870                 nla_nest_end(msg, matches);
10871         }
10872
10873         scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
10874         if (!scan_plans)
10875                 return -ENOBUFS;
10876
10877         for (i = 0; i < req->n_scan_plans; i++) {
10878                 scan_plan = nla_nest_start(msg, i + 1);
10879                 if (!scan_plan)
10880                         return -ENOBUFS;
10881
10882                 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
10883                                 req->scan_plans[i].interval) ||
10884                     (req->scan_plans[i].iterations &&
10885                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
10886                                  req->scan_plans[i].iterations)))
10887                         return -ENOBUFS;
10888                 nla_nest_end(msg, scan_plan);
10889         }
10890         nla_nest_end(msg, scan_plans);
10891
10892         nla_nest_end(msg, nd);
10893
10894         return 0;
10895 }
10896
10897 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
10898 {
10899         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10900         struct sk_buff *msg;
10901         void *hdr;
10902         u32 size = NLMSG_DEFAULT_SIZE;
10903
10904         if (!rdev->wiphy.wowlan)
10905                 return -EOPNOTSUPP;
10906
10907         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
10908                 /* adjust size to have room for all the data */
10909                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
10910                         rdev->wiphy.wowlan_config->tcp->payload_len +
10911                         rdev->wiphy.wowlan_config->tcp->wake_len +
10912                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
10913         }
10914
10915         msg = nlmsg_new(size, GFP_KERNEL);
10916         if (!msg)
10917                 return -ENOMEM;
10918
10919         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10920                              NL80211_CMD_GET_WOWLAN);
10921         if (!hdr)
10922                 goto nla_put_failure;
10923
10924         if (rdev->wiphy.wowlan_config) {
10925                 struct nlattr *nl_wowlan;
10926
10927                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
10928                 if (!nl_wowlan)
10929                         goto nla_put_failure;
10930
10931                 if ((rdev->wiphy.wowlan_config->any &&
10932                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
10933                     (rdev->wiphy.wowlan_config->disconnect &&
10934                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
10935                     (rdev->wiphy.wowlan_config->magic_pkt &&
10936                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
10937                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
10938                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
10939                     (rdev->wiphy.wowlan_config->eap_identity_req &&
10940                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
10941                     (rdev->wiphy.wowlan_config->four_way_handshake &&
10942                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
10943                     (rdev->wiphy.wowlan_config->rfkill_release &&
10944                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
10945                         goto nla_put_failure;
10946
10947                 if (nl80211_send_wowlan_patterns(msg, rdev))
10948                         goto nla_put_failure;
10949
10950                 if (nl80211_send_wowlan_tcp(msg,
10951                                             rdev->wiphy.wowlan_config->tcp))
10952                         goto nla_put_failure;
10953
10954                 if (nl80211_send_wowlan_nd(
10955                             msg,
10956                             rdev->wiphy.wowlan_config->nd_config))
10957                         goto nla_put_failure;
10958
10959                 nla_nest_end(msg, nl_wowlan);
10960         }
10961
10962         genlmsg_end(msg, hdr);
10963         return genlmsg_reply(msg, info);
10964
10965 nla_put_failure:
10966         nlmsg_free(msg);
10967         return -ENOBUFS;
10968 }
10969
10970 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
10971                                     struct nlattr *attr,
10972                                     struct cfg80211_wowlan *trig)
10973 {
10974         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
10975         struct cfg80211_wowlan_tcp *cfg;
10976         struct nl80211_wowlan_tcp_data_token *tok = NULL;
10977         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
10978         u32 size;
10979         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
10980         int err, port;
10981
10982         if (!rdev->wiphy.wowlan->tcp)
10983                 return -EINVAL;
10984
10985         err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TCP, attr,
10986                                nl80211_wowlan_tcp_policy, NULL);
10987         if (err)
10988                 return err;
10989
10990         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
10991             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
10992             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
10993             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
10994             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
10995             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
10996             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
10997             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
10998                 return -EINVAL;
10999
11000         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
11001         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
11002                 return -EINVAL;
11003
11004         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
11005                         rdev->wiphy.wowlan->tcp->data_interval_max ||
11006             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
11007                 return -EINVAL;
11008
11009         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
11010         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
11011                 return -EINVAL;
11012
11013         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
11014         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
11015                 return -EINVAL;
11016
11017         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
11018                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
11019
11020                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
11021                 tokens_size = tokln - sizeof(*tok);
11022
11023                 if (!tok->len || tokens_size % tok->len)
11024                         return -EINVAL;
11025                 if (!rdev->wiphy.wowlan->tcp->tok)
11026                         return -EINVAL;
11027                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
11028                         return -EINVAL;
11029                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
11030                         return -EINVAL;
11031                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
11032                         return -EINVAL;
11033                 if (tok->offset + tok->len > data_size)
11034                         return -EINVAL;
11035         }
11036
11037         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
11038                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
11039                 if (!rdev->wiphy.wowlan->tcp->seq)
11040                         return -EINVAL;
11041                 if (seq->len == 0 || seq->len > 4)
11042                         return -EINVAL;
11043                 if (seq->len + seq->offset > data_size)
11044                         return -EINVAL;
11045         }
11046
11047         size = sizeof(*cfg);
11048         size += data_size;
11049         size += wake_size + wake_mask_size;
11050         size += tokens_size;
11051
11052         cfg = kzalloc(size, GFP_KERNEL);
11053         if (!cfg)
11054                 return -ENOMEM;
11055         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
11056         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
11057         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
11058                ETH_ALEN);
11059         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
11060                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
11061         else
11062                 port = 0;
11063 #ifdef CONFIG_INET
11064         /* allocate a socket and port for it and use it */
11065         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
11066                             IPPROTO_TCP, &cfg->sock, 1);
11067         if (err) {
11068                 kfree(cfg);
11069                 return err;
11070         }
11071         if (inet_csk_get_port(cfg->sock->sk, port)) {
11072                 sock_release(cfg->sock);
11073                 kfree(cfg);
11074                 return -EADDRINUSE;
11075         }
11076         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
11077 #else
11078         if (!port) {
11079                 kfree(cfg);
11080                 return -EINVAL;
11081         }
11082         cfg->src_port = port;
11083 #endif
11084
11085         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
11086         cfg->payload_len = data_size;
11087         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
11088         memcpy((void *)cfg->payload,
11089                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
11090                data_size);
11091         if (seq)
11092                 cfg->payload_seq = *seq;
11093         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
11094         cfg->wake_len = wake_size;
11095         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
11096         memcpy((void *)cfg->wake_data,
11097                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
11098                wake_size);
11099         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
11100                          data_size + wake_size;
11101         memcpy((void *)cfg->wake_mask,
11102                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
11103                wake_mask_size);
11104         if (tok) {
11105                 cfg->tokens_size = tokens_size;
11106                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
11107         }
11108
11109         trig->tcp = cfg;
11110
11111         return 0;
11112 }
11113
11114 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
11115                                    const struct wiphy_wowlan_support *wowlan,
11116                                    struct nlattr *attr,
11117                                    struct cfg80211_wowlan *trig)
11118 {
11119         struct nlattr **tb;
11120         int err;
11121
11122         tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
11123         if (!tb)
11124                 return -ENOMEM;
11125
11126         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
11127                 err = -EOPNOTSUPP;
11128                 goto out;
11129         }
11130
11131         err = nla_parse_nested(tb, NL80211_ATTR_MAX, attr, nl80211_policy,
11132                                NULL);
11133         if (err)
11134                 goto out;
11135
11136         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
11137                                                    wowlan->max_nd_match_sets);
11138         err = PTR_ERR_OR_ZERO(trig->nd_config);
11139         if (err)
11140                 trig->nd_config = NULL;
11141
11142 out:
11143         kfree(tb);
11144         return err;
11145 }
11146
11147 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
11148 {
11149         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11150         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
11151         struct cfg80211_wowlan new_triggers = {};
11152         struct cfg80211_wowlan *ntrig;
11153         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
11154         int err, i;
11155         bool prev_enabled = rdev->wiphy.wowlan_config;
11156         bool regular = false;
11157
11158         if (!wowlan)
11159                 return -EOPNOTSUPP;
11160
11161         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
11162                 cfg80211_rdev_free_wowlan(rdev);
11163                 rdev->wiphy.wowlan_config = NULL;
11164                 goto set_wakeup;
11165         }
11166
11167         err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TRIG,
11168                                info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
11169                                nl80211_wowlan_policy, info->extack);
11170         if (err)
11171                 return err;
11172
11173         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
11174                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
11175                         return -EINVAL;
11176                 new_triggers.any = true;
11177         }
11178
11179         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
11180                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
11181                         return -EINVAL;
11182                 new_triggers.disconnect = true;
11183                 regular = true;
11184         }
11185
11186         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
11187                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
11188                         return -EINVAL;
11189                 new_triggers.magic_pkt = true;
11190                 regular = true;
11191         }
11192
11193         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
11194                 return -EINVAL;
11195
11196         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
11197                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
11198                         return -EINVAL;
11199                 new_triggers.gtk_rekey_failure = true;
11200                 regular = true;
11201         }
11202
11203         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
11204                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
11205                         return -EINVAL;
11206                 new_triggers.eap_identity_req = true;
11207                 regular = true;
11208         }
11209
11210         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
11211                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
11212                         return -EINVAL;
11213                 new_triggers.four_way_handshake = true;
11214                 regular = true;
11215         }
11216
11217         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
11218                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
11219                         return -EINVAL;
11220                 new_triggers.rfkill_release = true;
11221                 regular = true;
11222         }
11223
11224         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
11225                 struct nlattr *pat;
11226                 int n_patterns = 0;
11227                 int rem, pat_len, mask_len, pkt_offset;
11228                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
11229
11230                 regular = true;
11231
11232                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
11233                                     rem)
11234                         n_patterns++;
11235                 if (n_patterns > wowlan->n_patterns)
11236                         return -EINVAL;
11237
11238                 new_triggers.patterns = kcalloc(n_patterns,
11239                                                 sizeof(new_triggers.patterns[0]),
11240                                                 GFP_KERNEL);
11241                 if (!new_triggers.patterns)
11242                         return -ENOMEM;
11243
11244                 new_triggers.n_patterns = n_patterns;
11245                 i = 0;
11246
11247                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
11248                                     rem) {
11249                         u8 *mask_pat;
11250
11251                         err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
11252                                                nl80211_packet_pattern_policy,
11253                                                info->extack);
11254                         if (err)
11255                                 goto error;
11256
11257                         err = -EINVAL;
11258                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
11259                             !pat_tb[NL80211_PKTPAT_PATTERN])
11260                                 goto error;
11261                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
11262                         mask_len = DIV_ROUND_UP(pat_len, 8);
11263                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
11264                                 goto error;
11265                         if (pat_len > wowlan->pattern_max_len ||
11266                             pat_len < wowlan->pattern_min_len)
11267                                 goto error;
11268
11269                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
11270                                 pkt_offset = 0;
11271                         else
11272                                 pkt_offset = nla_get_u32(
11273                                         pat_tb[NL80211_PKTPAT_OFFSET]);
11274                         if (pkt_offset > wowlan->max_pkt_offset)
11275                                 goto error;
11276                         new_triggers.patterns[i].pkt_offset = pkt_offset;
11277
11278                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
11279                         if (!mask_pat) {
11280                                 err = -ENOMEM;
11281                                 goto error;
11282                         }
11283                         new_triggers.patterns[i].mask = mask_pat;
11284                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
11285                                mask_len);
11286                         mask_pat += mask_len;
11287                         new_triggers.patterns[i].pattern = mask_pat;
11288                         new_triggers.patterns[i].pattern_len = pat_len;
11289                         memcpy(mask_pat,
11290                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
11291                                pat_len);
11292                         i++;
11293                 }
11294         }
11295
11296         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
11297                 regular = true;
11298                 err = nl80211_parse_wowlan_tcp(
11299                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
11300                         &new_triggers);
11301                 if (err)
11302                         goto error;
11303         }
11304
11305         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
11306                 regular = true;
11307                 err = nl80211_parse_wowlan_nd(
11308                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
11309                         &new_triggers);
11310                 if (err)
11311                         goto error;
11312         }
11313
11314         /* The 'any' trigger means the device continues operating more or less
11315          * as in its normal operation mode and wakes up the host on most of the
11316          * normal interrupts (like packet RX, ...)
11317          * It therefore makes little sense to combine with the more constrained
11318          * wakeup trigger modes.
11319          */
11320         if (new_triggers.any && regular) {
11321                 err = -EINVAL;
11322                 goto error;
11323         }
11324
11325         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
11326         if (!ntrig) {
11327                 err = -ENOMEM;
11328                 goto error;
11329         }
11330         cfg80211_rdev_free_wowlan(rdev);
11331         rdev->wiphy.wowlan_config = ntrig;
11332
11333  set_wakeup:
11334         if (rdev->ops->set_wakeup &&
11335             prev_enabled != !!rdev->wiphy.wowlan_config)
11336                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
11337
11338         return 0;
11339  error:
11340         for (i = 0; i < new_triggers.n_patterns; i++)
11341                 kfree(new_triggers.patterns[i].mask);
11342         kfree(new_triggers.patterns);
11343         if (new_triggers.tcp && new_triggers.tcp->sock)
11344                 sock_release(new_triggers.tcp->sock);
11345         kfree(new_triggers.tcp);
11346         kfree(new_triggers.nd_config);
11347         return err;
11348 }
11349 #endif
11350
11351 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
11352                                        struct cfg80211_registered_device *rdev)
11353 {
11354         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
11355         int i, j, pat_len;
11356         struct cfg80211_coalesce_rules *rule;
11357
11358         if (!rdev->coalesce->n_rules)
11359                 return 0;
11360
11361         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
11362         if (!nl_rules)
11363                 return -ENOBUFS;
11364
11365         for (i = 0; i < rdev->coalesce->n_rules; i++) {
11366                 nl_rule = nla_nest_start(msg, i + 1);
11367                 if (!nl_rule)
11368                         return -ENOBUFS;
11369
11370                 rule = &rdev->coalesce->rules[i];
11371                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
11372                                 rule->delay))
11373                         return -ENOBUFS;
11374
11375                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
11376                                 rule->condition))
11377                         return -ENOBUFS;
11378
11379                 nl_pats = nla_nest_start(msg,
11380                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
11381                 if (!nl_pats)
11382                         return -ENOBUFS;
11383
11384                 for (j = 0; j < rule->n_patterns; j++) {
11385                         nl_pat = nla_nest_start(msg, j + 1);
11386                         if (!nl_pat)
11387                                 return -ENOBUFS;
11388                         pat_len = rule->patterns[j].pattern_len;
11389                         if (nla_put(msg, NL80211_PKTPAT_MASK,
11390                                     DIV_ROUND_UP(pat_len, 8),
11391                                     rule->patterns[j].mask) ||
11392                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
11393                                     rule->patterns[j].pattern) ||
11394                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
11395                                         rule->patterns[j].pkt_offset))
11396                                 return -ENOBUFS;
11397                         nla_nest_end(msg, nl_pat);
11398                 }
11399                 nla_nest_end(msg, nl_pats);
11400                 nla_nest_end(msg, nl_rule);
11401         }
11402         nla_nest_end(msg, nl_rules);
11403
11404         return 0;
11405 }
11406
11407 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
11408 {
11409         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11410         struct sk_buff *msg;
11411         void *hdr;
11412
11413         if (!rdev->wiphy.coalesce)
11414                 return -EOPNOTSUPP;
11415
11416         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11417         if (!msg)
11418                 return -ENOMEM;
11419
11420         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11421                              NL80211_CMD_GET_COALESCE);
11422         if (!hdr)
11423                 goto nla_put_failure;
11424
11425         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
11426                 goto nla_put_failure;
11427
11428         genlmsg_end(msg, hdr);
11429         return genlmsg_reply(msg, info);
11430
11431 nla_put_failure:
11432         nlmsg_free(msg);
11433         return -ENOBUFS;
11434 }
11435
11436 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
11437 {
11438         struct cfg80211_coalesce *coalesce = rdev->coalesce;
11439         int i, j;
11440         struct cfg80211_coalesce_rules *rule;
11441
11442         if (!coalesce)
11443                 return;
11444
11445         for (i = 0; i < coalesce->n_rules; i++) {
11446                 rule = &coalesce->rules[i];
11447                 for (j = 0; j < rule->n_patterns; j++)
11448                         kfree(rule->patterns[j].mask);
11449                 kfree(rule->patterns);
11450         }
11451         kfree(coalesce->rules);
11452         kfree(coalesce);
11453         rdev->coalesce = NULL;
11454 }
11455
11456 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
11457                                        struct nlattr *rule,
11458                                        struct cfg80211_coalesce_rules *new_rule)
11459 {
11460         int err, i;
11461         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
11462         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
11463         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
11464         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
11465
11466         err = nla_parse_nested(tb, NL80211_ATTR_COALESCE_RULE_MAX, rule,
11467                                nl80211_coalesce_policy, NULL);
11468         if (err)
11469                 return err;
11470
11471         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
11472                 new_rule->delay =
11473                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
11474         if (new_rule->delay > coalesce->max_delay)
11475                 return -EINVAL;
11476
11477         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
11478                 new_rule->condition =
11479                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
11480
11481         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
11482                 return -EINVAL;
11483
11484         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
11485                             rem)
11486                 n_patterns++;
11487         if (n_patterns > coalesce->n_patterns)
11488                 return -EINVAL;
11489
11490         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
11491                                      GFP_KERNEL);
11492         if (!new_rule->patterns)
11493                 return -ENOMEM;
11494
11495         new_rule->n_patterns = n_patterns;
11496         i = 0;
11497
11498         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
11499                             rem) {
11500                 u8 *mask_pat;
11501
11502                 err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
11503                                        nl80211_packet_pattern_policy, NULL);
11504                 if (err)
11505                         return err;
11506
11507                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
11508                     !pat_tb[NL80211_PKTPAT_PATTERN])
11509                         return -EINVAL;
11510                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
11511                 mask_len = DIV_ROUND_UP(pat_len, 8);
11512                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
11513                         return -EINVAL;
11514                 if (pat_len > coalesce->pattern_max_len ||
11515                     pat_len < coalesce->pattern_min_len)
11516                         return -EINVAL;
11517
11518                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
11519                         pkt_offset = 0;
11520                 else
11521                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
11522                 if (pkt_offset > coalesce->max_pkt_offset)
11523                         return -EINVAL;
11524                 new_rule->patterns[i].pkt_offset = pkt_offset;
11525
11526                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
11527                 if (!mask_pat)
11528                         return -ENOMEM;
11529
11530                 new_rule->patterns[i].mask = mask_pat;
11531                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
11532                        mask_len);
11533
11534                 mask_pat += mask_len;
11535                 new_rule->patterns[i].pattern = mask_pat;
11536                 new_rule->patterns[i].pattern_len = pat_len;
11537                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
11538                        pat_len);
11539                 i++;
11540         }
11541
11542         return 0;
11543 }
11544
11545 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
11546 {
11547         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11548         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
11549         struct cfg80211_coalesce new_coalesce = {};
11550         struct cfg80211_coalesce *n_coalesce;
11551         int err, rem_rule, n_rules = 0, i, j;
11552         struct nlattr *rule;
11553         struct cfg80211_coalesce_rules *tmp_rule;
11554
11555         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
11556                 return -EOPNOTSUPP;
11557
11558         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
11559                 cfg80211_rdev_free_coalesce(rdev);
11560                 rdev_set_coalesce(rdev, NULL);
11561                 return 0;
11562         }
11563
11564         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
11565                             rem_rule)
11566                 n_rules++;
11567         if (n_rules > coalesce->n_rules)
11568                 return -EINVAL;
11569
11570         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
11571                                      GFP_KERNEL);
11572         if (!new_coalesce.rules)
11573                 return -ENOMEM;
11574
11575         new_coalesce.n_rules = n_rules;
11576         i = 0;
11577
11578         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
11579                             rem_rule) {
11580                 err = nl80211_parse_coalesce_rule(rdev, rule,
11581                                                   &new_coalesce.rules[i]);
11582                 if (err)
11583                         goto error;
11584
11585                 i++;
11586         }
11587
11588         err = rdev_set_coalesce(rdev, &new_coalesce);
11589         if (err)
11590                 goto error;
11591
11592         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
11593         if (!n_coalesce) {
11594                 err = -ENOMEM;
11595                 goto error;
11596         }
11597         cfg80211_rdev_free_coalesce(rdev);
11598         rdev->coalesce = n_coalesce;
11599
11600         return 0;
11601 error:
11602         for (i = 0; i < new_coalesce.n_rules; i++) {
11603                 tmp_rule = &new_coalesce.rules[i];
11604                 for (j = 0; j < tmp_rule->n_patterns; j++)
11605                         kfree(tmp_rule->patterns[j].mask);
11606                 kfree(tmp_rule->patterns);
11607         }
11608         kfree(new_coalesce.rules);
11609
11610         return err;
11611 }
11612
11613 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
11614 {
11615         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11616         struct net_device *dev = info->user_ptr[1];
11617         struct wireless_dev *wdev = dev->ieee80211_ptr;
11618         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
11619         struct cfg80211_gtk_rekey_data rekey_data;
11620         int err;
11621
11622         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
11623                 return -EINVAL;
11624
11625         err = nla_parse_nested(tb, MAX_NL80211_REKEY_DATA,
11626                                info->attrs[NL80211_ATTR_REKEY_DATA],
11627                                nl80211_rekey_policy, info->extack);
11628         if (err)
11629                 return err;
11630
11631         if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
11632             !tb[NL80211_REKEY_DATA_KCK])
11633                 return -EINVAL;
11634         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
11635                 return -ERANGE;
11636         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
11637                 return -ERANGE;
11638         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
11639                 return -ERANGE;
11640
11641         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
11642         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
11643         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
11644
11645         wdev_lock(wdev);
11646         if (!wdev->current_bss) {
11647                 err = -ENOTCONN;
11648                 goto out;
11649         }
11650
11651         if (!rdev->ops->set_rekey_data) {
11652                 err = -EOPNOTSUPP;
11653                 goto out;
11654         }
11655
11656         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
11657  out:
11658         wdev_unlock(wdev);
11659         return err;
11660 }
11661
11662 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
11663                                              struct genl_info *info)
11664 {
11665         struct net_device *dev = info->user_ptr[1];
11666         struct wireless_dev *wdev = dev->ieee80211_ptr;
11667
11668         if (wdev->iftype != NL80211_IFTYPE_AP &&
11669             wdev->iftype != NL80211_IFTYPE_P2P_GO)
11670                 return -EINVAL;
11671
11672         if (wdev->ap_unexpected_nlportid)
11673                 return -EBUSY;
11674
11675         wdev->ap_unexpected_nlportid = info->snd_portid;
11676         return 0;
11677 }
11678
11679 static int nl80211_probe_client(struct sk_buff *skb,
11680                                 struct genl_info *info)
11681 {
11682         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11683         struct net_device *dev = info->user_ptr[1];
11684         struct wireless_dev *wdev = dev->ieee80211_ptr;
11685         struct sk_buff *msg;
11686         void *hdr;
11687         const u8 *addr;
11688         u64 cookie;
11689         int err;
11690
11691         if (wdev->iftype != NL80211_IFTYPE_AP &&
11692             wdev->iftype != NL80211_IFTYPE_P2P_GO)
11693                 return -EOPNOTSUPP;
11694
11695         if (!info->attrs[NL80211_ATTR_MAC])
11696                 return -EINVAL;
11697
11698         if (!rdev->ops->probe_client)
11699                 return -EOPNOTSUPP;
11700
11701         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11702         if (!msg)
11703                 return -ENOMEM;
11704
11705         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11706                              NL80211_CMD_PROBE_CLIENT);
11707         if (!hdr) {
11708                 err = -ENOBUFS;
11709                 goto free_msg;
11710         }
11711
11712         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
11713
11714         err = rdev_probe_client(rdev, dev, addr, &cookie);
11715         if (err)
11716                 goto free_msg;
11717
11718         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11719                               NL80211_ATTR_PAD))
11720                 goto nla_put_failure;
11721
11722         genlmsg_end(msg, hdr);
11723
11724         return genlmsg_reply(msg, info);
11725
11726  nla_put_failure:
11727         err = -ENOBUFS;
11728  free_msg:
11729         nlmsg_free(msg);
11730         return err;
11731 }
11732
11733 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
11734 {
11735         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11736         struct cfg80211_beacon_registration *reg, *nreg;
11737         int rv;
11738
11739         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
11740                 return -EOPNOTSUPP;
11741
11742         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
11743         if (!nreg)
11744                 return -ENOMEM;
11745
11746         /* First, check if already registered. */
11747         spin_lock_bh(&rdev->beacon_registrations_lock);
11748         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
11749                 if (reg->nlportid == info->snd_portid) {
11750                         rv = -EALREADY;
11751                         goto out_err;
11752                 }
11753         }
11754         /* Add it to the list */
11755         nreg->nlportid = info->snd_portid;
11756         list_add(&nreg->list, &rdev->beacon_registrations);
11757
11758         spin_unlock_bh(&rdev->beacon_registrations_lock);
11759
11760         return 0;
11761 out_err:
11762         spin_unlock_bh(&rdev->beacon_registrations_lock);
11763         kfree(nreg);
11764         return rv;
11765 }
11766
11767 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
11768 {
11769         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11770         struct wireless_dev *wdev = info->user_ptr[1];
11771         int err;
11772
11773         if (!rdev->ops->start_p2p_device)
11774                 return -EOPNOTSUPP;
11775
11776         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11777                 return -EOPNOTSUPP;
11778
11779         if (wdev_running(wdev))
11780                 return 0;
11781
11782         if (rfkill_blocked(rdev->rfkill))
11783                 return -ERFKILL;
11784
11785         err = rdev_start_p2p_device(rdev, wdev);
11786         if (err)
11787                 return err;
11788
11789         wdev->is_running = true;
11790         rdev->opencount++;
11791
11792         return 0;
11793 }
11794
11795 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
11796 {
11797         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11798         struct wireless_dev *wdev = info->user_ptr[1];
11799
11800         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11801                 return -EOPNOTSUPP;
11802
11803         if (!rdev->ops->stop_p2p_device)
11804                 return -EOPNOTSUPP;
11805
11806         cfg80211_stop_p2p_device(rdev, wdev);
11807
11808         return 0;
11809 }
11810
11811 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
11812 {
11813         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11814         struct wireless_dev *wdev = info->user_ptr[1];
11815         struct cfg80211_nan_conf conf = {};
11816         int err;
11817
11818         if (wdev->iftype != NL80211_IFTYPE_NAN)
11819                 return -EOPNOTSUPP;
11820
11821         if (wdev_running(wdev))
11822                 return -EEXIST;
11823
11824         if (rfkill_blocked(rdev->rfkill))
11825                 return -ERFKILL;
11826
11827         if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
11828                 return -EINVAL;
11829
11830         conf.master_pref =
11831                 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
11832
11833         if (info->attrs[NL80211_ATTR_BANDS]) {
11834                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
11835
11836                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
11837                         return -EOPNOTSUPP;
11838
11839                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
11840                         return -EINVAL;
11841
11842                 conf.bands = bands;
11843         }
11844
11845         err = rdev_start_nan(rdev, wdev, &conf);
11846         if (err)
11847                 return err;
11848
11849         wdev->is_running = true;
11850         rdev->opencount++;
11851
11852         return 0;
11853 }
11854
11855 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
11856 {
11857         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11858         struct wireless_dev *wdev = info->user_ptr[1];
11859
11860         if (wdev->iftype != NL80211_IFTYPE_NAN)
11861                 return -EOPNOTSUPP;
11862
11863         cfg80211_stop_nan(rdev, wdev);
11864
11865         return 0;
11866 }
11867
11868 static int validate_nan_filter(struct nlattr *filter_attr)
11869 {
11870         struct nlattr *attr;
11871         int len = 0, n_entries = 0, rem;
11872
11873         nla_for_each_nested(attr, filter_attr, rem) {
11874                 len += nla_len(attr);
11875                 n_entries++;
11876         }
11877
11878         if (len >= U8_MAX)
11879                 return -EINVAL;
11880
11881         return n_entries;
11882 }
11883
11884 static int handle_nan_filter(struct nlattr *attr_filter,
11885                              struct cfg80211_nan_func *func,
11886                              bool tx)
11887 {
11888         struct nlattr *attr;
11889         int n_entries, rem, i;
11890         struct cfg80211_nan_func_filter *filter;
11891
11892         n_entries = validate_nan_filter(attr_filter);
11893         if (n_entries < 0)
11894                 return n_entries;
11895
11896         BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
11897
11898         filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
11899         if (!filter)
11900                 return -ENOMEM;
11901
11902         i = 0;
11903         nla_for_each_nested(attr, attr_filter, rem) {
11904                 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
11905                 filter[i].len = nla_len(attr);
11906                 i++;
11907         }
11908         if (tx) {
11909                 func->num_tx_filters = n_entries;
11910                 func->tx_filters = filter;
11911         } else {
11912                 func->num_rx_filters = n_entries;
11913                 func->rx_filters = filter;
11914         }
11915
11916         return 0;
11917 }
11918
11919 static int nl80211_nan_add_func(struct sk_buff *skb,
11920                                 struct genl_info *info)
11921 {
11922         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11923         struct wireless_dev *wdev = info->user_ptr[1];
11924         struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
11925         struct cfg80211_nan_func *func;
11926         struct sk_buff *msg = NULL;
11927         void *hdr = NULL;
11928         int err = 0;
11929
11930         if (wdev->iftype != NL80211_IFTYPE_NAN)
11931                 return -EOPNOTSUPP;
11932
11933         if (!wdev_running(wdev))
11934                 return -ENOTCONN;
11935
11936         if (!info->attrs[NL80211_ATTR_NAN_FUNC])
11937                 return -EINVAL;
11938
11939         err = nla_parse_nested(tb, NL80211_NAN_FUNC_ATTR_MAX,
11940                                info->attrs[NL80211_ATTR_NAN_FUNC],
11941                                nl80211_nan_func_policy, info->extack);
11942         if (err)
11943                 return err;
11944
11945         func = kzalloc(sizeof(*func), GFP_KERNEL);
11946         if (!func)
11947                 return -ENOMEM;
11948
11949         func->cookie = cfg80211_assign_cookie(rdev);
11950
11951         if (!tb[NL80211_NAN_FUNC_TYPE] ||
11952             nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]) > NL80211_NAN_FUNC_MAX_TYPE) {
11953                 err = -EINVAL;
11954                 goto out;
11955         }
11956
11957
11958         func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
11959
11960         if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
11961                 err = -EINVAL;
11962                 goto out;
11963         }
11964
11965         memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
11966                sizeof(func->service_id));
11967
11968         func->close_range =
11969                 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
11970
11971         if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
11972                 func->serv_spec_info_len =
11973                         nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
11974                 func->serv_spec_info =
11975                         kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
11976                                 func->serv_spec_info_len,
11977                                 GFP_KERNEL);
11978                 if (!func->serv_spec_info) {
11979                         err = -ENOMEM;
11980                         goto out;
11981                 }
11982         }
11983
11984         if (tb[NL80211_NAN_FUNC_TTL])
11985                 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
11986
11987         switch (func->type) {
11988         case NL80211_NAN_FUNC_PUBLISH:
11989                 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
11990                         err = -EINVAL;
11991                         goto out;
11992                 }
11993
11994                 func->publish_type =
11995                         nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
11996                 func->publish_bcast =
11997                         nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
11998
11999                 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
12000                         func->publish_bcast) {
12001                         err = -EINVAL;
12002                         goto out;
12003                 }
12004                 break;
12005         case NL80211_NAN_FUNC_SUBSCRIBE:
12006                 func->subscribe_active =
12007                         nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
12008                 break;
12009         case NL80211_NAN_FUNC_FOLLOW_UP:
12010                 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
12011                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
12012                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
12013                         err = -EINVAL;
12014                         goto out;
12015                 }
12016
12017                 func->followup_id =
12018                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
12019                 func->followup_reqid =
12020                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
12021                 memcpy(func->followup_dest.addr,
12022                        nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
12023                        sizeof(func->followup_dest.addr));
12024                 if (func->ttl) {
12025                         err = -EINVAL;
12026                         goto out;
12027                 }
12028                 break;
12029         default:
12030                 err = -EINVAL;
12031                 goto out;
12032         }
12033
12034         if (tb[NL80211_NAN_FUNC_SRF]) {
12035                 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
12036
12037                 err = nla_parse_nested(srf_tb, NL80211_NAN_SRF_ATTR_MAX,
12038                                        tb[NL80211_NAN_FUNC_SRF],
12039                                        nl80211_nan_srf_policy, info->extack);
12040                 if (err)
12041                         goto out;
12042
12043                 func->srf_include =
12044                         nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
12045
12046                 if (srf_tb[NL80211_NAN_SRF_BF]) {
12047                         if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
12048                             !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
12049                                 err = -EINVAL;
12050                                 goto out;
12051                         }
12052
12053                         func->srf_bf_len =
12054                                 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
12055                         func->srf_bf =
12056                                 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
12057                                         func->srf_bf_len, GFP_KERNEL);
12058                         if (!func->srf_bf) {
12059                                 err = -ENOMEM;
12060                                 goto out;
12061                         }
12062
12063                         func->srf_bf_idx =
12064                                 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
12065                 } else {
12066                         struct nlattr *attr, *mac_attr =
12067                                 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
12068                         int n_entries, rem, i = 0;
12069
12070                         if (!mac_attr) {
12071                                 err = -EINVAL;
12072                                 goto out;
12073                         }
12074
12075                         n_entries = validate_acl_mac_addrs(mac_attr);
12076                         if (n_entries <= 0) {
12077                                 err = -EINVAL;
12078                                 goto out;
12079                         }
12080
12081                         func->srf_num_macs = n_entries;
12082                         func->srf_macs =
12083                                 kcalloc(n_entries, sizeof(*func->srf_macs),
12084                                         GFP_KERNEL);
12085                         if (!func->srf_macs) {
12086                                 err = -ENOMEM;
12087                                 goto out;
12088                         }
12089
12090                         nla_for_each_nested(attr, mac_attr, rem)
12091                                 memcpy(func->srf_macs[i++].addr, nla_data(attr),
12092                                        sizeof(*func->srf_macs));
12093                 }
12094         }
12095
12096         if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
12097                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
12098                                         func, true);
12099                 if (err)
12100                         goto out;
12101         }
12102
12103         if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
12104                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
12105                                         func, false);
12106                 if (err)
12107                         goto out;
12108         }
12109
12110         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12111         if (!msg) {
12112                 err = -ENOMEM;
12113                 goto out;
12114         }
12115
12116         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12117                              NL80211_CMD_ADD_NAN_FUNCTION);
12118         /* This can't really happen - we just allocated 4KB */
12119         if (WARN_ON(!hdr)) {
12120                 err = -ENOMEM;
12121                 goto out;
12122         }
12123
12124         err = rdev_add_nan_func(rdev, wdev, func);
12125 out:
12126         if (err < 0) {
12127                 cfg80211_free_nan_func(func);
12128                 nlmsg_free(msg);
12129                 return err;
12130         }
12131
12132         /* propagate the instance id and cookie to userspace  */
12133         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
12134                               NL80211_ATTR_PAD))
12135                 goto nla_put_failure;
12136
12137         func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
12138         if (!func_attr)
12139                 goto nla_put_failure;
12140
12141         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
12142                        func->instance_id))
12143                 goto nla_put_failure;
12144
12145         nla_nest_end(msg, func_attr);
12146
12147         genlmsg_end(msg, hdr);
12148         return genlmsg_reply(msg, info);
12149
12150 nla_put_failure:
12151         nlmsg_free(msg);
12152         return -ENOBUFS;
12153 }
12154
12155 static int nl80211_nan_del_func(struct sk_buff *skb,
12156                                struct genl_info *info)
12157 {
12158         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12159         struct wireless_dev *wdev = info->user_ptr[1];
12160         u64 cookie;
12161
12162         if (wdev->iftype != NL80211_IFTYPE_NAN)
12163                 return -EOPNOTSUPP;
12164
12165         if (!wdev_running(wdev))
12166                 return -ENOTCONN;
12167
12168         if (!info->attrs[NL80211_ATTR_COOKIE])
12169                 return -EINVAL;
12170
12171         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12172
12173         rdev_del_nan_func(rdev, wdev, cookie);
12174
12175         return 0;
12176 }
12177
12178 static int nl80211_nan_change_config(struct sk_buff *skb,
12179                                      struct genl_info *info)
12180 {
12181         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12182         struct wireless_dev *wdev = info->user_ptr[1];
12183         struct cfg80211_nan_conf conf = {};
12184         u32 changed = 0;
12185
12186         if (wdev->iftype != NL80211_IFTYPE_NAN)
12187                 return -EOPNOTSUPP;
12188
12189         if (!wdev_running(wdev))
12190                 return -ENOTCONN;
12191
12192         if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
12193                 conf.master_pref =
12194                         nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
12195                 if (conf.master_pref <= 1 || conf.master_pref == 255)
12196                         return -EINVAL;
12197
12198                 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
12199         }
12200
12201         if (info->attrs[NL80211_ATTR_BANDS]) {
12202                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
12203
12204                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
12205                         return -EOPNOTSUPP;
12206
12207                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
12208                         return -EINVAL;
12209
12210                 conf.bands = bands;
12211                 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
12212         }
12213
12214         if (!changed)
12215                 return -EINVAL;
12216
12217         return rdev_nan_change_conf(rdev, wdev, &conf, changed);
12218 }
12219
12220 void cfg80211_nan_match(struct wireless_dev *wdev,
12221                         struct cfg80211_nan_match_params *match, gfp_t gfp)
12222 {
12223         struct wiphy *wiphy = wdev->wiphy;
12224         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12225         struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
12226         struct sk_buff *msg;
12227         void *hdr;
12228
12229         if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
12230                 return;
12231
12232         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12233         if (!msg)
12234                 return;
12235
12236         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
12237         if (!hdr) {
12238                 nlmsg_free(msg);
12239                 return;
12240         }
12241
12242         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12243             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12244                                          wdev->netdev->ifindex)) ||
12245             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12246                               NL80211_ATTR_PAD))
12247                 goto nla_put_failure;
12248
12249         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
12250                               NL80211_ATTR_PAD) ||
12251             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
12252                 goto nla_put_failure;
12253
12254         match_attr = nla_nest_start(msg, NL80211_ATTR_NAN_MATCH);
12255         if (!match_attr)
12256                 goto nla_put_failure;
12257
12258         local_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_LOCAL);
12259         if (!local_func_attr)
12260                 goto nla_put_failure;
12261
12262         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
12263                 goto nla_put_failure;
12264
12265         nla_nest_end(msg, local_func_attr);
12266
12267         peer_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_PEER);
12268         if (!peer_func_attr)
12269                 goto nla_put_failure;
12270
12271         if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
12272             nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
12273                 goto nla_put_failure;
12274
12275         if (match->info && match->info_len &&
12276             nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
12277                     match->info))
12278                 goto nla_put_failure;
12279
12280         nla_nest_end(msg, peer_func_attr);
12281         nla_nest_end(msg, match_attr);
12282         genlmsg_end(msg, hdr);
12283
12284         if (!wdev->owner_nlportid)
12285                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12286                                         msg, 0, NL80211_MCGRP_NAN, gfp);
12287         else
12288                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
12289                                 wdev->owner_nlportid);
12290
12291         return;
12292
12293 nla_put_failure:
12294         nlmsg_free(msg);
12295 }
12296 EXPORT_SYMBOL(cfg80211_nan_match);
12297
12298 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
12299                                   u8 inst_id,
12300                                   enum nl80211_nan_func_term_reason reason,
12301                                   u64 cookie, gfp_t gfp)
12302 {
12303         struct wiphy *wiphy = wdev->wiphy;
12304         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12305         struct sk_buff *msg;
12306         struct nlattr *func_attr;
12307         void *hdr;
12308
12309         if (WARN_ON(!inst_id))
12310                 return;
12311
12312         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12313         if (!msg)
12314                 return;
12315
12316         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
12317         if (!hdr) {
12318                 nlmsg_free(msg);
12319                 return;
12320         }
12321
12322         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12323             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12324                                          wdev->netdev->ifindex)) ||
12325             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12326                               NL80211_ATTR_PAD))
12327                 goto nla_put_failure;
12328
12329         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12330                               NL80211_ATTR_PAD))
12331                 goto nla_put_failure;
12332
12333         func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
12334         if (!func_attr)
12335                 goto nla_put_failure;
12336
12337         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
12338             nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
12339                 goto nla_put_failure;
12340
12341         nla_nest_end(msg, func_attr);
12342         genlmsg_end(msg, hdr);
12343
12344         if (!wdev->owner_nlportid)
12345                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12346                                         msg, 0, NL80211_MCGRP_NAN, gfp);
12347         else
12348                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
12349                                 wdev->owner_nlportid);
12350
12351         return;
12352
12353 nla_put_failure:
12354         nlmsg_free(msg);
12355 }
12356 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
12357
12358 static int nl80211_get_protocol_features(struct sk_buff *skb,
12359                                          struct genl_info *info)
12360 {
12361         void *hdr;
12362         struct sk_buff *msg;
12363
12364         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12365         if (!msg)
12366                 return -ENOMEM;
12367
12368         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12369                              NL80211_CMD_GET_PROTOCOL_FEATURES);
12370         if (!hdr)
12371                 goto nla_put_failure;
12372
12373         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
12374                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
12375                 goto nla_put_failure;
12376
12377         genlmsg_end(msg, hdr);
12378         return genlmsg_reply(msg, info);
12379
12380  nla_put_failure:
12381         kfree_skb(msg);
12382         return -ENOBUFS;
12383 }
12384
12385 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
12386 {
12387         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12388         struct cfg80211_update_ft_ies_params ft_params;
12389         struct net_device *dev = info->user_ptr[1];
12390
12391         if (!rdev->ops->update_ft_ies)
12392                 return -EOPNOTSUPP;
12393
12394         if (!info->attrs[NL80211_ATTR_MDID] ||
12395             !info->attrs[NL80211_ATTR_IE])
12396                 return -EINVAL;
12397
12398         memset(&ft_params, 0, sizeof(ft_params));
12399         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
12400         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12401         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12402
12403         return rdev_update_ft_ies(rdev, dev, &ft_params);
12404 }
12405
12406 static int nl80211_crit_protocol_start(struct sk_buff *skb,
12407                                        struct genl_info *info)
12408 {
12409         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12410         struct wireless_dev *wdev = info->user_ptr[1];
12411         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
12412         u16 duration;
12413         int ret;
12414
12415         if (!rdev->ops->crit_proto_start)
12416                 return -EOPNOTSUPP;
12417
12418         if (WARN_ON(!rdev->ops->crit_proto_stop))
12419                 return -EINVAL;
12420
12421         if (rdev->crit_proto_nlportid)
12422                 return -EBUSY;
12423
12424         /* determine protocol if provided */
12425         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
12426                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
12427
12428         if (proto >= NUM_NL80211_CRIT_PROTO)
12429                 return -EINVAL;
12430
12431         /* timeout must be provided */
12432         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
12433                 return -EINVAL;
12434
12435         duration =
12436                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
12437
12438         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
12439                 return -ERANGE;
12440
12441         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
12442         if (!ret)
12443                 rdev->crit_proto_nlportid = info->snd_portid;
12444
12445         return ret;
12446 }
12447
12448 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
12449                                       struct genl_info *info)
12450 {
12451         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12452         struct wireless_dev *wdev = info->user_ptr[1];
12453
12454         if (!rdev->ops->crit_proto_stop)
12455                 return -EOPNOTSUPP;
12456
12457         if (rdev->crit_proto_nlportid) {
12458                 rdev->crit_proto_nlportid = 0;
12459                 rdev_crit_proto_stop(rdev, wdev);
12460         }
12461         return 0;
12462 }
12463
12464 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
12465 {
12466         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12467         struct wireless_dev *wdev =
12468                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
12469         int i, err;
12470         u32 vid, subcmd;
12471
12472         if (!rdev->wiphy.vendor_commands)
12473                 return -EOPNOTSUPP;
12474
12475         if (IS_ERR(wdev)) {
12476                 err = PTR_ERR(wdev);
12477                 if (err != -EINVAL)
12478                         return err;
12479                 wdev = NULL;
12480         } else if (wdev->wiphy != &rdev->wiphy) {
12481                 return -EINVAL;
12482         }
12483
12484         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
12485             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
12486                 return -EINVAL;
12487
12488         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
12489         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
12490         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
12491                 const struct wiphy_vendor_command *vcmd;
12492                 void *data = NULL;
12493                 int len = 0;
12494
12495                 vcmd = &rdev->wiphy.vendor_commands[i];
12496
12497                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
12498                         continue;
12499
12500                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
12501                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
12502                         if (!wdev)
12503                                 return -EINVAL;
12504                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
12505                             !wdev->netdev)
12506                                 return -EINVAL;
12507
12508                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
12509                                 if (!wdev_running(wdev))
12510                                         return -ENETDOWN;
12511                         }
12512
12513                         if (!vcmd->doit)
12514                                 return -EOPNOTSUPP;
12515                 } else {
12516                         wdev = NULL;
12517                 }
12518
12519                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
12520                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
12521                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
12522                 }
12523
12524                 rdev->cur_cmd_info = info;
12525                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
12526                                                           data, len);
12527                 rdev->cur_cmd_info = NULL;
12528                 return err;
12529         }
12530
12531         return -EOPNOTSUPP;
12532 }
12533
12534 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
12535                                        struct netlink_callback *cb,
12536                                        struct cfg80211_registered_device **rdev,
12537                                        struct wireless_dev **wdev)
12538 {
12539         struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
12540         u32 vid, subcmd;
12541         unsigned int i;
12542         int vcmd_idx = -1;
12543         int err;
12544         void *data = NULL;
12545         unsigned int data_len = 0;
12546
12547         if (cb->args[0]) {
12548                 /* subtract the 1 again here */
12549                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
12550                 struct wireless_dev *tmp;
12551
12552                 if (!wiphy)
12553                         return -ENODEV;
12554                 *rdev = wiphy_to_rdev(wiphy);
12555                 *wdev = NULL;
12556
12557                 if (cb->args[1]) {
12558                         list_for_each_entry(tmp, &wiphy->wdev_list, list) {
12559                                 if (tmp->identifier == cb->args[1] - 1) {
12560                                         *wdev = tmp;
12561                                         break;
12562                                 }
12563                         }
12564                 }
12565
12566                 /* keep rtnl locked in successful case */
12567                 return 0;
12568         }
12569
12570         err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, attrbuf,
12571                           nl80211_fam.maxattr, nl80211_policy, NULL);
12572         if (err)
12573                 return err;
12574
12575         if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
12576             !attrbuf[NL80211_ATTR_VENDOR_SUBCMD])
12577                 return -EINVAL;
12578
12579         *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf);
12580         if (IS_ERR(*wdev))
12581                 *wdev = NULL;
12582
12583         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
12584         if (IS_ERR(*rdev))
12585                 return PTR_ERR(*rdev);
12586
12587         vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
12588         subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
12589
12590         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
12591                 const struct wiphy_vendor_command *vcmd;
12592
12593                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
12594
12595                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
12596                         continue;
12597
12598                 if (!vcmd->dumpit)
12599                         return -EOPNOTSUPP;
12600
12601                 vcmd_idx = i;
12602                 break;
12603         }
12604
12605         if (vcmd_idx < 0)
12606                 return -EOPNOTSUPP;
12607
12608         if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
12609                 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
12610                 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
12611         }
12612
12613         /* 0 is the first index - add 1 to parse only once */
12614         cb->args[0] = (*rdev)->wiphy_idx + 1;
12615         /* add 1 to know if it was NULL */
12616         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
12617         cb->args[2] = vcmd_idx;
12618         cb->args[3] = (unsigned long)data;
12619         cb->args[4] = data_len;
12620
12621         /* keep rtnl locked in successful case */
12622         return 0;
12623 }
12624
12625 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
12626                                    struct netlink_callback *cb)
12627 {
12628         struct cfg80211_registered_device *rdev;
12629         struct wireless_dev *wdev;
12630         unsigned int vcmd_idx;
12631         const struct wiphy_vendor_command *vcmd;
12632         void *data;
12633         int data_len;
12634         int err;
12635         struct nlattr *vendor_data;
12636
12637         rtnl_lock();
12638         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
12639         if (err)
12640                 goto out;
12641
12642         vcmd_idx = cb->args[2];
12643         data = (void *)cb->args[3];
12644         data_len = cb->args[4];
12645         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
12646
12647         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
12648                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
12649                 if (!wdev) {
12650                         err = -EINVAL;
12651                         goto out;
12652                 }
12653                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
12654                     !wdev->netdev) {
12655                         err = -EINVAL;
12656                         goto out;
12657                 }
12658
12659                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
12660                         if (!wdev_running(wdev)) {
12661                                 err = -ENETDOWN;
12662                                 goto out;
12663                         }
12664                 }
12665         }
12666
12667         while (1) {
12668                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
12669                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
12670                                            NL80211_CMD_VENDOR);
12671                 if (!hdr)
12672                         break;
12673
12674                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12675                     (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
12676                                                wdev_id(wdev),
12677                                                NL80211_ATTR_PAD))) {
12678                         genlmsg_cancel(skb, hdr);
12679                         break;
12680                 }
12681
12682                 vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA);
12683                 if (!vendor_data) {
12684                         genlmsg_cancel(skb, hdr);
12685                         break;
12686                 }
12687
12688                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
12689                                    (unsigned long *)&cb->args[5]);
12690                 nla_nest_end(skb, vendor_data);
12691
12692                 if (err == -ENOBUFS || err == -ENOENT) {
12693                         genlmsg_cancel(skb, hdr);
12694                         break;
12695                 } else if (err) {
12696                         genlmsg_cancel(skb, hdr);
12697                         goto out;
12698                 }
12699
12700                 genlmsg_end(skb, hdr);
12701         }
12702
12703         err = skb->len;
12704  out:
12705         rtnl_unlock();
12706         return err;
12707 }
12708
12709 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
12710                                            enum nl80211_commands cmd,
12711                                            enum nl80211_attrs attr,
12712                                            int approxlen)
12713 {
12714         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12715
12716         if (WARN_ON(!rdev->cur_cmd_info))
12717                 return NULL;
12718
12719         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
12720                                            rdev->cur_cmd_info->snd_portid,
12721                                            rdev->cur_cmd_info->snd_seq,
12722                                            cmd, attr, NULL, GFP_KERNEL);
12723 }
12724 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
12725
12726 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
12727 {
12728         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
12729         void *hdr = ((void **)skb->cb)[1];
12730         struct nlattr *data = ((void **)skb->cb)[2];
12731
12732         /* clear CB data for netlink core to own from now on */
12733         memset(skb->cb, 0, sizeof(skb->cb));
12734
12735         if (WARN_ON(!rdev->cur_cmd_info)) {
12736                 kfree_skb(skb);
12737                 return -EINVAL;
12738         }
12739
12740         nla_nest_end(skb, data);
12741         genlmsg_end(skb, hdr);
12742         return genlmsg_reply(skb, rdev->cur_cmd_info);
12743 }
12744 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
12745
12746 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy)
12747 {
12748         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12749
12750         if (WARN_ON(!rdev->cur_cmd_info))
12751                 return 0;
12752
12753         return rdev->cur_cmd_info->snd_portid;
12754 }
12755 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender);
12756
12757 static int nl80211_set_qos_map(struct sk_buff *skb,
12758                                struct genl_info *info)
12759 {
12760         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12761         struct cfg80211_qos_map *qos_map = NULL;
12762         struct net_device *dev = info->user_ptr[1];
12763         u8 *pos, len, num_des, des_len, des;
12764         int ret;
12765
12766         if (!rdev->ops->set_qos_map)
12767                 return -EOPNOTSUPP;
12768
12769         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
12770                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
12771                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
12772
12773                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
12774                     len > IEEE80211_QOS_MAP_LEN_MAX)
12775                         return -EINVAL;
12776
12777                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
12778                 if (!qos_map)
12779                         return -ENOMEM;
12780
12781                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
12782                 if (num_des) {
12783                         des_len = num_des *
12784                                 sizeof(struct cfg80211_dscp_exception);
12785                         memcpy(qos_map->dscp_exception, pos, des_len);
12786                         qos_map->num_des = num_des;
12787                         for (des = 0; des < num_des; des++) {
12788                                 if (qos_map->dscp_exception[des].up > 7) {
12789                                         kfree(qos_map);
12790                                         return -EINVAL;
12791                                 }
12792                         }
12793                         pos += des_len;
12794                 }
12795                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
12796         }
12797
12798         wdev_lock(dev->ieee80211_ptr);
12799         ret = nl80211_key_allowed(dev->ieee80211_ptr);
12800         if (!ret)
12801                 ret = rdev_set_qos_map(rdev, dev, qos_map);
12802         wdev_unlock(dev->ieee80211_ptr);
12803
12804         kfree(qos_map);
12805         return ret;
12806 }
12807
12808 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
12809 {
12810         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12811         struct net_device *dev = info->user_ptr[1];
12812         struct wireless_dev *wdev = dev->ieee80211_ptr;
12813         const u8 *peer;
12814         u8 tsid, up;
12815         u16 admitted_time = 0;
12816         int err;
12817
12818         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
12819                 return -EOPNOTSUPP;
12820
12821         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
12822             !info->attrs[NL80211_ATTR_USER_PRIO])
12823                 return -EINVAL;
12824
12825         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
12826         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
12827
12828         /* WMM uses TIDs 0-7 even for TSPEC */
12829         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
12830                 /* TODO: handle 802.11 TSPEC/admission control
12831                  * need more attributes for that (e.g. BA session requirement);
12832                  * change the WMM adminssion test above to allow both then
12833                  */
12834                 return -EINVAL;
12835         }
12836
12837         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12838
12839         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
12840                 admitted_time =
12841                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
12842                 if (!admitted_time)
12843                         return -EINVAL;
12844         }
12845
12846         wdev_lock(wdev);
12847         switch (wdev->iftype) {
12848         case NL80211_IFTYPE_STATION:
12849         case NL80211_IFTYPE_P2P_CLIENT:
12850                 if (wdev->current_bss)
12851                         break;
12852                 err = -ENOTCONN;
12853                 goto out;
12854         default:
12855                 err = -EOPNOTSUPP;
12856                 goto out;
12857         }
12858
12859         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
12860
12861  out:
12862         wdev_unlock(wdev);
12863         return err;
12864 }
12865
12866 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
12867 {
12868         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12869         struct net_device *dev = info->user_ptr[1];
12870         struct wireless_dev *wdev = dev->ieee80211_ptr;
12871         const u8 *peer;
12872         u8 tsid;
12873         int err;
12874
12875         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
12876                 return -EINVAL;
12877
12878         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
12879         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12880
12881         wdev_lock(wdev);
12882         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
12883         wdev_unlock(wdev);
12884
12885         return err;
12886 }
12887
12888 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
12889                                        struct genl_info *info)
12890 {
12891         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12892         struct net_device *dev = info->user_ptr[1];
12893         struct wireless_dev *wdev = dev->ieee80211_ptr;
12894         struct cfg80211_chan_def chandef = {};
12895         const u8 *addr;
12896         u8 oper_class;
12897         int err;
12898
12899         if (!rdev->ops->tdls_channel_switch ||
12900             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
12901                 return -EOPNOTSUPP;
12902
12903         switch (dev->ieee80211_ptr->iftype) {
12904         case NL80211_IFTYPE_STATION:
12905         case NL80211_IFTYPE_P2P_CLIENT:
12906                 break;
12907         default:
12908                 return -EOPNOTSUPP;
12909         }
12910
12911         if (!info->attrs[NL80211_ATTR_MAC] ||
12912             !info->attrs[NL80211_ATTR_OPER_CLASS])
12913                 return -EINVAL;
12914
12915         err = nl80211_parse_chandef(rdev, info, &chandef);
12916         if (err)
12917                 return err;
12918
12919         /*
12920          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
12921          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
12922          * specification is not defined for them.
12923          */
12924         if (chandef.chan->band == NL80211_BAND_2GHZ &&
12925             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
12926             chandef.width != NL80211_CHAN_WIDTH_20)
12927                 return -EINVAL;
12928
12929         /* we will be active on the TDLS link */
12930         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
12931                                            wdev->iftype))
12932                 return -EINVAL;
12933
12934         /* don't allow switching to DFS channels */
12935         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
12936                 return -EINVAL;
12937
12938         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12939         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
12940
12941         wdev_lock(wdev);
12942         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
12943         wdev_unlock(wdev);
12944
12945         return err;
12946 }
12947
12948 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
12949                                               struct genl_info *info)
12950 {
12951         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12952         struct net_device *dev = info->user_ptr[1];
12953         struct wireless_dev *wdev = dev->ieee80211_ptr;
12954         const u8 *addr;
12955
12956         if (!rdev->ops->tdls_channel_switch ||
12957             !rdev->ops->tdls_cancel_channel_switch ||
12958             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
12959                 return -EOPNOTSUPP;
12960
12961         switch (dev->ieee80211_ptr->iftype) {
12962         case NL80211_IFTYPE_STATION:
12963         case NL80211_IFTYPE_P2P_CLIENT:
12964                 break;
12965         default:
12966                 return -EOPNOTSUPP;
12967         }
12968
12969         if (!info->attrs[NL80211_ATTR_MAC])
12970                 return -EINVAL;
12971
12972         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12973
12974         wdev_lock(wdev);
12975         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
12976         wdev_unlock(wdev);
12977
12978         return 0;
12979 }
12980
12981 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
12982                                             struct genl_info *info)
12983 {
12984         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12985         struct net_device *dev = info->user_ptr[1];
12986         struct wireless_dev *wdev = dev->ieee80211_ptr;
12987         const struct nlattr *nla;
12988         bool enabled;
12989
12990         if (!rdev->ops->set_multicast_to_unicast)
12991                 return -EOPNOTSUPP;
12992
12993         if (wdev->iftype != NL80211_IFTYPE_AP &&
12994             wdev->iftype != NL80211_IFTYPE_P2P_GO)
12995                 return -EOPNOTSUPP;
12996
12997         nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
12998         enabled = nla_get_flag(nla);
12999
13000         return rdev_set_multicast_to_unicast(rdev, dev, enabled);
13001 }
13002
13003 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
13004 {
13005         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13006         struct net_device *dev = info->user_ptr[1];
13007         struct wireless_dev *wdev = dev->ieee80211_ptr;
13008         struct cfg80211_pmk_conf pmk_conf = {};
13009         int ret;
13010
13011         if (wdev->iftype != NL80211_IFTYPE_STATION &&
13012             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
13013                 return -EOPNOTSUPP;
13014
13015         if (!wiphy_ext_feature_isset(&rdev->wiphy,
13016                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
13017                 return -EOPNOTSUPP;
13018
13019         if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
13020                 return -EINVAL;
13021
13022         wdev_lock(wdev);
13023         if (!wdev->current_bss) {
13024                 ret = -ENOTCONN;
13025                 goto out;
13026         }
13027
13028         pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
13029         if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) {
13030                 ret = -EINVAL;
13031                 goto out;
13032         }
13033
13034         pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
13035         pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
13036         if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
13037             pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
13038                 ret = -EINVAL;
13039                 goto out;
13040         }
13041
13042         if (info->attrs[NL80211_ATTR_PMKR0_NAME]) {
13043                 int r0_name_len = nla_len(info->attrs[NL80211_ATTR_PMKR0_NAME]);
13044
13045                 if (r0_name_len != WLAN_PMK_NAME_LEN) {
13046                         ret = -EINVAL;
13047                         goto out;
13048                 }
13049
13050                 pmk_conf.pmk_r0_name =
13051                         nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
13052         }
13053
13054         ret = rdev_set_pmk(rdev, dev, &pmk_conf);
13055 out:
13056         wdev_unlock(wdev);
13057         return ret;
13058 }
13059
13060 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
13061 {
13062         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13063         struct net_device *dev = info->user_ptr[1];
13064         struct wireless_dev *wdev = dev->ieee80211_ptr;
13065         const u8 *aa;
13066         int ret;
13067
13068         if (wdev->iftype != NL80211_IFTYPE_STATION &&
13069             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
13070                 return -EOPNOTSUPP;
13071
13072         if (!wiphy_ext_feature_isset(&rdev->wiphy,
13073                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
13074                 return -EOPNOTSUPP;
13075
13076         if (!info->attrs[NL80211_ATTR_MAC])
13077                 return -EINVAL;
13078
13079         wdev_lock(wdev);
13080         aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
13081         ret = rdev_del_pmk(rdev, dev, aa);
13082         wdev_unlock(wdev);
13083
13084         return ret;
13085 }
13086
13087 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
13088 {
13089         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13090         struct net_device *dev = info->user_ptr[1];
13091         struct cfg80211_external_auth_params params;
13092
13093         if (!rdev->ops->external_auth)
13094                 return -EOPNOTSUPP;
13095
13096         if (!info->attrs[NL80211_ATTR_SSID] &&
13097             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
13098             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
13099                 return -EINVAL;
13100
13101         if (!info->attrs[NL80211_ATTR_BSSID])
13102                 return -EINVAL;
13103
13104         if (!info->attrs[NL80211_ATTR_STATUS_CODE])
13105                 return -EINVAL;
13106
13107         memset(&params, 0, sizeof(params));
13108
13109         if (info->attrs[NL80211_ATTR_SSID]) {
13110                 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
13111                 if (params.ssid.ssid_len == 0 ||
13112                     params.ssid.ssid_len > IEEE80211_MAX_SSID_LEN)
13113                         return -EINVAL;
13114                 memcpy(params.ssid.ssid,
13115                        nla_data(info->attrs[NL80211_ATTR_SSID]),
13116                        params.ssid.ssid_len);
13117         }
13118
13119         memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
13120                ETH_ALEN);
13121
13122         params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
13123
13124         if (info->attrs[NL80211_ATTR_PMKID])
13125                 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
13126
13127         return rdev_external_auth(rdev, dev, &params);
13128 }
13129
13130 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
13131 {
13132         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13133         struct net_device *dev = info->user_ptr[1];
13134         struct wireless_dev *wdev = dev->ieee80211_ptr;
13135         const u8 *buf;
13136         size_t len;
13137         u8 *dest;
13138         u16 proto;
13139         bool noencrypt;
13140         int err;
13141
13142         if (!wiphy_ext_feature_isset(&rdev->wiphy,
13143                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
13144                 return -EOPNOTSUPP;
13145
13146         if (!rdev->ops->tx_control_port)
13147                 return -EOPNOTSUPP;
13148
13149         if (!info->attrs[NL80211_ATTR_FRAME] ||
13150             !info->attrs[NL80211_ATTR_MAC] ||
13151             !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
13152                 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
13153                 return -EINVAL;
13154         }
13155
13156         wdev_lock(wdev);
13157
13158         switch (wdev->iftype) {
13159         case NL80211_IFTYPE_AP:
13160         case NL80211_IFTYPE_P2P_GO:
13161         case NL80211_IFTYPE_MESH_POINT:
13162                 break;
13163         case NL80211_IFTYPE_ADHOC:
13164         case NL80211_IFTYPE_STATION:
13165         case NL80211_IFTYPE_P2P_CLIENT:
13166                 if (wdev->current_bss)
13167                         break;
13168                 err = -ENOTCONN;
13169                 goto out;
13170         default:
13171                 err = -EOPNOTSUPP;
13172                 goto out;
13173         }
13174
13175         wdev_unlock(wdev);
13176
13177         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
13178         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
13179         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
13180         proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
13181         noencrypt =
13182                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
13183
13184         return rdev_tx_control_port(rdev, dev, buf, len,
13185                                     dest, cpu_to_be16(proto), noencrypt);
13186
13187  out:
13188         wdev_unlock(wdev);
13189         return err;
13190 }
13191
13192 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
13193                                            struct genl_info *info)
13194 {
13195         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13196         struct net_device *dev = info->user_ptr[1];
13197         struct wireless_dev *wdev = dev->ieee80211_ptr;
13198         struct cfg80211_ftm_responder_stats ftm_stats = {};
13199         struct sk_buff *msg;
13200         void *hdr;
13201         struct nlattr *ftm_stats_attr;
13202         int err;
13203
13204         if (wdev->iftype != NL80211_IFTYPE_AP || !wdev->beacon_interval)
13205                 return -EOPNOTSUPP;
13206
13207         err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
13208         if (err)
13209                 return err;
13210
13211         if (!ftm_stats.filled)
13212                 return -ENODATA;
13213
13214         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13215         if (!msg)
13216                 return -ENOMEM;
13217
13218         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13219                              NL80211_CMD_GET_FTM_RESPONDER_STATS);
13220         if (!hdr)
13221                 return -ENOBUFS;
13222
13223         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
13224                 goto nla_put_failure;
13225
13226         ftm_stats_attr = nla_nest_start(msg, NL80211_ATTR_FTM_RESPONDER_STATS);
13227         if (!ftm_stats_attr)
13228                 goto nla_put_failure;
13229
13230 #define SET_FTM(field, name, type)                                       \
13231         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
13232             nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name,            \
13233                              ftm_stats.field))                           \
13234                 goto nla_put_failure; } while (0)
13235 #define SET_FTM_U64(field, name)                                         \
13236         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
13237             nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name,           \
13238                               ftm_stats.field, NL80211_FTM_STATS_PAD))   \
13239                 goto nla_put_failure; } while (0)
13240
13241         SET_FTM(success_num, SUCCESS_NUM, u32);
13242         SET_FTM(partial_num, PARTIAL_NUM, u32);
13243         SET_FTM(failed_num, FAILED_NUM, u32);
13244         SET_FTM(asap_num, ASAP_NUM, u32);
13245         SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
13246         SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
13247         SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
13248         SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
13249         SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
13250 #undef SET_FTM
13251
13252         nla_nest_end(msg, ftm_stats_attr);
13253
13254         genlmsg_end(msg, hdr);
13255         return genlmsg_reply(msg, info);
13256
13257 nla_put_failure:
13258         nlmsg_free(msg);
13259         return -ENOBUFS;
13260 }
13261
13262 #define NL80211_FLAG_NEED_WIPHY         0x01
13263 #define NL80211_FLAG_NEED_NETDEV        0x02
13264 #define NL80211_FLAG_NEED_RTNL          0x04
13265 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
13266 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
13267                                          NL80211_FLAG_CHECK_NETDEV_UP)
13268 #define NL80211_FLAG_NEED_WDEV          0x10
13269 /* If a netdev is associated, it must be UP, P2P must be started */
13270 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
13271                                          NL80211_FLAG_CHECK_NETDEV_UP)
13272 #define NL80211_FLAG_CLEAR_SKB          0x20
13273
13274 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
13275                             struct genl_info *info)
13276 {
13277         struct cfg80211_registered_device *rdev;
13278         struct wireless_dev *wdev;
13279         struct net_device *dev;
13280         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
13281
13282         if (rtnl)
13283                 rtnl_lock();
13284
13285         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
13286                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
13287                 if (IS_ERR(rdev)) {
13288                         if (rtnl)
13289                                 rtnl_unlock();
13290                         return PTR_ERR(rdev);
13291                 }
13292                 info->user_ptr[0] = rdev;
13293         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
13294                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
13295                 ASSERT_RTNL();
13296
13297                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
13298                                                   info->attrs);
13299                 if (IS_ERR(wdev)) {
13300                         if (rtnl)
13301                                 rtnl_unlock();
13302                         return PTR_ERR(wdev);
13303                 }
13304
13305                 dev = wdev->netdev;
13306                 rdev = wiphy_to_rdev(wdev->wiphy);
13307
13308                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
13309                         if (!dev) {
13310                                 if (rtnl)
13311                                         rtnl_unlock();
13312                                 return -EINVAL;
13313                         }
13314
13315                         info->user_ptr[1] = dev;
13316                 } else {
13317                         info->user_ptr[1] = wdev;
13318                 }
13319
13320                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
13321                     !wdev_running(wdev)) {
13322                         if (rtnl)
13323                                 rtnl_unlock();
13324                         return -ENETDOWN;
13325                 }
13326
13327                 if (dev)
13328                         dev_hold(dev);
13329
13330                 info->user_ptr[0] = rdev;
13331         }
13332
13333         return 0;
13334 }
13335
13336 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
13337                               struct genl_info *info)
13338 {
13339         if (info->user_ptr[1]) {
13340                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
13341                         struct wireless_dev *wdev = info->user_ptr[1];
13342
13343                         if (wdev->netdev)
13344                                 dev_put(wdev->netdev);
13345                 } else {
13346                         dev_put(info->user_ptr[1]);
13347                 }
13348         }
13349
13350         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
13351                 rtnl_unlock();
13352
13353         /* If needed, clear the netlink message payload from the SKB
13354          * as it might contain key data that shouldn't stick around on
13355          * the heap after the SKB is freed. The netlink message header
13356          * is still needed for further processing, so leave it intact.
13357          */
13358         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
13359                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
13360
13361                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
13362         }
13363 }
13364
13365 static const struct genl_ops nl80211_ops[] = {
13366         {
13367                 .cmd = NL80211_CMD_GET_WIPHY,
13368                 .doit = nl80211_get_wiphy,
13369                 .dumpit = nl80211_dump_wiphy,
13370                 .done = nl80211_dump_wiphy_done,
13371                 /* can be retrieved by unprivileged users */
13372                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13373                                   NL80211_FLAG_NEED_RTNL,
13374         },
13375         {
13376                 .cmd = NL80211_CMD_SET_WIPHY,
13377                 .doit = nl80211_set_wiphy,
13378                 .flags = GENL_UNS_ADMIN_PERM,
13379                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13380         },
13381         {
13382                 .cmd = NL80211_CMD_GET_INTERFACE,
13383                 .doit = nl80211_get_interface,
13384                 .dumpit = nl80211_dump_interface,
13385                 /* can be retrieved by unprivileged users */
13386                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13387                                   NL80211_FLAG_NEED_RTNL,
13388         },
13389         {
13390                 .cmd = NL80211_CMD_SET_INTERFACE,
13391                 .doit = nl80211_set_interface,
13392                 .flags = GENL_UNS_ADMIN_PERM,
13393                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13394                                   NL80211_FLAG_NEED_RTNL,
13395         },
13396         {
13397                 .cmd = NL80211_CMD_NEW_INTERFACE,
13398                 .doit = nl80211_new_interface,
13399                 .flags = GENL_UNS_ADMIN_PERM,
13400                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13401                                   NL80211_FLAG_NEED_RTNL,
13402         },
13403         {
13404                 .cmd = NL80211_CMD_DEL_INTERFACE,
13405                 .doit = nl80211_del_interface,
13406                 .flags = GENL_UNS_ADMIN_PERM,
13407                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13408                                   NL80211_FLAG_NEED_RTNL,
13409         },
13410         {
13411                 .cmd = NL80211_CMD_GET_KEY,
13412                 .doit = nl80211_get_key,
13413                 .flags = GENL_UNS_ADMIN_PERM,
13414                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13415                                   NL80211_FLAG_NEED_RTNL,
13416         },
13417         {
13418                 .cmd = NL80211_CMD_SET_KEY,
13419                 .doit = nl80211_set_key,
13420                 .flags = GENL_UNS_ADMIN_PERM,
13421                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13422                                   NL80211_FLAG_NEED_RTNL |
13423                                   NL80211_FLAG_CLEAR_SKB,
13424         },
13425         {
13426                 .cmd = NL80211_CMD_NEW_KEY,
13427                 .doit = nl80211_new_key,
13428                 .flags = GENL_UNS_ADMIN_PERM,
13429                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13430                                   NL80211_FLAG_NEED_RTNL |
13431                                   NL80211_FLAG_CLEAR_SKB,
13432         },
13433         {
13434                 .cmd = NL80211_CMD_DEL_KEY,
13435                 .doit = nl80211_del_key,
13436                 .flags = GENL_UNS_ADMIN_PERM,
13437                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13438                                   NL80211_FLAG_NEED_RTNL,
13439         },
13440         {
13441                 .cmd = NL80211_CMD_SET_BEACON,
13442                 .flags = GENL_UNS_ADMIN_PERM,
13443                 .doit = nl80211_set_beacon,
13444                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13445                                   NL80211_FLAG_NEED_RTNL,
13446         },
13447         {
13448                 .cmd = NL80211_CMD_START_AP,
13449                 .flags = GENL_UNS_ADMIN_PERM,
13450                 .doit = nl80211_start_ap,
13451                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13452                                   NL80211_FLAG_NEED_RTNL,
13453         },
13454         {
13455                 .cmd = NL80211_CMD_STOP_AP,
13456                 .flags = GENL_UNS_ADMIN_PERM,
13457                 .doit = nl80211_stop_ap,
13458                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13459                                   NL80211_FLAG_NEED_RTNL,
13460         },
13461         {
13462                 .cmd = NL80211_CMD_GET_STATION,
13463                 .doit = nl80211_get_station,
13464                 .dumpit = nl80211_dump_station,
13465                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13466                                   NL80211_FLAG_NEED_RTNL,
13467         },
13468         {
13469                 .cmd = NL80211_CMD_SET_STATION,
13470                 .doit = nl80211_set_station,
13471                 .flags = GENL_UNS_ADMIN_PERM,
13472                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13473                                   NL80211_FLAG_NEED_RTNL,
13474         },
13475         {
13476                 .cmd = NL80211_CMD_NEW_STATION,
13477                 .doit = nl80211_new_station,
13478                 .flags = GENL_UNS_ADMIN_PERM,
13479                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13480                                   NL80211_FLAG_NEED_RTNL,
13481         },
13482         {
13483                 .cmd = NL80211_CMD_DEL_STATION,
13484                 .doit = nl80211_del_station,
13485                 .flags = GENL_UNS_ADMIN_PERM,
13486                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13487                                   NL80211_FLAG_NEED_RTNL,
13488         },
13489         {
13490                 .cmd = NL80211_CMD_GET_MPATH,
13491                 .doit = nl80211_get_mpath,
13492                 .dumpit = nl80211_dump_mpath,
13493                 .flags = GENL_UNS_ADMIN_PERM,
13494                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13495                                   NL80211_FLAG_NEED_RTNL,
13496         },
13497         {
13498                 .cmd = NL80211_CMD_GET_MPP,
13499                 .doit = nl80211_get_mpp,
13500                 .dumpit = nl80211_dump_mpp,
13501                 .flags = GENL_UNS_ADMIN_PERM,
13502                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13503                                   NL80211_FLAG_NEED_RTNL,
13504         },
13505         {
13506                 .cmd = NL80211_CMD_SET_MPATH,
13507                 .doit = nl80211_set_mpath,
13508                 .flags = GENL_UNS_ADMIN_PERM,
13509                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13510                                   NL80211_FLAG_NEED_RTNL,
13511         },
13512         {
13513                 .cmd = NL80211_CMD_NEW_MPATH,
13514                 .doit = nl80211_new_mpath,
13515                 .flags = GENL_UNS_ADMIN_PERM,
13516                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13517                                   NL80211_FLAG_NEED_RTNL,
13518         },
13519         {
13520                 .cmd = NL80211_CMD_DEL_MPATH,
13521                 .doit = nl80211_del_mpath,
13522                 .flags = GENL_UNS_ADMIN_PERM,
13523                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13524                                   NL80211_FLAG_NEED_RTNL,
13525         },
13526         {
13527                 .cmd = NL80211_CMD_SET_BSS,
13528                 .doit = nl80211_set_bss,
13529                 .flags = GENL_UNS_ADMIN_PERM,
13530                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13531                                   NL80211_FLAG_NEED_RTNL,
13532         },
13533         {
13534                 .cmd = NL80211_CMD_GET_REG,
13535                 .doit = nl80211_get_reg_do,
13536                 .dumpit = nl80211_get_reg_dump,
13537                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13538                 /* can be retrieved by unprivileged users */
13539         },
13540 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
13541         {
13542                 .cmd = NL80211_CMD_SET_REG,
13543                 .doit = nl80211_set_reg,
13544                 .flags = GENL_ADMIN_PERM,
13545                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13546         },
13547 #endif
13548         {
13549                 .cmd = NL80211_CMD_REQ_SET_REG,
13550                 .doit = nl80211_req_set_reg,
13551                 .flags = GENL_ADMIN_PERM,
13552         },
13553         {
13554                 .cmd = NL80211_CMD_RELOAD_REGDB,
13555                 .doit = nl80211_reload_regdb,
13556                 .flags = GENL_ADMIN_PERM,
13557         },
13558         {
13559                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
13560                 .doit = nl80211_get_mesh_config,
13561                 /* can be retrieved by unprivileged users */
13562                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13563                                   NL80211_FLAG_NEED_RTNL,
13564         },
13565         {
13566                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
13567                 .doit = nl80211_update_mesh_config,
13568                 .flags = GENL_UNS_ADMIN_PERM,
13569                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13570                                   NL80211_FLAG_NEED_RTNL,
13571         },
13572         {
13573                 .cmd = NL80211_CMD_TRIGGER_SCAN,
13574                 .doit = nl80211_trigger_scan,
13575                 .flags = GENL_UNS_ADMIN_PERM,
13576                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13577                                   NL80211_FLAG_NEED_RTNL,
13578         },
13579         {
13580                 .cmd = NL80211_CMD_ABORT_SCAN,
13581                 .doit = nl80211_abort_scan,
13582                 .flags = GENL_UNS_ADMIN_PERM,
13583                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13584                                   NL80211_FLAG_NEED_RTNL,
13585         },
13586         {
13587                 .cmd = NL80211_CMD_GET_SCAN,
13588                 .dumpit = nl80211_dump_scan,
13589         },
13590         {
13591                 .cmd = NL80211_CMD_START_SCHED_SCAN,
13592                 .doit = nl80211_start_sched_scan,
13593                 .flags = GENL_UNS_ADMIN_PERM,
13594                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13595                                   NL80211_FLAG_NEED_RTNL,
13596         },
13597         {
13598                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
13599                 .doit = nl80211_stop_sched_scan,
13600                 .flags = GENL_UNS_ADMIN_PERM,
13601                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13602                                   NL80211_FLAG_NEED_RTNL,
13603         },
13604         {
13605                 .cmd = NL80211_CMD_AUTHENTICATE,
13606                 .doit = nl80211_authenticate,
13607                 .flags = GENL_UNS_ADMIN_PERM,
13608                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13609                                   NL80211_FLAG_NEED_RTNL |
13610                                   NL80211_FLAG_CLEAR_SKB,
13611         },
13612         {
13613                 .cmd = NL80211_CMD_ASSOCIATE,
13614                 .doit = nl80211_associate,
13615                 .flags = GENL_UNS_ADMIN_PERM,
13616                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13617                                   NL80211_FLAG_NEED_RTNL |
13618                                   NL80211_FLAG_CLEAR_SKB,
13619         },
13620         {
13621                 .cmd = NL80211_CMD_DEAUTHENTICATE,
13622                 .doit = nl80211_deauthenticate,
13623                 .flags = GENL_UNS_ADMIN_PERM,
13624                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13625                                   NL80211_FLAG_NEED_RTNL,
13626         },
13627         {
13628                 .cmd = NL80211_CMD_DISASSOCIATE,
13629                 .doit = nl80211_disassociate,
13630                 .flags = GENL_UNS_ADMIN_PERM,
13631                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13632                                   NL80211_FLAG_NEED_RTNL,
13633         },
13634         {
13635                 .cmd = NL80211_CMD_JOIN_IBSS,
13636                 .doit = nl80211_join_ibss,
13637                 .flags = GENL_UNS_ADMIN_PERM,
13638                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13639                                   NL80211_FLAG_NEED_RTNL,
13640         },
13641         {
13642                 .cmd = NL80211_CMD_LEAVE_IBSS,
13643                 .doit = nl80211_leave_ibss,
13644                 .flags = GENL_UNS_ADMIN_PERM,
13645                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13646                                   NL80211_FLAG_NEED_RTNL,
13647         },
13648 #ifdef CONFIG_NL80211_TESTMODE
13649         {
13650                 .cmd = NL80211_CMD_TESTMODE,
13651                 .doit = nl80211_testmode_do,
13652                 .dumpit = nl80211_testmode_dump,
13653                 .flags = GENL_UNS_ADMIN_PERM,
13654                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13655                                   NL80211_FLAG_NEED_RTNL,
13656         },
13657 #endif
13658         {
13659                 .cmd = NL80211_CMD_CONNECT,
13660                 .doit = nl80211_connect,
13661                 .flags = GENL_UNS_ADMIN_PERM,
13662                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13663                                   NL80211_FLAG_NEED_RTNL |
13664                                   NL80211_FLAG_CLEAR_SKB,
13665         },
13666         {
13667                 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
13668                 .doit = nl80211_update_connect_params,
13669                 .flags = GENL_ADMIN_PERM,
13670                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13671                                   NL80211_FLAG_NEED_RTNL |
13672                                   NL80211_FLAG_CLEAR_SKB,
13673         },
13674         {
13675                 .cmd = NL80211_CMD_DISCONNECT,
13676                 .doit = nl80211_disconnect,
13677                 .flags = GENL_UNS_ADMIN_PERM,
13678                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13679                                   NL80211_FLAG_NEED_RTNL,
13680         },
13681         {
13682                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
13683                 .doit = nl80211_wiphy_netns,
13684                 .flags = GENL_UNS_ADMIN_PERM,
13685                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13686                                   NL80211_FLAG_NEED_RTNL,
13687         },
13688         {
13689                 .cmd = NL80211_CMD_GET_SURVEY,
13690                 .dumpit = nl80211_dump_survey,
13691         },
13692         {
13693                 .cmd = NL80211_CMD_SET_PMKSA,
13694                 .doit = nl80211_setdel_pmksa,
13695                 .flags = GENL_UNS_ADMIN_PERM,
13696                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13697                                   NL80211_FLAG_NEED_RTNL |
13698                                   NL80211_FLAG_CLEAR_SKB,
13699         },
13700         {
13701                 .cmd = NL80211_CMD_DEL_PMKSA,
13702                 .doit = nl80211_setdel_pmksa,
13703                 .flags = GENL_UNS_ADMIN_PERM,
13704                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13705                                   NL80211_FLAG_NEED_RTNL,
13706         },
13707         {
13708                 .cmd = NL80211_CMD_FLUSH_PMKSA,
13709                 .doit = nl80211_flush_pmksa,
13710                 .flags = GENL_UNS_ADMIN_PERM,
13711                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13712                                   NL80211_FLAG_NEED_RTNL,
13713         },
13714         {
13715                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
13716                 .doit = nl80211_remain_on_channel,
13717                 .flags = GENL_UNS_ADMIN_PERM,
13718                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13719                                   NL80211_FLAG_NEED_RTNL,
13720         },
13721         {
13722                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
13723                 .doit = nl80211_cancel_remain_on_channel,
13724                 .flags = GENL_UNS_ADMIN_PERM,
13725                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13726                                   NL80211_FLAG_NEED_RTNL,
13727         },
13728         {
13729                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
13730                 .doit = nl80211_set_tx_bitrate_mask,
13731                 .flags = GENL_UNS_ADMIN_PERM,
13732                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13733                                   NL80211_FLAG_NEED_RTNL,
13734         },
13735         {
13736                 .cmd = NL80211_CMD_REGISTER_FRAME,
13737                 .doit = nl80211_register_mgmt,
13738                 .flags = GENL_UNS_ADMIN_PERM,
13739                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13740                                   NL80211_FLAG_NEED_RTNL,
13741         },
13742         {
13743                 .cmd = NL80211_CMD_FRAME,
13744                 .doit = nl80211_tx_mgmt,
13745                 .flags = GENL_UNS_ADMIN_PERM,
13746                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13747                                   NL80211_FLAG_NEED_RTNL,
13748         },
13749         {
13750                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
13751                 .doit = nl80211_tx_mgmt_cancel_wait,
13752                 .flags = GENL_UNS_ADMIN_PERM,
13753                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13754                                   NL80211_FLAG_NEED_RTNL,
13755         },
13756         {
13757                 .cmd = NL80211_CMD_SET_POWER_SAVE,
13758                 .doit = nl80211_set_power_save,
13759                 .flags = GENL_UNS_ADMIN_PERM,
13760                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13761                                   NL80211_FLAG_NEED_RTNL,
13762         },
13763         {
13764                 .cmd = NL80211_CMD_GET_POWER_SAVE,
13765                 .doit = nl80211_get_power_save,
13766                 /* can be retrieved by unprivileged users */
13767                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13768                                   NL80211_FLAG_NEED_RTNL,
13769         },
13770         {
13771                 .cmd = NL80211_CMD_SET_CQM,
13772                 .doit = nl80211_set_cqm,
13773                 .flags = GENL_UNS_ADMIN_PERM,
13774                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13775                                   NL80211_FLAG_NEED_RTNL,
13776         },
13777         {
13778                 .cmd = NL80211_CMD_SET_CHANNEL,
13779                 .doit = nl80211_set_channel,
13780                 .flags = GENL_UNS_ADMIN_PERM,
13781                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13782                                   NL80211_FLAG_NEED_RTNL,
13783         },
13784         {
13785                 .cmd = NL80211_CMD_SET_WDS_PEER,
13786                 .doit = nl80211_set_wds_peer,
13787                 .flags = GENL_UNS_ADMIN_PERM,
13788                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13789                                   NL80211_FLAG_NEED_RTNL,
13790         },
13791         {
13792                 .cmd = NL80211_CMD_JOIN_MESH,
13793                 .doit = nl80211_join_mesh,
13794                 .flags = GENL_UNS_ADMIN_PERM,
13795                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13796                                   NL80211_FLAG_NEED_RTNL,
13797         },
13798         {
13799                 .cmd = NL80211_CMD_LEAVE_MESH,
13800                 .doit = nl80211_leave_mesh,
13801                 .flags = GENL_UNS_ADMIN_PERM,
13802                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13803                                   NL80211_FLAG_NEED_RTNL,
13804         },
13805         {
13806                 .cmd = NL80211_CMD_JOIN_OCB,
13807                 .doit = nl80211_join_ocb,
13808                 .flags = GENL_UNS_ADMIN_PERM,
13809                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13810                                   NL80211_FLAG_NEED_RTNL,
13811         },
13812         {
13813                 .cmd = NL80211_CMD_LEAVE_OCB,
13814                 .doit = nl80211_leave_ocb,
13815                 .flags = GENL_UNS_ADMIN_PERM,
13816                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13817                                   NL80211_FLAG_NEED_RTNL,
13818         },
13819 #ifdef CONFIG_PM
13820         {
13821                 .cmd = NL80211_CMD_GET_WOWLAN,
13822                 .doit = nl80211_get_wowlan,
13823                 /* can be retrieved by unprivileged users */
13824                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13825                                   NL80211_FLAG_NEED_RTNL,
13826         },
13827         {
13828                 .cmd = NL80211_CMD_SET_WOWLAN,
13829                 .doit = nl80211_set_wowlan,
13830                 .flags = GENL_UNS_ADMIN_PERM,
13831                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13832                                   NL80211_FLAG_NEED_RTNL,
13833         },
13834 #endif
13835         {
13836                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
13837                 .doit = nl80211_set_rekey_data,
13838                 .flags = GENL_UNS_ADMIN_PERM,
13839                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13840                                   NL80211_FLAG_NEED_RTNL |
13841                                   NL80211_FLAG_CLEAR_SKB,
13842         },
13843         {
13844                 .cmd = NL80211_CMD_TDLS_MGMT,
13845                 .doit = nl80211_tdls_mgmt,
13846                 .flags = GENL_UNS_ADMIN_PERM,
13847                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13848                                   NL80211_FLAG_NEED_RTNL,
13849         },
13850         {
13851                 .cmd = NL80211_CMD_TDLS_OPER,
13852                 .doit = nl80211_tdls_oper,
13853                 .flags = GENL_UNS_ADMIN_PERM,
13854                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13855                                   NL80211_FLAG_NEED_RTNL,
13856         },
13857         {
13858                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
13859                 .doit = nl80211_register_unexpected_frame,
13860                 .flags = GENL_UNS_ADMIN_PERM,
13861                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13862                                   NL80211_FLAG_NEED_RTNL,
13863         },
13864         {
13865                 .cmd = NL80211_CMD_PROBE_CLIENT,
13866                 .doit = nl80211_probe_client,
13867                 .flags = GENL_UNS_ADMIN_PERM,
13868                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13869                                   NL80211_FLAG_NEED_RTNL,
13870         },
13871         {
13872                 .cmd = NL80211_CMD_REGISTER_BEACONS,
13873                 .doit = nl80211_register_beacons,
13874                 .flags = GENL_UNS_ADMIN_PERM,
13875                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13876                                   NL80211_FLAG_NEED_RTNL,
13877         },
13878         {
13879                 .cmd = NL80211_CMD_SET_NOACK_MAP,
13880                 .doit = nl80211_set_noack_map,
13881                 .flags = GENL_UNS_ADMIN_PERM,
13882                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13883                                   NL80211_FLAG_NEED_RTNL,
13884         },
13885         {
13886                 .cmd = NL80211_CMD_START_P2P_DEVICE,
13887                 .doit = nl80211_start_p2p_device,
13888                 .flags = GENL_UNS_ADMIN_PERM,
13889                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13890                                   NL80211_FLAG_NEED_RTNL,
13891         },
13892         {
13893                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
13894                 .doit = nl80211_stop_p2p_device,
13895                 .flags = GENL_UNS_ADMIN_PERM,
13896                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13897                                   NL80211_FLAG_NEED_RTNL,
13898         },
13899         {
13900                 .cmd = NL80211_CMD_START_NAN,
13901                 .doit = nl80211_start_nan,
13902                 .flags = GENL_ADMIN_PERM,
13903                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13904                                   NL80211_FLAG_NEED_RTNL,
13905         },
13906         {
13907                 .cmd = NL80211_CMD_STOP_NAN,
13908                 .doit = nl80211_stop_nan,
13909                 .flags = GENL_ADMIN_PERM,
13910                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13911                                   NL80211_FLAG_NEED_RTNL,
13912         },
13913         {
13914                 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
13915                 .doit = nl80211_nan_add_func,
13916                 .flags = GENL_ADMIN_PERM,
13917                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13918                                   NL80211_FLAG_NEED_RTNL,
13919         },
13920         {
13921                 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
13922                 .doit = nl80211_nan_del_func,
13923                 .flags = GENL_ADMIN_PERM,
13924                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13925                                   NL80211_FLAG_NEED_RTNL,
13926         },
13927         {
13928                 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
13929                 .doit = nl80211_nan_change_config,
13930                 .flags = GENL_ADMIN_PERM,
13931                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13932                                   NL80211_FLAG_NEED_RTNL,
13933         },
13934         {
13935                 .cmd = NL80211_CMD_SET_MCAST_RATE,
13936                 .doit = nl80211_set_mcast_rate,
13937                 .flags = GENL_UNS_ADMIN_PERM,
13938                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13939                                   NL80211_FLAG_NEED_RTNL,
13940         },
13941         {
13942                 .cmd = NL80211_CMD_SET_MAC_ACL,
13943                 .doit = nl80211_set_mac_acl,
13944                 .flags = GENL_UNS_ADMIN_PERM,
13945                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13946                                   NL80211_FLAG_NEED_RTNL,
13947         },
13948         {
13949                 .cmd = NL80211_CMD_RADAR_DETECT,
13950                 .doit = nl80211_start_radar_detection,
13951                 .flags = GENL_UNS_ADMIN_PERM,
13952                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13953                                   NL80211_FLAG_NEED_RTNL,
13954         },
13955         {
13956                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
13957                 .doit = nl80211_get_protocol_features,
13958         },
13959         {
13960                 .cmd = NL80211_CMD_UPDATE_FT_IES,
13961                 .doit = nl80211_update_ft_ies,
13962                 .flags = GENL_UNS_ADMIN_PERM,
13963                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13964                                   NL80211_FLAG_NEED_RTNL,
13965         },
13966         {
13967                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
13968                 .doit = nl80211_crit_protocol_start,
13969                 .flags = GENL_UNS_ADMIN_PERM,
13970                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13971                                   NL80211_FLAG_NEED_RTNL,
13972         },
13973         {
13974                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
13975                 .doit = nl80211_crit_protocol_stop,
13976                 .flags = GENL_UNS_ADMIN_PERM,
13977                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13978                                   NL80211_FLAG_NEED_RTNL,
13979         },
13980         {
13981                 .cmd = NL80211_CMD_GET_COALESCE,
13982                 .doit = nl80211_get_coalesce,
13983                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13984                                   NL80211_FLAG_NEED_RTNL,
13985         },
13986         {
13987                 .cmd = NL80211_CMD_SET_COALESCE,
13988                 .doit = nl80211_set_coalesce,
13989                 .flags = GENL_UNS_ADMIN_PERM,
13990                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13991                                   NL80211_FLAG_NEED_RTNL,
13992         },
13993         {
13994                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
13995                 .doit = nl80211_channel_switch,
13996                 .flags = GENL_UNS_ADMIN_PERM,
13997                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13998                                   NL80211_FLAG_NEED_RTNL,
13999         },
14000         {
14001                 .cmd = NL80211_CMD_VENDOR,
14002                 .doit = nl80211_vendor_cmd,
14003                 .dumpit = nl80211_vendor_cmd_dump,
14004                 .flags = GENL_UNS_ADMIN_PERM,
14005                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14006                                   NL80211_FLAG_NEED_RTNL |
14007                                   NL80211_FLAG_CLEAR_SKB,
14008         },
14009         {
14010                 .cmd = NL80211_CMD_SET_QOS_MAP,
14011                 .doit = nl80211_set_qos_map,
14012                 .flags = GENL_UNS_ADMIN_PERM,
14013                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14014                                   NL80211_FLAG_NEED_RTNL,
14015         },
14016         {
14017                 .cmd = NL80211_CMD_ADD_TX_TS,
14018                 .doit = nl80211_add_tx_ts,
14019                 .flags = GENL_UNS_ADMIN_PERM,
14020                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14021                                   NL80211_FLAG_NEED_RTNL,
14022         },
14023         {
14024                 .cmd = NL80211_CMD_DEL_TX_TS,
14025                 .doit = nl80211_del_tx_ts,
14026                 .flags = GENL_UNS_ADMIN_PERM,
14027                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14028                                   NL80211_FLAG_NEED_RTNL,
14029         },
14030         {
14031                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
14032                 .doit = nl80211_tdls_channel_switch,
14033                 .flags = GENL_UNS_ADMIN_PERM,
14034                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14035                                   NL80211_FLAG_NEED_RTNL,
14036         },
14037         {
14038                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
14039                 .doit = nl80211_tdls_cancel_channel_switch,
14040                 .flags = GENL_UNS_ADMIN_PERM,
14041                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14042                                   NL80211_FLAG_NEED_RTNL,
14043         },
14044         {
14045                 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
14046                 .doit = nl80211_set_multicast_to_unicast,
14047                 .flags = GENL_UNS_ADMIN_PERM,
14048                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14049                                   NL80211_FLAG_NEED_RTNL,
14050         },
14051         {
14052                 .cmd = NL80211_CMD_SET_PMK,
14053                 .doit = nl80211_set_pmk,
14054                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14055                                   NL80211_FLAG_NEED_RTNL |
14056                                   NL80211_FLAG_CLEAR_SKB,
14057         },
14058         {
14059                 .cmd = NL80211_CMD_DEL_PMK,
14060                 .doit = nl80211_del_pmk,
14061                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14062                                   NL80211_FLAG_NEED_RTNL,
14063         },
14064         {
14065                 .cmd = NL80211_CMD_EXTERNAL_AUTH,
14066                 .doit = nl80211_external_auth,
14067                 .flags = GENL_ADMIN_PERM,
14068                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14069                                   NL80211_FLAG_NEED_RTNL,
14070         },
14071         {
14072                 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
14073                 .doit = nl80211_tx_control_port,
14074                 .flags = GENL_UNS_ADMIN_PERM,
14075                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14076                                   NL80211_FLAG_NEED_RTNL,
14077         },
14078         {
14079                 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
14080                 .doit = nl80211_get_ftm_responder_stats,
14081                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14082                                   NL80211_FLAG_NEED_RTNL,
14083         },
14084         {
14085                 .cmd = NL80211_CMD_PEER_MEASUREMENT_START,
14086                 .doit = nl80211_pmsr_start,
14087                 .flags = GENL_UNS_ADMIN_PERM,
14088                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14089                                   NL80211_FLAG_NEED_RTNL,
14090         },
14091         {
14092                 .cmd = NL80211_CMD_NOTIFY_RADAR,
14093                 .doit = nl80211_notify_radar_detection,
14094                 .flags = GENL_UNS_ADMIN_PERM,
14095                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14096                                   NL80211_FLAG_NEED_RTNL,
14097         },
14098 };
14099
14100 static struct genl_family nl80211_fam __ro_after_init = {
14101         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
14102         .hdrsize = 0,                   /* no private header */
14103         .version = 1,                   /* no particular meaning now */
14104         .maxattr = NL80211_ATTR_MAX,
14105         .policy = nl80211_policy,
14106         .netnsok = true,
14107         .pre_doit = nl80211_pre_doit,
14108         .post_doit = nl80211_post_doit,
14109         .module = THIS_MODULE,
14110         .ops = nl80211_ops,
14111         .n_ops = ARRAY_SIZE(nl80211_ops),
14112         .mcgrps = nl80211_mcgrps,
14113         .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
14114 };
14115
14116 /* notification functions */
14117
14118 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
14119                           enum nl80211_commands cmd)
14120 {
14121         struct sk_buff *msg;
14122         struct nl80211_dump_wiphy_state state = {};
14123
14124         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
14125                 cmd != NL80211_CMD_DEL_WIPHY);
14126
14127         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14128         if (!msg)
14129                 return;
14130
14131         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
14132                 nlmsg_free(msg);
14133                 return;
14134         }
14135
14136         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14137                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
14138 }
14139
14140 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
14141                                 struct wireless_dev *wdev,
14142                                 enum nl80211_commands cmd)
14143 {
14144         struct sk_buff *msg;
14145
14146         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14147         if (!msg)
14148                 return;
14149
14150         if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) {
14151                 nlmsg_free(msg);
14152                 return;
14153         }
14154
14155         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14156                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
14157 }
14158
14159 static int nl80211_add_scan_req(struct sk_buff *msg,
14160                                 struct cfg80211_registered_device *rdev)
14161 {
14162         struct cfg80211_scan_request *req = rdev->scan_req;
14163         struct nlattr *nest;
14164         int i;
14165
14166         if (WARN_ON(!req))
14167                 return 0;
14168
14169         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
14170         if (!nest)
14171                 goto nla_put_failure;
14172         for (i = 0; i < req->n_ssids; i++) {
14173                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
14174                         goto nla_put_failure;
14175         }
14176         nla_nest_end(msg, nest);
14177
14178         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
14179         if (!nest)
14180                 goto nla_put_failure;
14181         for (i = 0; i < req->n_channels; i++) {
14182                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
14183                         goto nla_put_failure;
14184         }
14185         nla_nest_end(msg, nest);
14186
14187         if (req->ie &&
14188             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
14189                 goto nla_put_failure;
14190
14191         if (req->flags &&
14192             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
14193                 goto nla_put_failure;
14194
14195         if (req->info.scan_start_tsf &&
14196             (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
14197                                req->info.scan_start_tsf, NL80211_BSS_PAD) ||
14198              nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
14199                      req->info.tsf_bssid)))
14200                 goto nla_put_failure;
14201
14202         return 0;
14203  nla_put_failure:
14204         return -ENOBUFS;
14205 }
14206
14207 static int nl80211_prep_scan_msg(struct sk_buff *msg,
14208                                  struct cfg80211_registered_device *rdev,
14209                                  struct wireless_dev *wdev,
14210                                  u32 portid, u32 seq, int flags,
14211                                  u32 cmd)
14212 {
14213         void *hdr;
14214
14215         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
14216         if (!hdr)
14217                 return -1;
14218
14219         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14220             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14221                                          wdev->netdev->ifindex)) ||
14222             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14223                               NL80211_ATTR_PAD))
14224                 goto nla_put_failure;
14225
14226         /* ignore errors and send incomplete event anyway */
14227         nl80211_add_scan_req(msg, rdev);
14228
14229         genlmsg_end(msg, hdr);
14230         return 0;
14231
14232  nla_put_failure:
14233         genlmsg_cancel(msg, hdr);
14234         return -EMSGSIZE;
14235 }
14236
14237 static int
14238 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
14239                             struct cfg80211_sched_scan_request *req, u32 cmd)
14240 {
14241         void *hdr;
14242
14243         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14244         if (!hdr)
14245                 return -1;
14246
14247         if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
14248                         wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
14249             nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
14250             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
14251                               NL80211_ATTR_PAD))
14252                 goto nla_put_failure;
14253
14254         genlmsg_end(msg, hdr);
14255         return 0;
14256
14257  nla_put_failure:
14258         genlmsg_cancel(msg, hdr);
14259         return -EMSGSIZE;
14260 }
14261
14262 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
14263                              struct wireless_dev *wdev)
14264 {
14265         struct sk_buff *msg;
14266
14267         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14268         if (!msg)
14269                 return;
14270
14271         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
14272                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
14273                 nlmsg_free(msg);
14274                 return;
14275         }
14276
14277         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14278                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14279 }
14280
14281 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
14282                                        struct wireless_dev *wdev, bool aborted)
14283 {
14284         struct sk_buff *msg;
14285
14286         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14287         if (!msg)
14288                 return NULL;
14289
14290         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
14291                                   aborted ? NL80211_CMD_SCAN_ABORTED :
14292                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
14293                 nlmsg_free(msg);
14294                 return NULL;
14295         }
14296
14297         return msg;
14298 }
14299
14300 /* send message created by nl80211_build_scan_msg() */
14301 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
14302                            struct sk_buff *msg)
14303 {
14304         if (!msg)
14305                 return;
14306
14307         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14308                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14309 }
14310
14311 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
14312 {
14313         struct sk_buff *msg;
14314
14315         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14316         if (!msg)
14317                 return;
14318
14319         if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
14320                 nlmsg_free(msg);
14321                 return;
14322         }
14323
14324         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
14325                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14326 }
14327
14328 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
14329                                           struct regulatory_request *request)
14330 {
14331         /* Userspace can always count this one always being set */
14332         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
14333                 goto nla_put_failure;
14334
14335         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
14336                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14337                                NL80211_REGDOM_TYPE_WORLD))
14338                         goto nla_put_failure;
14339         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
14340                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14341                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
14342                         goto nla_put_failure;
14343         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
14344                    request->intersect) {
14345                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14346                                NL80211_REGDOM_TYPE_INTERSECTION))
14347                         goto nla_put_failure;
14348         } else {
14349                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14350                                NL80211_REGDOM_TYPE_COUNTRY) ||
14351                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
14352                                    request->alpha2))
14353                         goto nla_put_failure;
14354         }
14355
14356         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
14357                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
14358
14359                 if (wiphy &&
14360                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
14361                         goto nla_put_failure;
14362
14363                 if (wiphy &&
14364                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
14365                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
14366                         goto nla_put_failure;
14367         }
14368
14369         return true;
14370
14371 nla_put_failure:
14372         return false;
14373 }
14374
14375 /*
14376  * This can happen on global regulatory changes or device specific settings
14377  * based on custom regulatory domains.
14378  */
14379 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
14380                                      struct regulatory_request *request)
14381 {
14382         struct sk_buff *msg;
14383         void *hdr;
14384
14385         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14386         if (!msg)
14387                 return;
14388
14389         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
14390         if (!hdr) {
14391                 nlmsg_free(msg);
14392                 return;
14393         }
14394
14395         if (nl80211_reg_change_event_fill(msg, request) == false)
14396                 goto nla_put_failure;
14397
14398         genlmsg_end(msg, hdr);
14399
14400         rcu_read_lock();
14401         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
14402                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
14403         rcu_read_unlock();
14404
14405         return;
14406
14407 nla_put_failure:
14408         nlmsg_free(msg);
14409 }
14410
14411 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
14412                                     struct net_device *netdev,
14413                                     const u8 *buf, size_t len,
14414                                     enum nl80211_commands cmd, gfp_t gfp,
14415                                     int uapsd_queues, const u8 *req_ies,
14416                                     size_t req_ies_len)
14417 {
14418         struct sk_buff *msg;
14419         void *hdr;
14420
14421         msg = nlmsg_new(100 + len + req_ies_len, gfp);
14422         if (!msg)
14423                 return;
14424
14425         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14426         if (!hdr) {
14427                 nlmsg_free(msg);
14428                 return;
14429         }
14430
14431         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14432             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14433             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
14434             (req_ies &&
14435              nla_put(msg, NL80211_ATTR_REQ_IE, req_ies_len, req_ies)))
14436                 goto nla_put_failure;
14437
14438         if (uapsd_queues >= 0) {
14439                 struct nlattr *nla_wmm =
14440                         nla_nest_start(msg, NL80211_ATTR_STA_WME);
14441                 if (!nla_wmm)
14442                         goto nla_put_failure;
14443
14444                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
14445                                uapsd_queues))
14446                         goto nla_put_failure;
14447
14448                 nla_nest_end(msg, nla_wmm);
14449         }
14450
14451         genlmsg_end(msg, hdr);
14452
14453         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14454                                 NL80211_MCGRP_MLME, gfp);
14455         return;
14456
14457  nla_put_failure:
14458         nlmsg_free(msg);
14459 }
14460
14461 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
14462                           struct net_device *netdev, const u8 *buf,
14463                           size_t len, gfp_t gfp)
14464 {
14465         nl80211_send_mlme_event(rdev, netdev, buf, len,
14466                                 NL80211_CMD_AUTHENTICATE, gfp, -1, NULL, 0);
14467 }
14468
14469 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
14470                            struct net_device *netdev, const u8 *buf,
14471                            size_t len, gfp_t gfp, int uapsd_queues,
14472                            const u8 *req_ies, size_t req_ies_len)
14473 {
14474         nl80211_send_mlme_event(rdev, netdev, buf, len,
14475                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues,
14476                                 req_ies, req_ies_len);
14477 }
14478
14479 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
14480                          struct net_device *netdev, const u8 *buf,
14481                          size_t len, gfp_t gfp)
14482 {
14483         nl80211_send_mlme_event(rdev, netdev, buf, len,
14484                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1, NULL, 0);
14485 }
14486
14487 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
14488                            struct net_device *netdev, const u8 *buf,
14489                            size_t len, gfp_t gfp)
14490 {
14491         nl80211_send_mlme_event(rdev, netdev, buf, len,
14492                                 NL80211_CMD_DISASSOCIATE, gfp, -1, NULL, 0);
14493 }
14494
14495 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
14496                                   size_t len)
14497 {
14498         struct wireless_dev *wdev = dev->ieee80211_ptr;
14499         struct wiphy *wiphy = wdev->wiphy;
14500         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14501         const struct ieee80211_mgmt *mgmt = (void *)buf;
14502         u32 cmd;
14503
14504         if (WARN_ON(len < 2))
14505                 return;
14506
14507         if (ieee80211_is_deauth(mgmt->frame_control))
14508                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
14509         else
14510                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
14511
14512         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
14513         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1,
14514                                 NULL, 0);
14515 }
14516 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
14517
14518 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
14519                                       struct net_device *netdev, int cmd,
14520                                       const u8 *addr, gfp_t gfp)
14521 {
14522         struct sk_buff *msg;
14523         void *hdr;
14524
14525         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14526         if (!msg)
14527                 return;
14528
14529         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14530         if (!hdr) {
14531                 nlmsg_free(msg);
14532                 return;
14533         }
14534
14535         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14536             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14537             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
14538             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
14539                 goto nla_put_failure;
14540
14541         genlmsg_end(msg, hdr);
14542
14543         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14544                                 NL80211_MCGRP_MLME, gfp);
14545         return;
14546
14547  nla_put_failure:
14548         nlmsg_free(msg);
14549 }
14550
14551 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
14552                                struct net_device *netdev, const u8 *addr,
14553                                gfp_t gfp)
14554 {
14555         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
14556                                   addr, gfp);
14557 }
14558
14559 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
14560                                 struct net_device *netdev, const u8 *addr,
14561                                 gfp_t gfp)
14562 {
14563         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
14564                                   addr, gfp);
14565 }
14566
14567 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
14568                                  struct net_device *netdev,
14569                                  struct cfg80211_connect_resp_params *cr,
14570                                  gfp_t gfp)
14571 {
14572         struct sk_buff *msg;
14573         void *hdr;
14574
14575         msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
14576                         cr->fils.kek_len + cr->fils.pmk_len +
14577                         (cr->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
14578         if (!msg)
14579                 return;
14580
14581         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
14582         if (!hdr) {
14583                 nlmsg_free(msg);
14584                 return;
14585         }
14586
14587         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14588             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14589             (cr->bssid &&
14590              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) ||
14591             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
14592                         cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
14593                         cr->status) ||
14594             (cr->status < 0 &&
14595              (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
14596               nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
14597                           cr->timeout_reason))) ||
14598             (cr->req_ie &&
14599              nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
14600             (cr->resp_ie &&
14601              nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
14602                      cr->resp_ie)) ||
14603             (cr->fils.update_erp_next_seq_num &&
14604              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
14605                          cr->fils.erp_next_seq_num)) ||
14606             (cr->status == WLAN_STATUS_SUCCESS &&
14607              ((cr->fils.kek &&
14608                nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
14609                        cr->fils.kek)) ||
14610               (cr->fils.pmk &&
14611                nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
14612               (cr->fils.pmkid &&
14613                nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
14614                 goto nla_put_failure;
14615
14616         genlmsg_end(msg, hdr);
14617
14618         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14619                                 NL80211_MCGRP_MLME, gfp);
14620         return;
14621
14622  nla_put_failure:
14623         nlmsg_free(msg);
14624 }
14625
14626 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
14627                          struct net_device *netdev,
14628                          struct cfg80211_roam_info *info, gfp_t gfp)
14629 {
14630         struct sk_buff *msg;
14631         void *hdr;
14632         const u8 *bssid = info->bss ? info->bss->bssid : info->bssid;
14633
14634         msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
14635                         info->fils.kek_len + info->fils.pmk_len +
14636                         (info->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
14637         if (!msg)
14638                 return;
14639
14640         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
14641         if (!hdr) {
14642                 nlmsg_free(msg);
14643                 return;
14644         }
14645
14646         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14647             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14648             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
14649             (info->req_ie &&
14650              nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
14651                      info->req_ie)) ||
14652             (info->resp_ie &&
14653              nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
14654                      info->resp_ie)) ||
14655             (info->fils.update_erp_next_seq_num &&
14656              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
14657                          info->fils.erp_next_seq_num)) ||
14658             (info->fils.kek &&
14659              nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
14660                      info->fils.kek)) ||
14661             (info->fils.pmk &&
14662              nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
14663             (info->fils.pmkid &&
14664              nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
14665                 goto nla_put_failure;
14666
14667         genlmsg_end(msg, hdr);
14668
14669         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14670                                 NL80211_MCGRP_MLME, gfp);
14671         return;
14672
14673  nla_put_failure:
14674         nlmsg_free(msg);
14675 }
14676
14677 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
14678                                   struct net_device *netdev, const u8 *bssid)
14679 {
14680         struct sk_buff *msg;
14681         void *hdr;
14682
14683         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14684         if (!msg)
14685                 return;
14686
14687         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
14688         if (!hdr) {
14689                 nlmsg_free(msg);
14690                 return;
14691         }
14692
14693         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
14694                 goto nla_put_failure;
14695
14696         genlmsg_end(msg, hdr);
14697
14698         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14699                                 NL80211_MCGRP_MLME, GFP_KERNEL);
14700         return;
14701
14702  nla_put_failure:
14703         nlmsg_free(msg);
14704 }
14705
14706 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
14707                                struct net_device *netdev, u16 reason,
14708                                const u8 *ie, size_t ie_len, bool from_ap)
14709 {
14710         struct sk_buff *msg;
14711         void *hdr;
14712
14713         msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
14714         if (!msg)
14715                 return;
14716
14717         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
14718         if (!hdr) {
14719                 nlmsg_free(msg);
14720                 return;
14721         }
14722
14723         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14724             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14725             (reason &&
14726              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
14727             (from_ap &&
14728              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
14729             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
14730                 goto nla_put_failure;
14731
14732         genlmsg_end(msg, hdr);
14733
14734         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14735                                 NL80211_MCGRP_MLME, GFP_KERNEL);
14736         return;
14737
14738  nla_put_failure:
14739         nlmsg_free(msg);
14740 }
14741
14742 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
14743                              struct net_device *netdev, const u8 *bssid,
14744                              gfp_t gfp)
14745 {
14746         struct sk_buff *msg;
14747         void *hdr;
14748
14749         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14750         if (!msg)
14751                 return;
14752
14753         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
14754         if (!hdr) {
14755                 nlmsg_free(msg);
14756                 return;
14757         }
14758
14759         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14760             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14761             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
14762                 goto nla_put_failure;
14763
14764         genlmsg_end(msg, hdr);
14765
14766         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14767                                 NL80211_MCGRP_MLME, gfp);
14768         return;
14769
14770  nla_put_failure:
14771         nlmsg_free(msg);
14772 }
14773
14774 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
14775                                         const u8 *ie, u8 ie_len,
14776                                         int sig_dbm, gfp_t gfp)
14777 {
14778         struct wireless_dev *wdev = dev->ieee80211_ptr;
14779         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14780         struct sk_buff *msg;
14781         void *hdr;
14782
14783         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
14784                 return;
14785
14786         trace_cfg80211_notify_new_peer_candidate(dev, addr);
14787
14788         msg = nlmsg_new(100 + ie_len, gfp);
14789         if (!msg)
14790                 return;
14791
14792         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
14793         if (!hdr) {
14794                 nlmsg_free(msg);
14795                 return;
14796         }
14797
14798         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14799             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14800             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
14801             (ie_len && ie &&
14802              nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
14803             (sig_dbm &&
14804              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
14805                 goto nla_put_failure;
14806
14807         genlmsg_end(msg, hdr);
14808
14809         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14810                                 NL80211_MCGRP_MLME, gfp);
14811         return;
14812
14813  nla_put_failure:
14814         nlmsg_free(msg);
14815 }
14816 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
14817
14818 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
14819                                  struct net_device *netdev, const u8 *addr,
14820                                  enum nl80211_key_type key_type, int key_id,
14821                                  const u8 *tsc, gfp_t gfp)
14822 {
14823         struct sk_buff *msg;
14824         void *hdr;
14825
14826         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14827         if (!msg)
14828                 return;
14829
14830         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
14831         if (!hdr) {
14832                 nlmsg_free(msg);
14833                 return;
14834         }
14835
14836         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14837             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14838             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
14839             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
14840             (key_id != -1 &&
14841              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
14842             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
14843                 goto nla_put_failure;
14844
14845         genlmsg_end(msg, hdr);
14846
14847         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14848                                 NL80211_MCGRP_MLME, gfp);
14849         return;
14850
14851  nla_put_failure:
14852         nlmsg_free(msg);
14853 }
14854
14855 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
14856                                     struct ieee80211_channel *channel_before,
14857                                     struct ieee80211_channel *channel_after)
14858 {
14859         struct sk_buff *msg;
14860         void *hdr;
14861         struct nlattr *nl_freq;
14862
14863         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
14864         if (!msg)
14865                 return;
14866
14867         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
14868         if (!hdr) {
14869                 nlmsg_free(msg);
14870                 return;
14871         }
14872
14873         /*
14874          * Since we are applying the beacon hint to a wiphy we know its
14875          * wiphy_idx is valid
14876          */
14877         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
14878                 goto nla_put_failure;
14879
14880         /* Before */
14881         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
14882         if (!nl_freq)
14883                 goto nla_put_failure;
14884
14885         if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
14886                 goto nla_put_failure;
14887         nla_nest_end(msg, nl_freq);
14888
14889         /* After */
14890         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
14891         if (!nl_freq)
14892                 goto nla_put_failure;
14893
14894         if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
14895                 goto nla_put_failure;
14896         nla_nest_end(msg, nl_freq);
14897
14898         genlmsg_end(msg, hdr);
14899
14900         rcu_read_lock();
14901         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
14902                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
14903         rcu_read_unlock();
14904
14905         return;
14906
14907 nla_put_failure:
14908         nlmsg_free(msg);
14909 }
14910
14911 static void nl80211_send_remain_on_chan_event(
14912         int cmd, struct cfg80211_registered_device *rdev,
14913         struct wireless_dev *wdev, u64 cookie,
14914         struct ieee80211_channel *chan,
14915         unsigned int duration, gfp_t gfp)
14916 {
14917         struct sk_buff *msg;
14918         void *hdr;
14919
14920         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14921         if (!msg)
14922                 return;
14923
14924         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14925         if (!hdr) {
14926                 nlmsg_free(msg);
14927                 return;
14928         }
14929
14930         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14931             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14932                                          wdev->netdev->ifindex)) ||
14933             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14934                               NL80211_ATTR_PAD) ||
14935             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
14936             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
14937                         NL80211_CHAN_NO_HT) ||
14938             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14939                               NL80211_ATTR_PAD))
14940                 goto nla_put_failure;
14941
14942         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
14943             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
14944                 goto nla_put_failure;
14945
14946         genlmsg_end(msg, hdr);
14947
14948         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14949                                 NL80211_MCGRP_MLME, gfp);
14950         return;
14951
14952  nla_put_failure:
14953         nlmsg_free(msg);
14954 }
14955
14956 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
14957                                struct ieee80211_channel *chan,
14958                                unsigned int duration, gfp_t gfp)
14959 {
14960         struct wiphy *wiphy = wdev->wiphy;
14961         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14962
14963         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
14964         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
14965                                           rdev, wdev, cookie, chan,
14966                                           duration, gfp);
14967 }
14968 EXPORT_SYMBOL(cfg80211_ready_on_channel);
14969
14970 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
14971                                         struct ieee80211_channel *chan,
14972                                         gfp_t gfp)
14973 {
14974         struct wiphy *wiphy = wdev->wiphy;
14975         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14976
14977         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
14978         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
14979                                           rdev, wdev, cookie, chan, 0, gfp);
14980 }
14981 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
14982
14983 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
14984                       struct station_info *sinfo, gfp_t gfp)
14985 {
14986         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14987         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14988         struct sk_buff *msg;
14989
14990         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
14991
14992         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14993         if (!msg)
14994                 return;
14995
14996         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
14997                                  rdev, dev, mac_addr, sinfo) < 0) {
14998                 nlmsg_free(msg);
14999                 return;
15000         }
15001
15002         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15003                                 NL80211_MCGRP_MLME, gfp);
15004 }
15005 EXPORT_SYMBOL(cfg80211_new_sta);
15006
15007 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
15008                             struct station_info *sinfo, gfp_t gfp)
15009 {
15010         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
15011         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15012         struct sk_buff *msg;
15013         struct station_info empty_sinfo = {};
15014
15015         if (!sinfo)
15016                 sinfo = &empty_sinfo;
15017
15018         trace_cfg80211_del_sta(dev, mac_addr);
15019
15020         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15021         if (!msg) {
15022                 cfg80211_sinfo_release_content(sinfo);
15023                 return;
15024         }
15025
15026         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
15027                                  rdev, dev, mac_addr, sinfo) < 0) {
15028                 nlmsg_free(msg);
15029                 return;
15030         }
15031
15032         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15033                                 NL80211_MCGRP_MLME, gfp);
15034 }
15035 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
15036
15037 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
15038                           enum nl80211_connect_failed_reason reason,
15039                           gfp_t gfp)
15040 {
15041         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
15042         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15043         struct sk_buff *msg;
15044         void *hdr;
15045
15046         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
15047         if (!msg)
15048                 return;
15049
15050         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
15051         if (!hdr) {
15052                 nlmsg_free(msg);
15053                 return;
15054         }
15055
15056         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15057             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
15058             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
15059                 goto nla_put_failure;
15060
15061         genlmsg_end(msg, hdr);
15062
15063         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15064                                 NL80211_MCGRP_MLME, gfp);
15065         return;
15066
15067  nla_put_failure:
15068         nlmsg_free(msg);
15069 }
15070 EXPORT_SYMBOL(cfg80211_conn_failed);
15071
15072 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
15073                                        const u8 *addr, gfp_t gfp)
15074 {
15075         struct wireless_dev *wdev = dev->ieee80211_ptr;
15076         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15077         struct sk_buff *msg;
15078         void *hdr;
15079         u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
15080
15081         if (!nlportid)
15082                 return false;
15083
15084         msg = nlmsg_new(100, gfp);
15085         if (!msg)
15086                 return true;
15087
15088         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
15089         if (!hdr) {
15090                 nlmsg_free(msg);
15091                 return true;
15092         }
15093
15094         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15095             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15096             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
15097                 goto nla_put_failure;
15098
15099         genlmsg_end(msg, hdr);
15100         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15101         return true;
15102
15103  nla_put_failure:
15104         nlmsg_free(msg);
15105         return true;
15106 }
15107
15108 bool cfg80211_rx_spurious_frame(struct net_device *dev,
15109                                 const u8 *addr, gfp_t gfp)
15110 {
15111         struct wireless_dev *wdev = dev->ieee80211_ptr;
15112         bool ret;
15113
15114         trace_cfg80211_rx_spurious_frame(dev, addr);
15115
15116         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
15117                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
15118                 trace_cfg80211_return_bool(false);
15119                 return false;
15120         }
15121         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
15122                                          addr, gfp);
15123         trace_cfg80211_return_bool(ret);
15124         return ret;
15125 }
15126 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
15127
15128 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
15129                                         const u8 *addr, gfp_t gfp)
15130 {
15131         struct wireless_dev *wdev = dev->ieee80211_ptr;
15132         bool ret;
15133
15134         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
15135
15136         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
15137                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
15138                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
15139                 trace_cfg80211_return_bool(false);
15140                 return false;
15141         }
15142         ret = __nl80211_unexpected_frame(dev,
15143                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
15144                                          addr, gfp);
15145         trace_cfg80211_return_bool(ret);
15146         return ret;
15147 }
15148 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
15149
15150 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
15151                       struct wireless_dev *wdev, u32 nlportid,
15152                       int freq, int sig_dbm,
15153                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
15154 {
15155         struct net_device *netdev = wdev->netdev;
15156         struct sk_buff *msg;
15157         void *hdr;
15158
15159         msg = nlmsg_new(100 + len, gfp);
15160         if (!msg)
15161                 return -ENOMEM;
15162
15163         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
15164         if (!hdr) {
15165                 nlmsg_free(msg);
15166                 return -ENOMEM;
15167         }
15168
15169         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15170             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15171                                         netdev->ifindex)) ||
15172             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15173                               NL80211_ATTR_PAD) ||
15174             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
15175             (sig_dbm &&
15176              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
15177             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
15178             (flags &&
15179              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
15180                 goto nla_put_failure;
15181
15182         genlmsg_end(msg, hdr);
15183
15184         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15185
15186  nla_put_failure:
15187         nlmsg_free(msg);
15188         return -ENOBUFS;
15189 }
15190
15191 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
15192                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
15193 {
15194         struct wiphy *wiphy = wdev->wiphy;
15195         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15196         struct net_device *netdev = wdev->netdev;
15197         struct sk_buff *msg;
15198         void *hdr;
15199
15200         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
15201
15202         msg = nlmsg_new(100 + len, gfp);
15203         if (!msg)
15204                 return;
15205
15206         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
15207         if (!hdr) {
15208                 nlmsg_free(msg);
15209                 return;
15210         }
15211
15212         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15213             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15214                                    netdev->ifindex)) ||
15215             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15216                               NL80211_ATTR_PAD) ||
15217             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
15218             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15219                               NL80211_ATTR_PAD) ||
15220             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
15221                 goto nla_put_failure;
15222
15223         genlmsg_end(msg, hdr);
15224
15225         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15226                                 NL80211_MCGRP_MLME, gfp);
15227         return;
15228
15229  nla_put_failure:
15230         nlmsg_free(msg);
15231 }
15232 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
15233
15234 static int __nl80211_rx_control_port(struct net_device *dev,
15235                                      struct sk_buff *skb,
15236                                      bool unencrypted, gfp_t gfp)
15237 {
15238         struct wireless_dev *wdev = dev->ieee80211_ptr;
15239         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15240         struct ethhdr *ehdr = eth_hdr(skb);
15241         const u8 *addr = ehdr->h_source;
15242         u16 proto = be16_to_cpu(skb->protocol);
15243         struct sk_buff *msg;
15244         void *hdr;
15245         struct nlattr *frame;
15246
15247         u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
15248
15249         if (!nlportid)
15250                 return -ENOENT;
15251
15252         msg = nlmsg_new(100 + skb->len, gfp);
15253         if (!msg)
15254                 return -ENOMEM;
15255
15256         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
15257         if (!hdr) {
15258                 nlmsg_free(msg);
15259                 return -ENOBUFS;
15260         }
15261
15262         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15263             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15264             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15265                               NL80211_ATTR_PAD) ||
15266             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
15267             nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
15268             (unencrypted && nla_put_flag(msg,
15269                                          NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
15270                 goto nla_put_failure;
15271
15272         frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
15273         if (!frame)
15274                 goto nla_put_failure;
15275
15276         skb_copy_bits(skb, 0, nla_data(frame), skb->len);
15277         genlmsg_end(msg, hdr);
15278
15279         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15280
15281  nla_put_failure:
15282         nlmsg_free(msg);
15283         return -ENOBUFS;
15284 }
15285
15286 bool cfg80211_rx_control_port(struct net_device *dev,
15287                               struct sk_buff *skb, bool unencrypted)
15288 {
15289         int ret;
15290
15291         trace_cfg80211_rx_control_port(dev, skb, unencrypted);
15292         ret = __nl80211_rx_control_port(dev, skb, unencrypted, GFP_ATOMIC);
15293         trace_cfg80211_return_bool(ret == 0);
15294         return ret == 0;
15295 }
15296 EXPORT_SYMBOL(cfg80211_rx_control_port);
15297
15298 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
15299                                             const char *mac, gfp_t gfp)
15300 {
15301         struct wireless_dev *wdev = dev->ieee80211_ptr;
15302         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15303         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15304         void **cb;
15305
15306         if (!msg)
15307                 return NULL;
15308
15309         cb = (void **)msg->cb;
15310
15311         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
15312         if (!cb[0]) {
15313                 nlmsg_free(msg);
15314                 return NULL;
15315         }
15316
15317         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15318             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15319                 goto nla_put_failure;
15320
15321         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
15322                 goto nla_put_failure;
15323
15324         cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM);
15325         if (!cb[1])
15326                 goto nla_put_failure;
15327
15328         cb[2] = rdev;
15329
15330         return msg;
15331  nla_put_failure:
15332         nlmsg_free(msg);
15333         return NULL;
15334 }
15335
15336 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
15337 {
15338         void **cb = (void **)msg->cb;
15339         struct cfg80211_registered_device *rdev = cb[2];
15340
15341         nla_nest_end(msg, cb[1]);
15342         genlmsg_end(msg, cb[0]);
15343
15344         memset(msg->cb, 0, sizeof(msg->cb));
15345
15346         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15347                                 NL80211_MCGRP_MLME, gfp);
15348 }
15349
15350 void cfg80211_cqm_rssi_notify(struct net_device *dev,
15351                               enum nl80211_cqm_rssi_threshold_event rssi_event,
15352                               s32 rssi_level, gfp_t gfp)
15353 {
15354         struct sk_buff *msg;
15355         struct wireless_dev *wdev = dev->ieee80211_ptr;
15356         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15357
15358         trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
15359
15360         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
15361                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
15362                 return;
15363
15364         if (wdev->cqm_config) {
15365                 wdev->cqm_config->last_rssi_event_value = rssi_level;
15366
15367                 cfg80211_cqm_rssi_update(rdev, dev);
15368
15369                 if (rssi_level == 0)
15370                         rssi_level = wdev->cqm_config->last_rssi_event_value;
15371         }
15372
15373         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
15374         if (!msg)
15375                 return;
15376
15377         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
15378                         rssi_event))
15379                 goto nla_put_failure;
15380
15381         if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
15382                                       rssi_level))
15383                 goto nla_put_failure;
15384
15385         cfg80211_send_cqm(msg, gfp);
15386
15387         return;
15388
15389  nla_put_failure:
15390         nlmsg_free(msg);
15391 }
15392 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
15393
15394 void cfg80211_cqm_txe_notify(struct net_device *dev,
15395                              const u8 *peer, u32 num_packets,
15396                              u32 rate, u32 intvl, gfp_t gfp)
15397 {
15398         struct sk_buff *msg;
15399
15400         msg = cfg80211_prepare_cqm(dev, peer, gfp);
15401         if (!msg)
15402                 return;
15403
15404         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
15405                 goto nla_put_failure;
15406
15407         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
15408                 goto nla_put_failure;
15409
15410         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
15411                 goto nla_put_failure;
15412
15413         cfg80211_send_cqm(msg, gfp);
15414         return;
15415
15416  nla_put_failure:
15417         nlmsg_free(msg);
15418 }
15419 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
15420
15421 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
15422                                  const u8 *peer, u32 num_packets, gfp_t gfp)
15423 {
15424         struct sk_buff *msg;
15425
15426         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
15427
15428         msg = cfg80211_prepare_cqm(dev, peer, gfp);
15429         if (!msg)
15430                 return;
15431
15432         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
15433                 goto nla_put_failure;
15434
15435         cfg80211_send_cqm(msg, gfp);
15436         return;
15437
15438  nla_put_failure:
15439         nlmsg_free(msg);
15440 }
15441 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
15442
15443 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
15444 {
15445         struct sk_buff *msg;
15446
15447         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
15448         if (!msg)
15449                 return;
15450
15451         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
15452                 goto nla_put_failure;
15453
15454         cfg80211_send_cqm(msg, gfp);
15455         return;
15456
15457  nla_put_failure:
15458         nlmsg_free(msg);
15459 }
15460 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
15461
15462 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
15463                                      struct net_device *netdev, const u8 *bssid,
15464                                      const u8 *replay_ctr, gfp_t gfp)
15465 {
15466         struct sk_buff *msg;
15467         struct nlattr *rekey_attr;
15468         void *hdr;
15469
15470         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15471         if (!msg)
15472                 return;
15473
15474         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
15475         if (!hdr) {
15476                 nlmsg_free(msg);
15477                 return;
15478         }
15479
15480         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15481             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15482             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
15483                 goto nla_put_failure;
15484
15485         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
15486         if (!rekey_attr)
15487                 goto nla_put_failure;
15488
15489         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
15490                     NL80211_REPLAY_CTR_LEN, replay_ctr))
15491                 goto nla_put_failure;
15492
15493         nla_nest_end(msg, rekey_attr);
15494
15495         genlmsg_end(msg, hdr);
15496
15497         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15498                                 NL80211_MCGRP_MLME, gfp);
15499         return;
15500
15501  nla_put_failure:
15502         nlmsg_free(msg);
15503 }
15504
15505 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
15506                                const u8 *replay_ctr, gfp_t gfp)
15507 {
15508         struct wireless_dev *wdev = dev->ieee80211_ptr;
15509         struct wiphy *wiphy = wdev->wiphy;
15510         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15511
15512         trace_cfg80211_gtk_rekey_notify(dev, bssid);
15513         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
15514 }
15515 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
15516
15517 static void
15518 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
15519                                struct net_device *netdev, int index,
15520                                const u8 *bssid, bool preauth, gfp_t gfp)
15521 {
15522         struct sk_buff *msg;
15523         struct nlattr *attr;
15524         void *hdr;
15525
15526         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15527         if (!msg)
15528                 return;
15529
15530         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
15531         if (!hdr) {
15532                 nlmsg_free(msg);
15533                 return;
15534         }
15535
15536         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15537             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
15538                 goto nla_put_failure;
15539
15540         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
15541         if (!attr)
15542                 goto nla_put_failure;
15543
15544         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
15545             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
15546             (preauth &&
15547              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
15548                 goto nla_put_failure;
15549
15550         nla_nest_end(msg, attr);
15551
15552         genlmsg_end(msg, hdr);
15553
15554         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15555                                 NL80211_MCGRP_MLME, gfp);
15556         return;
15557
15558  nla_put_failure:
15559         nlmsg_free(msg);
15560 }
15561
15562 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
15563                                      const u8 *bssid, bool preauth, gfp_t gfp)
15564 {
15565         struct wireless_dev *wdev = dev->ieee80211_ptr;
15566         struct wiphy *wiphy = wdev->wiphy;
15567         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15568
15569         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
15570         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
15571 }
15572 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
15573
15574 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
15575                                      struct net_device *netdev,
15576                                      struct cfg80211_chan_def *chandef,
15577                                      gfp_t gfp,
15578                                      enum nl80211_commands notif,
15579                                      u8 count)
15580 {
15581         struct sk_buff *msg;
15582         void *hdr;
15583
15584         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15585         if (!msg)
15586                 return;
15587
15588         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
15589         if (!hdr) {
15590                 nlmsg_free(msg);
15591                 return;
15592         }
15593
15594         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
15595                 goto nla_put_failure;
15596
15597         if (nl80211_send_chandef(msg, chandef))
15598                 goto nla_put_failure;
15599
15600         if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
15601             (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
15602                         goto nla_put_failure;
15603
15604         genlmsg_end(msg, hdr);
15605
15606         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15607                                 NL80211_MCGRP_MLME, gfp);
15608         return;
15609
15610  nla_put_failure:
15611         nlmsg_free(msg);
15612 }
15613
15614 void cfg80211_ch_switch_notify(struct net_device *dev,
15615                                struct cfg80211_chan_def *chandef)
15616 {
15617         struct wireless_dev *wdev = dev->ieee80211_ptr;
15618         struct wiphy *wiphy = wdev->wiphy;
15619         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15620
15621         ASSERT_WDEV_LOCK(wdev);
15622
15623         trace_cfg80211_ch_switch_notify(dev, chandef);
15624
15625         wdev->chandef = *chandef;
15626         wdev->preset_chandef = *chandef;
15627         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
15628                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0);
15629 }
15630 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
15631
15632 void cfg80211_ch_switch_started_notify(struct net_device *dev,
15633                                        struct cfg80211_chan_def *chandef,
15634                                        u8 count)
15635 {
15636         struct wireless_dev *wdev = dev->ieee80211_ptr;
15637         struct wiphy *wiphy = wdev->wiphy;
15638         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15639
15640         trace_cfg80211_ch_switch_started_notify(dev, chandef);
15641
15642         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
15643                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
15644 }
15645 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
15646
15647 void
15648 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
15649                      const struct cfg80211_chan_def *chandef,
15650                      enum nl80211_radar_event event,
15651                      struct net_device *netdev, gfp_t gfp)
15652 {
15653         struct sk_buff *msg;
15654         void *hdr;
15655
15656         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15657         if (!msg)
15658                 return;
15659
15660         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
15661         if (!hdr) {
15662                 nlmsg_free(msg);
15663                 return;
15664         }
15665
15666         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
15667                 goto nla_put_failure;
15668
15669         /* NOP and radar events don't need a netdev parameter */
15670         if (netdev) {
15671                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
15672
15673                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15674                     nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15675                                       NL80211_ATTR_PAD))
15676                         goto nla_put_failure;
15677         }
15678
15679         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
15680                 goto nla_put_failure;
15681
15682         if (nl80211_send_chandef(msg, chandef))
15683                 goto nla_put_failure;
15684
15685         genlmsg_end(msg, hdr);
15686
15687         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15688                                 NL80211_MCGRP_MLME, gfp);
15689         return;
15690
15691  nla_put_failure:
15692         nlmsg_free(msg);
15693 }
15694
15695 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
15696                                        struct sta_opmode_info *sta_opmode,
15697                                        gfp_t gfp)
15698 {
15699         struct sk_buff *msg;
15700         struct wireless_dev *wdev = dev->ieee80211_ptr;
15701         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15702         void *hdr;
15703
15704         if (WARN_ON(!mac))
15705                 return;
15706
15707         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15708         if (!msg)
15709                 return;
15710
15711         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
15712         if (!hdr) {
15713                 nlmsg_free(msg);
15714                 return;
15715         }
15716
15717         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
15718                 goto nla_put_failure;
15719
15720         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15721                 goto nla_put_failure;
15722
15723         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
15724                 goto nla_put_failure;
15725
15726         if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
15727             nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
15728                 goto nla_put_failure;
15729
15730         if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
15731             nla_put_u8(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
15732                 goto nla_put_failure;
15733
15734         if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
15735             nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
15736                 goto nla_put_failure;
15737
15738         genlmsg_end(msg, hdr);
15739
15740         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15741                                 NL80211_MCGRP_MLME, gfp);
15742
15743         return;
15744
15745 nla_put_failure:
15746         nlmsg_free(msg);
15747 }
15748 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
15749
15750 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
15751                            u64 cookie, bool acked, s32 ack_signal,
15752                            bool is_valid_ack_signal, gfp_t gfp)
15753 {
15754         struct wireless_dev *wdev = dev->ieee80211_ptr;
15755         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15756         struct sk_buff *msg;
15757         void *hdr;
15758
15759         trace_cfg80211_probe_status(dev, addr, cookie, acked);
15760
15761         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15762
15763         if (!msg)
15764                 return;
15765
15766         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
15767         if (!hdr) {
15768                 nlmsg_free(msg);
15769                 return;
15770         }
15771
15772         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15773             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15774             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
15775             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15776                               NL80211_ATTR_PAD) ||
15777             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
15778             (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
15779                                                 ack_signal)))
15780                 goto nla_put_failure;
15781
15782         genlmsg_end(msg, hdr);
15783
15784         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15785                                 NL80211_MCGRP_MLME, gfp);
15786         return;
15787
15788  nla_put_failure:
15789         nlmsg_free(msg);
15790 }
15791 EXPORT_SYMBOL(cfg80211_probe_status);
15792
15793 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
15794                                  const u8 *frame, size_t len,
15795                                  int freq, int sig_dbm)
15796 {
15797         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15798         struct sk_buff *msg;
15799         void *hdr;
15800         struct cfg80211_beacon_registration *reg;
15801
15802         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
15803
15804         spin_lock_bh(&rdev->beacon_registrations_lock);
15805         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
15806                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
15807                 if (!msg) {
15808                         spin_unlock_bh(&rdev->beacon_registrations_lock);
15809                         return;
15810                 }
15811
15812                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
15813                 if (!hdr)
15814                         goto nla_put_failure;
15815
15816                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15817                     (freq &&
15818                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
15819                     (sig_dbm &&
15820                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
15821                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
15822                         goto nla_put_failure;
15823
15824                 genlmsg_end(msg, hdr);
15825
15826                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
15827         }
15828         spin_unlock_bh(&rdev->beacon_registrations_lock);
15829         return;
15830
15831  nla_put_failure:
15832         spin_unlock_bh(&rdev->beacon_registrations_lock);
15833         nlmsg_free(msg);
15834 }
15835 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
15836
15837 #ifdef CONFIG_PM
15838 static int cfg80211_net_detect_results(struct sk_buff *msg,
15839                                        struct cfg80211_wowlan_wakeup *wakeup)
15840 {
15841         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
15842         struct nlattr *nl_results, *nl_match, *nl_freqs;
15843         int i, j;
15844
15845         nl_results = nla_nest_start(
15846                 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
15847         if (!nl_results)
15848                 return -EMSGSIZE;
15849
15850         for (i = 0; i < nd->n_matches; i++) {
15851                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
15852
15853                 nl_match = nla_nest_start(msg, i);
15854                 if (!nl_match)
15855                         break;
15856
15857                 /* The SSID attribute is optional in nl80211, but for
15858                  * simplicity reasons it's always present in the
15859                  * cfg80211 structure.  If a driver can't pass the
15860                  * SSID, that needs to be changed.  A zero length SSID
15861                  * is still a valid SSID (wildcard), so it cannot be
15862                  * used for this purpose.
15863                  */
15864                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
15865                             match->ssid.ssid)) {
15866                         nla_nest_cancel(msg, nl_match);
15867                         goto out;
15868                 }
15869
15870                 if (match->n_channels) {
15871                         nl_freqs = nla_nest_start(
15872                                 msg, NL80211_ATTR_SCAN_FREQUENCIES);
15873                         if (!nl_freqs) {
15874                                 nla_nest_cancel(msg, nl_match);
15875                                 goto out;
15876                         }
15877
15878                         for (j = 0; j < match->n_channels; j++) {
15879                                 if (nla_put_u32(msg, j, match->channels[j])) {
15880                                         nla_nest_cancel(msg, nl_freqs);
15881                                         nla_nest_cancel(msg, nl_match);
15882                                         goto out;
15883                                 }
15884                         }
15885
15886                         nla_nest_end(msg, nl_freqs);
15887                 }
15888
15889                 nla_nest_end(msg, nl_match);
15890         }
15891
15892 out:
15893         nla_nest_end(msg, nl_results);
15894         return 0;
15895 }
15896
15897 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
15898                                    struct cfg80211_wowlan_wakeup *wakeup,
15899                                    gfp_t gfp)
15900 {
15901         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15902         struct sk_buff *msg;
15903         void *hdr;
15904         int size = 200;
15905
15906         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
15907
15908         if (wakeup)
15909                 size += wakeup->packet_present_len;
15910
15911         msg = nlmsg_new(size, gfp);
15912         if (!msg)
15913                 return;
15914
15915         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
15916         if (!hdr)
15917                 goto free_msg;
15918
15919         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15920             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15921                               NL80211_ATTR_PAD))
15922                 goto free_msg;
15923
15924         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15925                                         wdev->netdev->ifindex))
15926                 goto free_msg;
15927
15928         if (wakeup) {
15929                 struct nlattr *reasons;
15930
15931                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
15932                 if (!reasons)
15933                         goto free_msg;
15934
15935                 if (wakeup->disconnect &&
15936                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
15937                         goto free_msg;
15938                 if (wakeup->magic_pkt &&
15939                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
15940                         goto free_msg;
15941                 if (wakeup->gtk_rekey_failure &&
15942                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
15943                         goto free_msg;
15944                 if (wakeup->eap_identity_req &&
15945                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
15946                         goto free_msg;
15947                 if (wakeup->four_way_handshake &&
15948                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
15949                         goto free_msg;
15950                 if (wakeup->rfkill_release &&
15951                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
15952                         goto free_msg;
15953
15954                 if (wakeup->pattern_idx >= 0 &&
15955                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
15956                                 wakeup->pattern_idx))
15957                         goto free_msg;
15958
15959                 if (wakeup->tcp_match &&
15960                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
15961                         goto free_msg;
15962
15963                 if (wakeup->tcp_connlost &&
15964                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
15965                         goto free_msg;
15966
15967                 if (wakeup->tcp_nomoretokens &&
15968                     nla_put_flag(msg,
15969                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
15970                         goto free_msg;
15971
15972                 if (wakeup->packet) {
15973                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
15974                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
15975
15976                         if (!wakeup->packet_80211) {
15977                                 pkt_attr =
15978                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
15979                                 len_attr =
15980                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
15981                         }
15982
15983                         if (wakeup->packet_len &&
15984                             nla_put_u32(msg, len_attr, wakeup->packet_len))
15985                                 goto free_msg;
15986
15987                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
15988                                     wakeup->packet))
15989                                 goto free_msg;
15990                 }
15991
15992                 if (wakeup->net_detect &&
15993                     cfg80211_net_detect_results(msg, wakeup))
15994                                 goto free_msg;
15995
15996                 nla_nest_end(msg, reasons);
15997         }
15998
15999         genlmsg_end(msg, hdr);
16000
16001         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16002                                 NL80211_MCGRP_MLME, gfp);
16003         return;
16004
16005  free_msg:
16006         nlmsg_free(msg);
16007 }
16008 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
16009 #endif
16010
16011 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
16012                                 enum nl80211_tdls_operation oper,
16013                                 u16 reason_code, gfp_t gfp)
16014 {
16015         struct wireless_dev *wdev = dev->ieee80211_ptr;
16016         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16017         struct sk_buff *msg;
16018         void *hdr;
16019
16020         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
16021                                          reason_code);
16022
16023         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16024         if (!msg)
16025                 return;
16026
16027         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
16028         if (!hdr) {
16029                 nlmsg_free(msg);
16030                 return;
16031         }
16032
16033         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16034             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16035             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
16036             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
16037             (reason_code > 0 &&
16038              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
16039                 goto nla_put_failure;
16040
16041         genlmsg_end(msg, hdr);
16042
16043         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16044                                 NL80211_MCGRP_MLME, gfp);
16045         return;
16046
16047  nla_put_failure:
16048         nlmsg_free(msg);
16049 }
16050 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
16051
16052 static int nl80211_netlink_notify(struct notifier_block * nb,
16053                                   unsigned long state,
16054                                   void *_notify)
16055 {
16056         struct netlink_notify *notify = _notify;
16057         struct cfg80211_registered_device *rdev;
16058         struct wireless_dev *wdev;
16059         struct cfg80211_beacon_registration *reg, *tmp;
16060
16061         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
16062                 return NOTIFY_DONE;
16063
16064         rcu_read_lock();
16065
16066         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
16067                 struct cfg80211_sched_scan_request *sched_scan_req;
16068
16069                 list_for_each_entry_rcu(sched_scan_req,
16070                                         &rdev->sched_scan_req_list,
16071                                         list) {
16072                         if (sched_scan_req->owner_nlportid == notify->portid) {
16073                                 sched_scan_req->nl_owner_dead = true;
16074                                 schedule_work(&rdev->sched_scan_stop_wk);
16075                         }
16076                 }
16077
16078                 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
16079                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
16080
16081                         if (wdev->owner_nlportid == notify->portid) {
16082                                 wdev->nl_owner_dead = true;
16083                                 schedule_work(&rdev->destroy_work);
16084                         } else if (wdev->conn_owner_nlportid == notify->portid) {
16085                                 schedule_work(&wdev->disconnect_wk);
16086                         }
16087
16088                         cfg80211_release_pmsr(wdev, notify->portid);
16089                 }
16090
16091                 spin_lock_bh(&rdev->beacon_registrations_lock);
16092                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
16093                                          list) {
16094                         if (reg->nlportid == notify->portid) {
16095                                 list_del(&reg->list);
16096                                 kfree(reg);
16097                                 break;
16098                         }
16099                 }
16100                 spin_unlock_bh(&rdev->beacon_registrations_lock);
16101         }
16102
16103         rcu_read_unlock();
16104
16105         /*
16106          * It is possible that the user space process that is controlling the
16107          * indoor setting disappeared, so notify the regulatory core.
16108          */
16109         regulatory_netlink_notify(notify->portid);
16110         return NOTIFY_OK;
16111 }
16112
16113 static struct notifier_block nl80211_netlink_notifier = {
16114         .notifier_call = nl80211_netlink_notify,
16115 };
16116
16117 void cfg80211_ft_event(struct net_device *netdev,
16118                        struct cfg80211_ft_event_params *ft_event)
16119 {
16120         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
16121         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16122         struct sk_buff *msg;
16123         void *hdr;
16124
16125         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
16126
16127         if (!ft_event->target_ap)
16128                 return;
16129
16130         msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
16131                         GFP_KERNEL);
16132         if (!msg)
16133                 return;
16134
16135         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
16136         if (!hdr)
16137                 goto out;
16138
16139         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16140             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16141             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
16142                 goto out;
16143
16144         if (ft_event->ies &&
16145             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
16146                 goto out;
16147         if (ft_event->ric_ies &&
16148             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
16149                     ft_event->ric_ies))
16150                 goto out;
16151
16152         genlmsg_end(msg, hdr);
16153
16154         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16155                                 NL80211_MCGRP_MLME, GFP_KERNEL);
16156         return;
16157  out:
16158         nlmsg_free(msg);
16159 }
16160 EXPORT_SYMBOL(cfg80211_ft_event);
16161
16162 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
16163 {
16164         struct cfg80211_registered_device *rdev;
16165         struct sk_buff *msg;
16166         void *hdr;
16167         u32 nlportid;
16168
16169         rdev = wiphy_to_rdev(wdev->wiphy);
16170         if (!rdev->crit_proto_nlportid)
16171                 return;
16172
16173         nlportid = rdev->crit_proto_nlportid;
16174         rdev->crit_proto_nlportid = 0;
16175
16176         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16177         if (!msg)
16178                 return;
16179
16180         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
16181         if (!hdr)
16182                 goto nla_put_failure;
16183
16184         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16185             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16186                               NL80211_ATTR_PAD))
16187                 goto nla_put_failure;
16188
16189         genlmsg_end(msg, hdr);
16190
16191         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
16192         return;
16193
16194  nla_put_failure:
16195         nlmsg_free(msg);
16196 }
16197 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
16198
16199 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
16200 {
16201         struct wiphy *wiphy = wdev->wiphy;
16202         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16203         struct sk_buff *msg;
16204         void *hdr;
16205
16206         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16207         if (!msg)
16208                 return;
16209
16210         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
16211         if (!hdr)
16212                 goto out;
16213
16214         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16215             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
16216             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16217                               NL80211_ATTR_PAD))
16218                 goto out;
16219
16220         genlmsg_end(msg, hdr);
16221
16222         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
16223                                 NL80211_MCGRP_MLME, GFP_KERNEL);
16224         return;
16225  out:
16226         nlmsg_free(msg);
16227 }
16228
16229 int cfg80211_external_auth_request(struct net_device *dev,
16230                                    struct cfg80211_external_auth_params *params,
16231                                    gfp_t gfp)
16232 {
16233         struct wireless_dev *wdev = dev->ieee80211_ptr;
16234         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16235         struct sk_buff *msg;
16236         void *hdr;
16237
16238         if (!wdev->conn_owner_nlportid)
16239                 return -EINVAL;
16240
16241         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16242         if (!msg)
16243                 return -ENOMEM;
16244
16245         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
16246         if (!hdr)
16247                 goto nla_put_failure;
16248
16249         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16250             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16251             nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) ||
16252             nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
16253                         params->action) ||
16254             nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
16255             nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
16256                     params->ssid.ssid))
16257                 goto nla_put_failure;
16258
16259         genlmsg_end(msg, hdr);
16260         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
16261                         wdev->conn_owner_nlportid);
16262         return 0;
16263
16264  nla_put_failure:
16265         nlmsg_free(msg);
16266         return -ENOBUFS;
16267 }
16268 EXPORT_SYMBOL(cfg80211_external_auth_request);
16269
16270 /* initialisation/exit functions */
16271
16272 int __init nl80211_init(void)
16273 {
16274         int err;
16275
16276         err = genl_register_family(&nl80211_fam);
16277         if (err)
16278                 return err;
16279
16280         err = netlink_register_notifier(&nl80211_netlink_notifier);
16281         if (err)
16282                 goto err_out;
16283
16284         return 0;
16285  err_out:
16286         genl_unregister_family(&nl80211_fam);
16287         return err;
16288 }
16289
16290 void nl80211_exit(void)
16291 {
16292         netlink_unregister_notifier(&nl80211_netlink_notifier);
16293         genl_unregister_family(&nl80211_fam);
16294 }