net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright 2013-2014  Intel Mobile Communications GmbH
   6  * Copyright 2015-2017  Intel Deutschland GmbH
   7  * Copyright (C) 2018-2019 Intel Corporation
   8  */
   9
  10 #include <linux/if.h>
  11 #include <linux/module.h>
  12 #include <linux/err.h>
  13 #include <linux/slab.h>
  14 #include <linux/list.h>
  15 #include <linux/if_ether.h>
  16 #include <linux/ieee80211.h>
  17 #include <linux/nl80211.h>
  18 #include <linux/rtnetlink.h>
  19 #include <linux/netlink.h>
  20 #include <linux/nospec.h>
  21 #include <linux/etherdevice.h>
  22 #include <net/net_namespace.h>
  23 #include <net/genetlink.h>
  24 #include <net/cfg80211.h>
  25 #include <net/sock.h>
  26 #include <net/inet_connection_sock.h>
  27 #include "core.h"
  28 #include "nl80211.h"
  29 #include "reg.h"
  30 #include "rdev-ops.h"
  31
  32 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  33                                    struct genl_info *info,
  34                                    struct cfg80211_crypto_settings *settings,
  35                                    int cipher_limit);
  36
  37 /* the netlink family */
  38 static struct genl_family nl80211_fam;
  39
  40 /* multicast groups */
  41 enum nl80211_multicast_groups {
  42         NL80211_MCGRP_CONFIG,
  43         NL80211_MCGRP_SCAN,
  44         NL80211_MCGRP_REGULATORY,
  45         NL80211_MCGRP_MLME,
  46         NL80211_MCGRP_VENDOR,
  47         NL80211_MCGRP_NAN,
  48         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  49 };
  50
  51 static const struct genl_multicast_group nl80211_mcgrps[] = {
  52         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  53         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  54         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  55         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  56         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  57         [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
  58 #ifdef CONFIG_NL80211_TESTMODE
  59         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  60 #endif
  61 };
  62
  63 /* returns ERR_PTR values */
  64 static struct wireless_dev *
  65 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  66 {
  67         struct cfg80211_registered_device *rdev;
  68         struct wireless_dev *result = NULL;
  69         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  70         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  71         u64 wdev_id;
  72         int wiphy_idx = -1;
  73         int ifidx = -1;
  74
  75         ASSERT_RTNL();
  76
  77         if (!have_ifidx && !have_wdev_id)
  78                 return ERR_PTR(-EINVAL);
  79
  80         if (have_ifidx)
  81                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  82         if (have_wdev_id) {
  83                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  84                 wiphy_idx = wdev_id >> 32;
  85         }
  86
  87         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  88                 struct wireless_dev *wdev;
  89
  90                 if (wiphy_net(&rdev->wiphy) != netns)
  91                         continue;
  92
  93                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  94                         continue;
  95
  96                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
  97                         if (have_ifidx && wdev->netdev &&
  98                             wdev->netdev->ifindex == ifidx) {
  99                                 result = wdev;
 100                                 break;
 101                         }
 102                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 103                                 result = wdev;
 104                                 break;
 105                         }
 106                 }
 107
 108                 if (result)
 109                         break;
 110         }
 111
 112         if (result)
 113                 return result;
 114         return ERR_PTR(-ENODEV);
 115 }
 116
 117 static struct cfg80211_registered_device *
 118 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 119 {
 120         struct cfg80211_registered_device *rdev = NULL, *tmp;
 121         struct net_device *netdev;
 122
 123         ASSERT_RTNL();
 124
 125         if (!attrs[NL80211_ATTR_WIPHY] &&
 126             !attrs[NL80211_ATTR_IFINDEX] &&
 127             !attrs[NL80211_ATTR_WDEV])
 128                 return ERR_PTR(-EINVAL);
 129
 130         if (attrs[NL80211_ATTR_WIPHY])
 131                 rdev = cfg80211_rdev_by_wiphy_idx(
 132                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 133
 134         if (attrs[NL80211_ATTR_WDEV]) {
 135                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 136                 struct wireless_dev *wdev;
 137                 bool found = false;
 138
 139                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 140                 if (tmp) {
 141                         /* make sure wdev exists */
 142                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 143                                 if (wdev->identifier != (u32)wdev_id)
 144                                         continue;
 145                                 found = true;
 146                                 break;
 147                         }
 148
 149                         if (!found)
 150                                 tmp = NULL;
 151
 152                         if (rdev && tmp != rdev)
 153                                 return ERR_PTR(-EINVAL);
 154                         rdev = tmp;
 155                 }
 156         }
 157
 158         if (attrs[NL80211_ATTR_IFINDEX]) {
 159                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 160
 161                 netdev = __dev_get_by_index(netns, ifindex);
 162                 if (netdev) {
 163                         if (netdev->ieee80211_ptr)
 164                                 tmp = wiphy_to_rdev(
 165                                         netdev->ieee80211_ptr->wiphy);
 166                         else
 167                                 tmp = NULL;
 168
 169                         /* not wireless device -- return error */
 170                         if (!tmp)
 171                                 return ERR_PTR(-EINVAL);
 172
 173                         /* mismatch -- return error */
 174                         if (rdev && tmp != rdev)
 175                                 return ERR_PTR(-EINVAL);
 176
 177                         rdev = tmp;
 178                 }
 179         }
 180
 181         if (!rdev)
 182                 return ERR_PTR(-ENODEV);
 183
 184         if (netns != wiphy_net(&rdev->wiphy))
 185                 return ERR_PTR(-ENODEV);
 186
 187         return rdev;
 188 }
 189
 190 /*
 191  * This function returns a pointer to the driver
 192  * that the genl_info item that is passed refers to.
 193  *
 194  * The result of this can be a PTR_ERR and hence must
 195  * be checked with IS_ERR() for errors.
 196  */
 197 static struct cfg80211_registered_device *
 198 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 199 {
 200         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 201 }
 202
 203 static int validate_ie_attr(const struct nlattr *attr,
 204                             struct netlink_ext_ack *extack)
 205 {
 206         const u8 *data = nla_data(attr);
 207         unsigned int len = nla_len(attr);
 208         const struct element *elem;
 209
 210         for_each_element(elem, data, len) {
 211                 /* nothing */
 212         }
 213
 214         if (for_each_element_completed(elem, data, len))
 215                 return 0;
 216
 217         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
 218         return -EINVAL;
 219 }
 220
 221 /* policy for the attributes */
 222 static const struct nla_policy
 223 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
 224         [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
 225         [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
 226                                         .len = U8_MAX },
 227         [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
 228                                              .len = U8_MAX },
 229 };
 230
 231 static const struct nla_policy
 232 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
 233         [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
 234         [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
 235         [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
 236                 NLA_POLICY_MAX(NLA_U8, 15),
 237         [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
 238         [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
 239                 NLA_POLICY_MAX(NLA_U8, 15),
 240         [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] =
 241                 NLA_POLICY_MAX(NLA_U8, 31),
 242         [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
 243         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
 244         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
 245 };
 246
 247 static const struct nla_policy
 248 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
 249         [NL80211_PMSR_TYPE_FTM] =
 250                 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
 251 };
 252
 253 static const struct nla_policy
 254 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
 255         [NL80211_PMSR_REQ_ATTR_DATA] =
 256                 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
 257         [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
 258 };
 259
 260 static const struct nla_policy
 261 nl80211_psmr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
 262         [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
 263         /*
 264          * we could specify this again to be the top-level policy,
 265          * but that would open us up to recursion problems ...
 266          */
 267         [NL80211_PMSR_PEER_ATTR_CHAN] = { .type = NLA_NESTED },
 268         [NL80211_PMSR_PEER_ATTR_REQ] =
 269                 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
 270         [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
 271 };
 272
 273 static const struct nla_policy
 274 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
 275         [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
 276         [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
 277         [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
 278         [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
 279         [NL80211_PMSR_ATTR_PEERS] =
 280                 NLA_POLICY_NESTED_ARRAY(nl80211_psmr_peer_attr_policy),
 281 };
 282
 283 const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 284         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 285         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 286                                       .len = 20-1 },
 287         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 288
 289         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 290         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 291         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 292         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 293         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 294
 295         [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 296         [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 297         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 298         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 299         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 300         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 301
 302         [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
 303         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 304         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 305
 306         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 307         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 308
 309         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 310         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 311                                     .len = WLAN_MAX_KEY_LEN },
 312         [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 5),
 313         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 314         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 315         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 316         [NL80211_ATTR_KEY_TYPE] =
 317                 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
 318
 319         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 320         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 321         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 322                                        .len = IEEE80211_MAX_DATA_LEN },
 323         [NL80211_ATTR_BEACON_TAIL] =
 324                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 325                                        IEEE80211_MAX_DATA_LEN),
 326         [NL80211_ATTR_STA_AID] =
 327                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 328         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 329         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 330         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 331                                                .len = NL80211_MAX_SUPP_RATES },
 332         [NL80211_ATTR_STA_PLINK_ACTION] =
 333                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
 334         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 335         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 336         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 337                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 338         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 339
 340         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 341         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 342
 343         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 344         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 345         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 346         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 347                                            .len = NL80211_MAX_SUPP_RATES },
 348         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 349
 350         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 351         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 352
 353         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 354
 355         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 356         [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
 357                                                    validate_ie_attr,
 358                                                    IEEE80211_MAX_DATA_LEN),
 359         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 360         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 361
 362         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 363                                 .len = IEEE80211_MAX_SSID_LEN },
 364         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 365         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 366         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 367         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 368         [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
 369                                                   NL80211_MFP_NO,
 370                                                   NL80211_MFP_OPTIONAL),
 371         [NL80211_ATTR_STA_FLAGS2] = {
 372                 .len = sizeof(struct nl80211_sta_flag_update),
 373         },
 374         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 375         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 376         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 377         [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
 378         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 379         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 380         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 381         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 382         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 383         [NL80211_ATTR_PMKID] = { .len = WLAN_PMKID_LEN },
 384         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 385         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 386         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 387         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 388                                  .len = IEEE80211_MAX_DATA_LEN },
 389         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 390         [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
 391                                                    NL80211_PS_DISABLED,
 392                                                    NL80211_PS_ENABLED),
 393         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 394         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 395         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 396         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 397         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 398         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 399         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 400         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 401         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 402         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 403         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 404         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 405         [NL80211_ATTR_STA_PLINK_STATE] =
 406                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
 407         [NL80211_ATTR_MESH_PEER_AID] =
 408                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 409         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 410         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 411         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 412         [NL80211_ATTR_HIDDEN_SSID] =
 413                 NLA_POLICY_RANGE(NLA_U32,
 414                                  NL80211_HIDDEN_SSID_NOT_IN_USE,
 415                                  NL80211_HIDDEN_SSID_ZERO_CONTENTS),
 416         [NL80211_ATTR_IE_PROBE_RESP] =
 417                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 418                                        IEEE80211_MAX_DATA_LEN),
 419         [NL80211_ATTR_IE_ASSOC_RESP] =
 420                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 421                                        IEEE80211_MAX_DATA_LEN),
 422         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 423         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 424         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 425         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 426         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 427         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 428         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 429         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 430         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 431         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 432         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 433                                       .len = IEEE80211_MAX_DATA_LEN },
 434         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 435         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 436         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 437                 .len = NL80211_HT_CAPABILITY_LEN
 438         },
 439         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 440         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 441         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 442         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 443         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 444         [NL80211_ATTR_AUTH_DATA] = { .type = NLA_BINARY, },
 445         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 446         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 447         [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
 448         [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
 449         [NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
 450                 NLA_POLICY_RANGE(NLA_U32,
 451                                  NL80211_MESH_POWER_UNKNOWN + 1,
 452                                  NL80211_MESH_POWER_MAX),
 453         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 454         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 455         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 456         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 457         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 458         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 459         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 460                 .len = NL80211_VHT_CAPABILITY_LEN,
 461         },
 462         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 463         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 464                                   .len = IEEE80211_MAX_DATA_LEN },
 465         [NL80211_ATTR_PEER_AID] =
 466                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 467         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 468         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 469         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 470         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 471         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 472         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 473         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 474         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 475         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 476         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 477         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 478         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 479         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 480                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 481         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 482         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 483         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 484         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 485         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 486         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 487         [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
 488         [NL80211_ATTR_USER_PRIO] =
 489                 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
 490         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 491         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 492         [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
 493         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 494         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 495         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 496         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 497         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 498         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 499         [NL80211_ATTR_STA_SUPPORT_P2P_PS] =
 500                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
 501         [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 502                 .len = VHT_MUMIMO_GROUPS_DATA_LEN
 503         },
 504         [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = { .len = ETH_ALEN },
 505         [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
 506         [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
 507         [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 508         [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
 509                                     .len = FILS_MAX_KEK_LEN },
 510         [NL80211_ATTR_FILS_NONCES] = { .len = 2 * FILS_NONCE_LEN },
 511         [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
 512         [NL80211_ATTR_BSSID] = { .len = ETH_ALEN },
 513         [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
 514         [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
 515                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 516         },
 517         [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
 518         [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
 519                                              .len = FILS_ERP_MAX_USERNAME_LEN },
 520         [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
 521                                           .len = FILS_ERP_MAX_REALM_LEN },
 522         [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
 523         [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
 524                                         .len = FILS_ERP_MAX_RRK_LEN },
 525         [NL80211_ATTR_FILS_CACHE_ID] = { .len = 2 },
 526         [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
 527         [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
 528         [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
 529
 530         [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
 531         [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
 532         [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
 533         [NL80211_ATTR_HE_CAPABILITY] = { .type = NLA_BINARY,
 534                                          .len = NL80211_HE_MAX_CAPABILITY_LEN },
 535
 536         [NL80211_ATTR_FTM_RESPONDER] = {
 537                 .type = NLA_NESTED,
 538                 .validation_data = nl80211_ftm_responder_policy,
 539         },
 540         [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
 541         [NL80211_ATTR_PEER_MEASUREMENTS] =
 542                 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
 543         [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
 544 };
 545
 546 /* policy for the key attributes */
 547 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 548         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 549         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 550         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 551         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 552         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 553         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 554         [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
 555         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 556         [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
 557 };
 558
 559 /* policy for the key default flags */
 560 static const struct nla_policy
 561 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 562         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 563         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 564 };
 565
 566 #ifdef CONFIG_PM
 567 /* policy for WoWLAN attributes */
 568 static const struct nla_policy
 569 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 570         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 571         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 572         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 573         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 574         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 575         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 576         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 577         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 578         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 579         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 580 };
 581
 582 static const struct nla_policy
 583 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 584         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 585         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 586         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 587         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 588         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 589         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 590         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 591                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 592         },
 593         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 594                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 595         },
 596         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 597         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 598         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 599 };
 600 #endif /* CONFIG_PM */
 601
 602 /* policy for coalesce rule attributes */
 603 static const struct nla_policy
 604 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 605         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 606         [NL80211_ATTR_COALESCE_RULE_CONDITION] =
 607                 NLA_POLICY_RANGE(NLA_U32,
 608                                  NL80211_COALESCE_CONDITION_MATCH,
 609                                  NL80211_COALESCE_CONDITION_NO_MATCH),
 610         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 611 };
 612
 613 /* policy for GTK rekey offload attributes */
 614 static const struct nla_policy
 615 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 616         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 617         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 618         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 619 };
 620
 621 static const struct nla_policy
 622 nl80211_match_band_rssi_policy[NUM_NL80211_BANDS] = {
 623         [NL80211_BAND_2GHZ] = { .type = NLA_S32 },
 624         [NL80211_BAND_5GHZ] = { .type = NLA_S32 },
 625         [NL80211_BAND_60GHZ] = { .type = NLA_S32 },
 626 };
 627
 628 static const struct nla_policy
 629 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 630         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 631                                                  .len = IEEE80211_MAX_SSID_LEN },
 632         [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = { .len = ETH_ALEN },
 633         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 634         [NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI] =
 635                 NLA_POLICY_NESTED(nl80211_match_band_rssi_policy),
 636 };
 637
 638 static const struct nla_policy
 639 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 640         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 641         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 642 };
 643
 644 static const struct nla_policy
 645 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 646         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 647         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 648         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 649                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 650         },
 651 };
 652
 653 /* policy for NAN function attributes */
 654 static const struct nla_policy
 655 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 656         [NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 },
 657         [NL80211_NAN_FUNC_SERVICE_ID] = {
 658                                     .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 659         [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 660         [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 661         [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 662         [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 663         [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 664         [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = { .len = ETH_ALEN },
 665         [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 666         [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 667         [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 668                         .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 669         [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 670         [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 671         [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 672         [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 673         [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 674 };
 675
 676 /* policy for Service Response Filter attributes */
 677 static const struct nla_policy
 678 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 679         [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 680         [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 681                                  .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 682         [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 683         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 684 };
 685
 686 /* policy for packet pattern attributes */
 687 static const struct nla_policy
 688 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
 689         [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
 690         [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
 691         [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
 692 };
 693
 694 int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
 695                               struct cfg80211_registered_device **rdev,
 696                               struct wireless_dev **wdev)
 697 {
 698         int err;
 699
 700         if (!cb->args[0]) {
 701                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 702                                   genl_family_attrbuf(&nl80211_fam),
 703                                   nl80211_fam.maxattr, nl80211_policy, NULL);
 704                 if (err)
 705                         return err;
 706
 707                 *wdev = __cfg80211_wdev_from_attrs(
 708                                         sock_net(cb->skb->sk),
 709                                         genl_family_attrbuf(&nl80211_fam));
 710                 if (IS_ERR(*wdev))
 711                         return PTR_ERR(*wdev);
 712                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 713                 /* 0 is the first index - add 1 to parse only once */
 714                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 715                 cb->args[1] = (*wdev)->identifier;
 716         } else {
 717                 /* subtract the 1 again here */
 718                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 719                 struct wireless_dev *tmp;
 720
 721                 if (!wiphy)
 722                         return -ENODEV;
 723                 *rdev = wiphy_to_rdev(wiphy);
 724                 *wdev = NULL;
 725
 726                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
 727                         if (tmp->identifier == cb->args[1]) {
 728                                 *wdev = tmp;
 729                                 break;
 730                         }
 731                 }
 732
 733                 if (!*wdev)
 734                         return -ENODEV;
 735         }
 736
 737         return 0;
 738 }
 739
 740 /* message building helper */
 741 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 742                      int flags, u8 cmd)
 743 {
 744         /* since there is no private header just add the generic one */
 745         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 746 }
 747
 748 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
 749                                      const struct ieee80211_reg_rule *rule)
 750 {
 751         int j;
 752         struct nlattr *nl_wmm_rules =
 753                 nla_nest_start(msg, NL80211_FREQUENCY_ATTR_WMM);
 754
 755         if (!nl_wmm_rules)
 756                 goto nla_put_failure;
 757
 758         for (j = 0; j < IEEE80211_NUM_ACS; j++) {
 759                 struct nlattr *nl_wmm_rule = nla_nest_start(msg, j);
 760
 761                 if (!nl_wmm_rule)
 762                         goto nla_put_failure;
 763
 764                 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
 765                                 rule->wmm_rule.client[j].cw_min) ||
 766                     nla_put_u16(msg, NL80211_WMMR_CW_MAX,
 767                                 rule->wmm_rule.client[j].cw_max) ||
 768                     nla_put_u8(msg, NL80211_WMMR_AIFSN,
 769                                rule->wmm_rule.client[j].aifsn) ||
 770                     nla_put_u16(msg, NL80211_WMMR_TXOP,
 771                                 rule->wmm_rule.client[j].cot))
 772                         goto nla_put_failure;
 773
 774                 nla_nest_end(msg, nl_wmm_rule);
 775         }
 776         nla_nest_end(msg, nl_wmm_rules);
 777
 778         return 0;
 779
 780 nla_put_failure:
 781         return -ENOBUFS;
 782 }
 783
 784 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
 785                                    struct ieee80211_channel *chan,
 786                                    bool large)
 787 {
 788         /* Some channels must be completely excluded from the
 789          * list to protect old user-space tools from breaking
 790          */
 791         if (!large && chan->flags &
 792             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 793                 return 0;
 794
 795         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 796                         chan->center_freq))
 797                 goto nla_put_failure;
 798
 799         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 800             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 801                 goto nla_put_failure;
 802         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 803                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 804                         goto nla_put_failure;
 805                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 806                         goto nla_put_failure;
 807         }
 808         if (chan->flags & IEEE80211_CHAN_RADAR) {
 809                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 810                         goto nla_put_failure;
 811                 if (large) {
 812                         u32 time;
 813
 814                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 815
 816                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 817                                         chan->dfs_state))
 818                                 goto nla_put_failure;
 819                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 820                                         time))
 821                                 goto nla_put_failure;
 822                         if (nla_put_u32(msg,
 823                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 824                                         chan->dfs_cac_ms))
 825                                 goto nla_put_failure;
 826                 }
 827         }
 828
 829         if (large) {
 830                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 831                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 832                         goto nla_put_failure;
 833                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 834                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 835                         goto nla_put_failure;
 836                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 837                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 838                         goto nla_put_failure;
 839                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 840                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 841                         goto nla_put_failure;
 842                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 843                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 844                         goto nla_put_failure;
 845                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
 846                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
 847                         goto nla_put_failure;
 848                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 849                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 850                         goto nla_put_failure;
 851                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 852                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 853                         goto nla_put_failure;
 854         }
 855
 856         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 857                         DBM_TO_MBM(chan->max_power)))
 858                 goto nla_put_failure;
 859
 860         if (large) {
 861                 const struct ieee80211_reg_rule *rule =
 862                         freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
 863
 864                 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
 865                         if (nl80211_msg_put_wmm_rules(msg, rule))
 866                                 goto nla_put_failure;
 867                 }
 868         }
 869
 870         return 0;
 871
 872  nla_put_failure:
 873         return -ENOBUFS;
 874 }
 875
 876 static bool nl80211_put_txq_stats(struct sk_buff *msg,
 877                                   struct cfg80211_txq_stats *txqstats,
 878                                   int attrtype)
 879 {
 880         struct nlattr *txqattr;
 881
 882 #define PUT_TXQVAL_U32(attr, memb) do {                                   \
 883         if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) &&         \
 884             nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
 885                 return false;                                             \
 886         } while (0)
 887
 888         txqattr = nla_nest_start(msg, attrtype);
 889         if (!txqattr)
 890                 return false;
 891
 892         PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
 893         PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
 894         PUT_TXQVAL_U32(FLOWS, flows);
 895         PUT_TXQVAL_U32(DROPS, drops);
 896         PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
 897         PUT_TXQVAL_U32(OVERLIMIT, overlimit);
 898         PUT_TXQVAL_U32(OVERMEMORY, overmemory);
 899         PUT_TXQVAL_U32(COLLISIONS, collisions);
 900         PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
 901         PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
 902         PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
 903         nla_nest_end(msg, txqattr);
 904
 905 #undef PUT_TXQVAL_U32
 906         return true;
 907 }
 908
 909 /* netlink command implementations */
 910
 911 struct key_parse {
 912         struct key_params p;
 913         int idx;
 914         int type;
 915         bool def, defmgmt;
 916         bool def_uni, def_multi;
 917 };
 918
 919 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
 920                                  struct key_parse *k)
 921 {
 922         struct nlattr *tb[NL80211_KEY_MAX + 1];
 923         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 924                                    nl80211_key_policy, info->extack);
 925         if (err)
 926                 return err;
 927
 928         k->def = !!tb[NL80211_KEY_DEFAULT];
 929         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 930
 931         if (k->def) {
 932                 k->def_uni = true;
 933                 k->def_multi = true;
 934         }
 935         if (k->defmgmt)
 936                 k->def_multi = true;
 937
 938         if (tb[NL80211_KEY_IDX])
 939                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 940
 941         if (tb[NL80211_KEY_DATA]) {
 942                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 943                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 944         }
 945
 946         if (tb[NL80211_KEY_SEQ]) {
 947                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 948                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 949         }
 950
 951         if (tb[NL80211_KEY_CIPHER])
 952                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 953
 954         if (tb[NL80211_KEY_TYPE])
 955                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 956
 957         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 958                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 959
 960                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 961                                        tb[NL80211_KEY_DEFAULT_TYPES],
 962                                        nl80211_key_default_policy,
 963                                        info->extack);
 964                 if (err)
 965                         return err;
 966
 967                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 968                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 969         }
 970
 971         if (tb[NL80211_KEY_MODE])
 972                 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
 973
 974         return 0;
 975 }
 976
 977 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 978 {
 979         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 980                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 981                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 982         }
 983
 984         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 985                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 986                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 987         }
 988
 989         if (info->attrs[NL80211_ATTR_KEY_IDX])
 990                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 991
 992         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 993                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 994
 995         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 996         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 997
 998         if (k->def) {
 999                 k->def_uni = true;
1000                 k->def_multi = true;
1001         }
1002         if (k->defmgmt)
1003                 k->def_multi = true;
1004
1005         if (info->attrs[NL80211_ATTR_KEY_TYPE])
1006                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1007
1008         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
1009                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1010                 int err = nla_parse_nested(kdt,
1011                                            NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1012                                            info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
1013                                            nl80211_key_default_policy,
1014                                            info->extack);
1015                 if (err)
1016                         return err;
1017
1018                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1019                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1020         }
1021
1022         return 0;
1023 }
1024
1025 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
1026 {
1027         int err;
1028
1029         memset(k, 0, sizeof(*k));
1030         k->idx = -1;
1031         k->type = -1;
1032
1033         if (info->attrs[NL80211_ATTR_KEY])
1034                 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
1035         else
1036                 err = nl80211_parse_key_old(info, k);
1037
1038         if (err)
1039                 return err;
1040
1041         if (k->def && k->defmgmt) {
1042                 GENL_SET_ERR_MSG(info, "key with def && defmgmt is invalid");
1043                 return -EINVAL;
1044         }
1045
1046         if (k->defmgmt) {
1047                 if (k->def_uni || !k->def_multi) {
1048                         GENL_SET_ERR_MSG(info, "defmgmt key must be mcast");
1049                         return -EINVAL;
1050                 }
1051         }
1052
1053         if (k->idx != -1) {
1054                 if (k->defmgmt) {
1055                         if (k->idx < 4 || k->idx > 5) {
1056                                 GENL_SET_ERR_MSG(info,
1057                                                  "defmgmt key idx not 4 or 5");
1058                                 return -EINVAL;
1059                         }
1060                 } else if (k->def) {
1061                         if (k->idx < 0 || k->idx > 3) {
1062                                 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1063                                 return -EINVAL;
1064                         }
1065                 } else {
1066                         if (k->idx < 0 || k->idx > 5) {
1067                                 GENL_SET_ERR_MSG(info, "key idx not 0-5");
1068                                 return -EINVAL;
1069                         }
1070                 }
1071         }
1072
1073         return 0;
1074 }
1075
1076 static struct cfg80211_cached_keys *
1077 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1078                        struct genl_info *info, bool *no_ht)
1079 {
1080         struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1081         struct key_parse parse;
1082         struct nlattr *key;
1083         struct cfg80211_cached_keys *result;
1084         int rem, err, def = 0;
1085         bool have_key = false;
1086
1087         nla_for_each_nested(key, keys, rem) {
1088                 have_key = true;
1089                 break;
1090         }
1091
1092         if (!have_key)
1093                 return NULL;
1094
1095         result = kzalloc(sizeof(*result), GFP_KERNEL);
1096         if (!result)
1097                 return ERR_PTR(-ENOMEM);
1098
1099         result->def = -1;
1100
1101         nla_for_each_nested(key, keys, rem) {
1102                 memset(&parse, 0, sizeof(parse));
1103                 parse.idx = -1;
1104
1105                 err = nl80211_parse_key_new(info, key, &parse);
1106                 if (err)
1107                         goto error;
1108                 err = -EINVAL;
1109                 if (!parse.p.key)
1110                         goto error;
1111                 if (parse.idx < 0 || parse.idx > 3) {
1112                         GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1113                         goto error;
1114                 }
1115                 if (parse.def) {
1116                         if (def) {
1117                                 GENL_SET_ERR_MSG(info,
1118                                                  "only one key can be default");
1119                                 goto error;
1120                         }
1121                         def = 1;
1122                         result->def = parse.idx;
1123                         if (!parse.def_uni || !parse.def_multi)
1124                                 goto error;
1125                 } else if (parse.defmgmt)
1126                         goto error;
1127                 err = cfg80211_validate_key_settings(rdev, &parse.p,
1128                                                      parse.idx, false, NULL);
1129                 if (err)
1130                         goto error;
1131                 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1132                     parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1133                         GENL_SET_ERR_MSG(info, "connect key must be WEP");
1134                         err = -EINVAL;
1135                         goto error;
1136                 }
1137                 result->params[parse.idx].cipher = parse.p.cipher;
1138                 result->params[parse.idx].key_len = parse.p.key_len;
1139                 result->params[parse.idx].key = result->data[parse.idx];
1140                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1141
1142                 /* must be WEP key if we got here */
1143                 if (no_ht)
1144                         *no_ht = true;
1145         }
1146
1147         if (result->def < 0) {
1148                 err = -EINVAL;
1149                 GENL_SET_ERR_MSG(info, "need a default/TX key");
1150                 goto error;
1151         }
1152
1153         return result;
1154  error:
1155         kfree(result);
1156         return ERR_PTR(err);
1157 }
1158
1159 static int nl80211_key_allowed(struct wireless_dev *wdev)
1160 {
1161         ASSERT_WDEV_LOCK(wdev);
1162
1163         switch (wdev->iftype) {
1164         case NL80211_IFTYPE_AP:
1165         case NL80211_IFTYPE_AP_VLAN:
1166         case NL80211_IFTYPE_P2P_GO:
1167         case NL80211_IFTYPE_MESH_POINT:
1168                 break;
1169         case NL80211_IFTYPE_ADHOC:
1170         case NL80211_IFTYPE_STATION:
1171         case NL80211_IFTYPE_P2P_CLIENT:
1172                 if (!wdev->current_bss)
1173                         return -ENOLINK;
1174                 break;
1175         case NL80211_IFTYPE_UNSPECIFIED:
1176         case NL80211_IFTYPE_OCB:
1177         case NL80211_IFTYPE_MONITOR:
1178         case NL80211_IFTYPE_NAN:
1179         case NL80211_IFTYPE_P2P_DEVICE:
1180         case NL80211_IFTYPE_WDS:
1181         case NUM_NL80211_IFTYPES:
1182                 return -EINVAL;
1183         }
1184
1185         return 0;
1186 }
1187
1188 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1189                                                         struct nlattr *tb)
1190 {
1191         struct ieee80211_channel *chan;
1192
1193         if (tb == NULL)
1194                 return NULL;
1195         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
1196         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1197                 return NULL;
1198         return chan;
1199 }
1200
1201 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1202 {
1203         struct nlattr *nl_modes = nla_nest_start(msg, attr);
1204         int i;
1205
1206         if (!nl_modes)
1207                 goto nla_put_failure;
1208
1209         i = 0;
1210         while (ifmodes) {
1211                 if ((ifmodes & 1) && nla_put_flag(msg, i))
1212                         goto nla_put_failure;
1213                 ifmodes >>= 1;
1214                 i++;
1215         }
1216
1217         nla_nest_end(msg, nl_modes);
1218         return 0;
1219
1220 nla_put_failure:
1221         return -ENOBUFS;
1222 }
1223
1224 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1225                                           struct sk_buff *msg,
1226                                           bool large)
1227 {
1228         struct nlattr *nl_combis;
1229         int i, j;
1230
1231         nl_combis = nla_nest_start(msg,
1232                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
1233         if (!nl_combis)
1234                 goto nla_put_failure;
1235
1236         for (i = 0; i < wiphy->n_iface_combinations; i++) {
1237                 const struct ieee80211_iface_combination *c;
1238                 struct nlattr *nl_combi, *nl_limits;
1239
1240                 c = &wiphy->iface_combinations[i];
1241
1242                 nl_combi = nla_nest_start(msg, i + 1);
1243                 if (!nl_combi)
1244                         goto nla_put_failure;
1245
1246                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
1247                 if (!nl_limits)
1248                         goto nla_put_failure;
1249
1250                 for (j = 0; j < c->n_limits; j++) {
1251                         struct nlattr *nl_limit;
1252
1253                         nl_limit = nla_nest_start(msg, j + 1);
1254                         if (!nl_limit)
1255                                 goto nla_put_failure;
1256                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1257                                         c->limits[j].max))
1258                                 goto nla_put_failure;
1259                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1260                                                 c->limits[j].types))
1261                                 goto nla_put_failure;
1262                         nla_nest_end(msg, nl_limit);
1263                 }
1264
1265                 nla_nest_end(msg, nl_limits);
1266
1267                 if (c->beacon_int_infra_match &&
1268                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1269                         goto nla_put_failure;
1270                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1271                                 c->num_different_channels) ||
1272                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1273                                 c->max_interfaces))
1274                         goto nla_put_failure;
1275                 if (large &&
1276                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1277                                 c->radar_detect_widths) ||
1278                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1279                                 c->radar_detect_regions)))
1280                         goto nla_put_failure;
1281                 if (c->beacon_int_min_gcd &&
1282                     nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1283                                 c->beacon_int_min_gcd))
1284                         goto nla_put_failure;
1285
1286                 nla_nest_end(msg, nl_combi);
1287         }
1288
1289         nla_nest_end(msg, nl_combis);
1290
1291         return 0;
1292 nla_put_failure:
1293         return -ENOBUFS;
1294 }
1295
1296 #ifdef CONFIG_PM
1297 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1298                                         struct sk_buff *msg)
1299 {
1300         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1301         struct nlattr *nl_tcp;
1302
1303         if (!tcp)
1304                 return 0;
1305
1306         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1307         if (!nl_tcp)
1308                 return -ENOBUFS;
1309
1310         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1311                         tcp->data_payload_max))
1312                 return -ENOBUFS;
1313
1314         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1315                         tcp->data_payload_max))
1316                 return -ENOBUFS;
1317
1318         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1319                 return -ENOBUFS;
1320
1321         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1322                                 sizeof(*tcp->tok), tcp->tok))
1323                 return -ENOBUFS;
1324
1325         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1326                         tcp->data_interval_max))
1327                 return -ENOBUFS;
1328
1329         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1330                         tcp->wake_payload_max))
1331                 return -ENOBUFS;
1332
1333         nla_nest_end(msg, nl_tcp);
1334         return 0;
1335 }
1336
1337 static int nl80211_send_wowlan(struct sk_buff *msg,
1338                                struct cfg80211_registered_device *rdev,
1339                                bool large)
1340 {
1341         struct nlattr *nl_wowlan;
1342
1343         if (!rdev->wiphy.wowlan)
1344                 return 0;
1345
1346         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1347         if (!nl_wowlan)
1348                 return -ENOBUFS;
1349
1350         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1351              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1352             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1353              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1354             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1355              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1356             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1357              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1358             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1359              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1360             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1361              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1362             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1363              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1364             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1365              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1366                 return -ENOBUFS;
1367
1368         if (rdev->wiphy.wowlan->n_patterns) {
1369                 struct nl80211_pattern_support pat = {
1370                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1371                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1372                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1373                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1374                 };
1375
1376                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1377                             sizeof(pat), &pat))
1378                         return -ENOBUFS;
1379         }
1380
1381         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1382             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1383                         rdev->wiphy.wowlan->max_nd_match_sets))
1384                 return -ENOBUFS;
1385
1386         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1387                 return -ENOBUFS;
1388
1389         nla_nest_end(msg, nl_wowlan);
1390
1391         return 0;
1392 }
1393 #endif
1394
1395 static int nl80211_send_coalesce(struct sk_buff *msg,
1396                                  struct cfg80211_registered_device *rdev)
1397 {
1398         struct nl80211_coalesce_rule_support rule;
1399
1400         if (!rdev->wiphy.coalesce)
1401                 return 0;
1402
1403         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1404         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1405         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1406         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1407         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1408         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1409
1410         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1411                 return -ENOBUFS;
1412
1413         return 0;
1414 }
1415
1416 static int
1417 nl80211_send_iftype_data(struct sk_buff *msg,
1418                          const struct ieee80211_sband_iftype_data *iftdata)
1419 {
1420         const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1421
1422         if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1423                                 iftdata->types_mask))
1424                 return -ENOBUFS;
1425
1426         if (he_cap->has_he) {
1427                 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1428                             sizeof(he_cap->he_cap_elem.mac_cap_info),
1429                             he_cap->he_cap_elem.mac_cap_info) ||
1430                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1431                             sizeof(he_cap->he_cap_elem.phy_cap_info),
1432                             he_cap->he_cap_elem.phy_cap_info) ||
1433                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1434                             sizeof(he_cap->he_mcs_nss_supp),
1435                             &he_cap->he_mcs_nss_supp) ||
1436                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1437                             sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1438                         return -ENOBUFS;
1439         }
1440
1441         return 0;
1442 }
1443
1444 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1445                                       struct ieee80211_supported_band *sband)
1446 {
1447         struct nlattr *nl_rates, *nl_rate;
1448         struct ieee80211_rate *rate;
1449         int i;
1450
1451         /* add HT info */
1452         if (sband->ht_cap.ht_supported &&
1453             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1454                      sizeof(sband->ht_cap.mcs),
1455                      &sband->ht_cap.mcs) ||
1456              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1457                          sband->ht_cap.cap) ||
1458              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1459                         sband->ht_cap.ampdu_factor) ||
1460              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1461                         sband->ht_cap.ampdu_density)))
1462                 return -ENOBUFS;
1463
1464         /* add VHT info */
1465         if (sband->vht_cap.vht_supported &&
1466             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1467                      sizeof(sband->vht_cap.vht_mcs),
1468                      &sband->vht_cap.vht_mcs) ||
1469              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1470                          sband->vht_cap.cap)))
1471                 return -ENOBUFS;
1472
1473         if (sband->n_iftype_data) {
1474                 struct nlattr *nl_iftype_data =
1475                         nla_nest_start(msg, NL80211_BAND_ATTR_IFTYPE_DATA);
1476                 int err;
1477
1478                 if (!nl_iftype_data)
1479                         return -ENOBUFS;
1480
1481                 for (i = 0; i < sband->n_iftype_data; i++) {
1482                         struct nlattr *iftdata;
1483
1484                         iftdata = nla_nest_start(msg, i + 1);
1485                         if (!iftdata)
1486                                 return -ENOBUFS;
1487
1488                         err = nl80211_send_iftype_data(msg,
1489                                                        &sband->iftype_data[i]);
1490                         if (err)
1491                                 return err;
1492
1493                         nla_nest_end(msg, iftdata);
1494                 }
1495
1496                 nla_nest_end(msg, nl_iftype_data);
1497         }
1498
1499         /* add bitrates */
1500         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1501         if (!nl_rates)
1502                 return -ENOBUFS;
1503
1504         for (i = 0; i < sband->n_bitrates; i++) {
1505                 nl_rate = nla_nest_start(msg, i);
1506                 if (!nl_rate)
1507                         return -ENOBUFS;
1508
1509                 rate = &sband->bitrates[i];
1510                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1511                                 rate->bitrate))
1512                         return -ENOBUFS;
1513                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1514                     nla_put_flag(msg,
1515                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1516                         return -ENOBUFS;
1517
1518                 nla_nest_end(msg, nl_rate);
1519         }
1520
1521         nla_nest_end(msg, nl_rates);
1522
1523         return 0;
1524 }
1525
1526 static int
1527 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1528                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1529 {
1530         u16 stypes;
1531         struct nlattr *nl_ftypes, *nl_ifs;
1532         enum nl80211_iftype ift;
1533         int i;
1534
1535         if (!mgmt_stypes)
1536                 return 0;
1537
1538         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1539         if (!nl_ifs)
1540                 return -ENOBUFS;
1541
1542         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1543                 nl_ftypes = nla_nest_start(msg, ift);
1544                 if (!nl_ftypes)
1545                         return -ENOBUFS;
1546                 i = 0;
1547                 stypes = mgmt_stypes[ift].tx;
1548                 while (stypes) {
1549                         if ((stypes & 1) &&
1550                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1551                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1552                                 return -ENOBUFS;
1553                         stypes >>= 1;
1554                         i++;
1555                 }
1556                 nla_nest_end(msg, nl_ftypes);
1557         }
1558
1559         nla_nest_end(msg, nl_ifs);
1560
1561         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1562         if (!nl_ifs)
1563                 return -ENOBUFS;
1564
1565         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1566                 nl_ftypes = nla_nest_start(msg, ift);
1567                 if (!nl_ftypes)
1568                         return -ENOBUFS;
1569                 i = 0;
1570                 stypes = mgmt_stypes[ift].rx;
1571                 while (stypes) {
1572                         if ((stypes & 1) &&
1573                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1574                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1575                                 return -ENOBUFS;
1576                         stypes >>= 1;
1577                         i++;
1578                 }
1579                 nla_nest_end(msg, nl_ftypes);
1580         }
1581         nla_nest_end(msg, nl_ifs);
1582
1583         return 0;
1584 }
1585
1586 #define CMD(op, n)                                                      \
1587          do {                                                           \
1588                 if (rdev->ops->op) {                                    \
1589                         i++;                                            \
1590                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n))     \
1591                                 goto nla_put_failure;                   \
1592                 }                                                       \
1593         } while (0)
1594
1595 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
1596                                         struct sk_buff *msg)
1597 {
1598         int i = 0;
1599
1600         /*
1601          * do *NOT* add anything into this function, new things need to be
1602          * advertised only to new versions of userspace that can deal with
1603          * the split (and they can't possibly care about new features...
1604          */
1605         CMD(add_virtual_intf, NEW_INTERFACE);
1606         CMD(change_virtual_intf, SET_INTERFACE);
1607         CMD(add_key, NEW_KEY);
1608         CMD(start_ap, START_AP);
1609         CMD(add_station, NEW_STATION);
1610         CMD(add_mpath, NEW_MPATH);
1611         CMD(update_mesh_config, SET_MESH_CONFIG);
1612         CMD(change_bss, SET_BSS);
1613         CMD(auth, AUTHENTICATE);
1614         CMD(assoc, ASSOCIATE);
1615         CMD(deauth, DEAUTHENTICATE);
1616         CMD(disassoc, DISASSOCIATE);
1617         CMD(join_ibss, JOIN_IBSS);
1618         CMD(join_mesh, JOIN_MESH);
1619         CMD(set_pmksa, SET_PMKSA);
1620         CMD(del_pmksa, DEL_PMKSA);
1621         CMD(flush_pmksa, FLUSH_PMKSA);
1622         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1623                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1624         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1625         CMD(mgmt_tx, FRAME);
1626         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1627         if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1628                 i++;
1629                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1630                         goto nla_put_failure;
1631         }
1632         if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1633             rdev->ops->join_mesh) {
1634                 i++;
1635                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1636                         goto nla_put_failure;
1637         }
1638         CMD(set_wds_peer, SET_WDS_PEER);
1639         if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1640                 CMD(tdls_mgmt, TDLS_MGMT);
1641                 CMD(tdls_oper, TDLS_OPER);
1642         }
1643         if (rdev->wiphy.max_sched_scan_reqs)
1644                 CMD(sched_scan_start, START_SCHED_SCAN);
1645         CMD(probe_client, PROBE_CLIENT);
1646         CMD(set_noack_map, SET_NOACK_MAP);
1647         if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1648                 i++;
1649                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1650                         goto nla_put_failure;
1651         }
1652         CMD(start_p2p_device, START_P2P_DEVICE);
1653         CMD(set_mcast_rate, SET_MCAST_RATE);
1654 #ifdef CONFIG_NL80211_TESTMODE
1655         CMD(testmode_cmd, TESTMODE);
1656 #endif
1657
1658         if (rdev->ops->connect || rdev->ops->auth) {
1659                 i++;
1660                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1661                         goto nla_put_failure;
1662         }
1663
1664         if (rdev->ops->disconnect || rdev->ops->deauth) {
1665                 i++;
1666                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1667                         goto nla_put_failure;
1668         }
1669
1670         return i;
1671  nla_put_failure:
1672         return -ENOBUFS;
1673 }
1674
1675 static int
1676 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
1677                            struct sk_buff *msg)
1678 {
1679         struct nlattr *ftm;
1680
1681         if (!cap->ftm.supported)
1682                 return 0;
1683
1684         ftm = nla_nest_start(msg, NL80211_PMSR_TYPE_FTM);
1685         if (!ftm)
1686                 return -ENOBUFS;
1687
1688         if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
1689                 return -ENOBUFS;
1690         if (cap->ftm.non_asap &&
1691             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
1692                 return -ENOBUFS;
1693         if (cap->ftm.request_lci &&
1694             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
1695                 return -ENOBUFS;
1696         if (cap->ftm.request_civicloc &&
1697             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
1698                 return -ENOBUFS;
1699         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
1700                         cap->ftm.preambles))
1701                 return -ENOBUFS;
1702         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
1703                         cap->ftm.bandwidths))
1704                 return -ENOBUFS;
1705         if (cap->ftm.max_bursts_exponent >= 0 &&
1706             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
1707                         cap->ftm.max_bursts_exponent))
1708                 return -ENOBUFS;
1709         if (cap->ftm.max_ftms_per_burst &&
1710             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
1711                         cap->ftm.max_ftms_per_burst))
1712                 return -ENOBUFS;
1713
1714         nla_nest_end(msg, ftm);
1715         return 0;
1716 }
1717
1718 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
1719                                   struct sk_buff *msg)
1720 {
1721         const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
1722         struct nlattr *pmsr, *caps;
1723
1724         if (!cap)
1725                 return 0;
1726
1727         /*
1728          * we don't need to clean up anything here since the caller
1729          * will genlmsg_cancel() if we fail
1730          */
1731
1732         pmsr = nla_nest_start(msg, NL80211_ATTR_PEER_MEASUREMENTS);
1733         if (!pmsr)
1734                 return -ENOBUFS;
1735
1736         if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
1737                 return -ENOBUFS;
1738
1739         if (cap->report_ap_tsf &&
1740             nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
1741                 return -ENOBUFS;
1742
1743         if (cap->randomize_mac_addr &&
1744             nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
1745                 return -ENOBUFS;
1746
1747         caps = nla_nest_start(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
1748         if (!caps)
1749                 return -ENOBUFS;
1750
1751         if (nl80211_send_pmsr_ftm_capa(cap, msg))
1752                 return -ENOBUFS;
1753
1754         nla_nest_end(msg, caps);
1755         nla_nest_end(msg, pmsr);
1756
1757         return 0;
1758 }
1759
1760 struct nl80211_dump_wiphy_state {
1761         s64 filter_wiphy;
1762         long start;
1763         long split_start, band_start, chan_start, capa_start;
1764         bool split;
1765 };
1766
1767 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1768                               enum nl80211_commands cmd,
1769                               struct sk_buff *msg, u32 portid, u32 seq,
1770                               int flags, struct nl80211_dump_wiphy_state *state)
1771 {
1772         void *hdr;
1773         struct nlattr *nl_bands, *nl_band;
1774         struct nlattr *nl_freqs, *nl_freq;
1775         struct nlattr *nl_cmds;
1776         enum nl80211_band band;
1777         struct ieee80211_channel *chan;
1778         int i;
1779         const struct ieee80211_txrx_stypes *mgmt_stypes =
1780                                 rdev->wiphy.mgmt_stypes;
1781         u32 features;
1782
1783         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1784         if (!hdr)
1785                 return -ENOBUFS;
1786
1787         if (WARN_ON(!state))
1788                 return -EINVAL;
1789
1790         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1791             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1792                            wiphy_name(&rdev->wiphy)) ||
1793             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1794                         cfg80211_rdev_list_generation))
1795                 goto nla_put_failure;
1796
1797         if (cmd != NL80211_CMD_NEW_WIPHY)
1798                 goto finish;
1799
1800         switch (state->split_start) {
1801         case 0:
1802                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1803                                rdev->wiphy.retry_short) ||
1804                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1805                                rdev->wiphy.retry_long) ||
1806                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1807                                 rdev->wiphy.frag_threshold) ||
1808                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1809                                 rdev->wiphy.rts_threshold) ||
1810                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1811                                rdev->wiphy.coverage_class) ||
1812                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1813                                rdev->wiphy.max_scan_ssids) ||
1814                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1815                                rdev->wiphy.max_sched_scan_ssids) ||
1816                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1817                                 rdev->wiphy.max_scan_ie_len) ||
1818                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1819                                 rdev->wiphy.max_sched_scan_ie_len) ||
1820                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1821                                rdev->wiphy.max_match_sets) ||
1822                     nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1823                                 rdev->wiphy.max_sched_scan_plans) ||
1824                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1825                                 rdev->wiphy.max_sched_scan_plan_interval) ||
1826                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1827                                 rdev->wiphy.max_sched_scan_plan_iterations))
1828                         goto nla_put_failure;
1829
1830                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1831                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1832                         goto nla_put_failure;
1833                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1834                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1835                         goto nla_put_failure;
1836                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1837                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1838                         goto nla_put_failure;
1839                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1840                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1841                         goto nla_put_failure;
1842                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1843                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1844                         goto nla_put_failure;
1845                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1846                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1847                         goto nla_put_failure;
1848                 state->split_start++;
1849                 if (state->split)
1850                         break;
1851                 /* fall through */
1852         case 1:
1853                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1854                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1855                             rdev->wiphy.cipher_suites))
1856                         goto nla_put_failure;
1857
1858                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1859                                rdev->wiphy.max_num_pmkids))
1860                         goto nla_put_failure;
1861
1862                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1863                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1864                         goto nla_put_failure;
1865
1866                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1867                                 rdev->wiphy.available_antennas_tx) ||
1868                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1869                                 rdev->wiphy.available_antennas_rx))
1870                         goto nla_put_failure;
1871
1872                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1873                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1874                                 rdev->wiphy.probe_resp_offload))
1875                         goto nla_put_failure;
1876
1877                 if ((rdev->wiphy.available_antennas_tx ||
1878                      rdev->wiphy.available_antennas_rx) &&
1879                     rdev->ops->get_antenna) {
1880                         u32 tx_ant = 0, rx_ant = 0;
1881                         int res;
1882
1883                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1884                         if (!res) {
1885                                 if (nla_put_u32(msg,
1886                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1887                                                 tx_ant) ||
1888                                     nla_put_u32(msg,
1889                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1890                                                 rx_ant))
1891                                         goto nla_put_failure;
1892                         }
1893                 }
1894
1895                 state->split_start++;
1896                 if (state->split)
1897                         break;
1898                 /* fall through */
1899         case 2:
1900                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1901                                         rdev->wiphy.interface_modes))
1902                                 goto nla_put_failure;
1903                 state->split_start++;
1904                 if (state->split)
1905                         break;
1906                 /* fall through */
1907         case 3:
1908                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1909                 if (!nl_bands)
1910                         goto nla_put_failure;
1911
1912                 for (band = state->band_start;
1913                      band < NUM_NL80211_BANDS; band++) {
1914                         struct ieee80211_supported_band *sband;
1915
1916                         sband = rdev->wiphy.bands[band];
1917
1918                         if (!sband)
1919                                 continue;
1920
1921                         nl_band = nla_nest_start(msg, band);
1922                         if (!nl_band)
1923                                 goto nla_put_failure;
1924
1925                         switch (state->chan_start) {
1926                         case 0:
1927                                 if (nl80211_send_band_rateinfo(msg, sband))
1928                                         goto nla_put_failure;
1929                                 state->chan_start++;
1930                                 if (state->split)
1931                                         break;
1932                                 /* fall through */
1933                         default:
1934                                 /* add frequencies */
1935                                 nl_freqs = nla_nest_start(
1936                                         msg, NL80211_BAND_ATTR_FREQS);
1937                                 if (!nl_freqs)
1938                                         goto nla_put_failure;
1939
1940                                 for (i = state->chan_start - 1;
1941                                      i < sband->n_channels;
1942                                      i++) {
1943                                         nl_freq = nla_nest_start(msg, i);
1944                                         if (!nl_freq)
1945                                                 goto nla_put_failure;
1946
1947                                         chan = &sband->channels[i];
1948
1949                                         if (nl80211_msg_put_channel(
1950                                                         msg, &rdev->wiphy, chan,
1951                                                         state->split))
1952                                                 goto nla_put_failure;
1953
1954                                         nla_nest_end(msg, nl_freq);
1955                                         if (state->split)
1956                                                 break;
1957                                 }
1958                                 if (i < sband->n_channels)
1959                                         state->chan_start = i + 2;
1960                                 else
1961                                         state->chan_start = 0;
1962                                 nla_nest_end(msg, nl_freqs);
1963                         }
1964
1965                         nla_nest_end(msg, nl_band);
1966
1967                         if (state->split) {
1968                                 /* start again here */
1969                                 if (state->chan_start)
1970                                         band--;
1971                                 break;
1972                         }
1973                 }
1974                 nla_nest_end(msg, nl_bands);
1975
1976                 if (band < NUM_NL80211_BANDS)
1977                         state->band_start = band + 1;
1978                 else
1979                         state->band_start = 0;
1980
1981                 /* if bands & channels are done, continue outside */
1982                 if (state->band_start == 0 && state->chan_start == 0)
1983                         state->split_start++;
1984                 if (state->split)
1985                         break;
1986                 /* fall through */
1987         case 4:
1988                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1989                 if (!nl_cmds)
1990                         goto nla_put_failure;
1991
1992                 i = nl80211_add_commands_unsplit(rdev, msg);
1993                 if (i < 0)
1994                         goto nla_put_failure;
1995                 if (state->split) {
1996                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1997                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1998                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1999                                 CMD(channel_switch, CHANNEL_SWITCH);
2000                         CMD(set_qos_map, SET_QOS_MAP);
2001                         if (rdev->wiphy.features &
2002                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
2003                                 CMD(add_tx_ts, ADD_TX_TS);
2004                         CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
2005                         CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
2006                 }
2007 #undef CMD
2008
2009                 nla_nest_end(msg, nl_cmds);
2010                 state->split_start++;
2011                 if (state->split)
2012                         break;
2013                 /* fall through */
2014         case 5:
2015                 if (rdev->ops->remain_on_channel &&
2016                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
2017                     nla_put_u32(msg,
2018                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
2019                                 rdev->wiphy.max_remain_on_channel_duration))
2020                         goto nla_put_failure;
2021
2022                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
2023                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
2024                         goto nla_put_failure;
2025
2026                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
2027                         goto nla_put_failure;
2028                 state->split_start++;
2029                 if (state->split)
2030                         break;
2031                 /* fall through */
2032         case 6:
2033 #ifdef CONFIG_PM
2034                 if (nl80211_send_wowlan(msg, rdev, state->split))
2035                         goto nla_put_failure;
2036                 state->split_start++;
2037                 if (state->split)
2038                         break;
2039 #else
2040                 state->split_start++;
2041 #endif
2042                 /* fall through */
2043         case 7:
2044                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
2045                                         rdev->wiphy.software_iftypes))
2046                         goto nla_put_failure;
2047
2048                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
2049                                                    state->split))
2050                         goto nla_put_failure;
2051
2052                 state->split_start++;
2053                 if (state->split)
2054                         break;
2055                 /* fall through */
2056         case 8:
2057                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
2058                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
2059                                 rdev->wiphy.ap_sme_capa))
2060                         goto nla_put_failure;
2061
2062                 features = rdev->wiphy.features;
2063                 /*
2064                  * We can only add the per-channel limit information if the
2065                  * dump is split, otherwise it makes it too big. Therefore
2066                  * only advertise it in that case.
2067                  */
2068                 if (state->split)
2069                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
2070                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
2071                         goto nla_put_failure;
2072
2073                 if (rdev->wiphy.ht_capa_mod_mask &&
2074                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
2075                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
2076                             rdev->wiphy.ht_capa_mod_mask))
2077                         goto nla_put_failure;
2078
2079                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
2080                     rdev->wiphy.max_acl_mac_addrs &&
2081                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
2082                                 rdev->wiphy.max_acl_mac_addrs))
2083                         goto nla_put_failure;
2084
2085                 /*
2086                  * Any information below this point is only available to
2087                  * applications that can deal with it being split. This
2088                  * helps ensure that newly added capabilities don't break
2089                  * older tools by overrunning their buffers.
2090                  *
2091                  * We still increment split_start so that in the split
2092                  * case we'll continue with more data in the next round,
2093                  * but break unconditionally so unsplit data stops here.
2094                  */
2095                 state->split_start++;
2096                 break;
2097         case 9:
2098                 if (rdev->wiphy.extended_capabilities &&
2099                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
2100                              rdev->wiphy.extended_capabilities_len,
2101                              rdev->wiphy.extended_capabilities) ||
2102                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2103                              rdev->wiphy.extended_capabilities_len,
2104                              rdev->wiphy.extended_capabilities_mask)))
2105                         goto nla_put_failure;
2106
2107                 if (rdev->wiphy.vht_capa_mod_mask &&
2108                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
2109                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
2110                             rdev->wiphy.vht_capa_mod_mask))
2111                         goto nla_put_failure;
2112
2113                 state->split_start++;
2114                 break;
2115         case 10:
2116                 if (nl80211_send_coalesce(msg, rdev))
2117                         goto nla_put_failure;
2118
2119                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
2120                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
2121                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
2122                         goto nla_put_failure;
2123
2124                 if (rdev->wiphy.max_ap_assoc_sta &&
2125                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
2126                                 rdev->wiphy.max_ap_assoc_sta))
2127                         goto nla_put_failure;
2128
2129                 state->split_start++;
2130                 break;
2131         case 11:
2132                 if (rdev->wiphy.n_vendor_commands) {
2133                         const struct nl80211_vendor_cmd_info *info;
2134                         struct nlattr *nested;
2135
2136                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
2137                         if (!nested)
2138                                 goto nla_put_failure;
2139
2140                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
2141                                 info = &rdev->wiphy.vendor_commands[i].info;
2142                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2143                                         goto nla_put_failure;
2144                         }
2145                         nla_nest_end(msg, nested);
2146                 }
2147
2148                 if (rdev->wiphy.n_vendor_events) {
2149                         const struct nl80211_vendor_cmd_info *info;
2150                         struct nlattr *nested;
2151
2152                         nested = nla_nest_start(msg,
2153                                                 NL80211_ATTR_VENDOR_EVENTS);
2154                         if (!nested)
2155                                 goto nla_put_failure;
2156
2157                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
2158                                 info = &rdev->wiphy.vendor_events[i];
2159                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2160                                         goto nla_put_failure;
2161                         }
2162                         nla_nest_end(msg, nested);
2163                 }
2164                 state->split_start++;
2165                 break;
2166         case 12:
2167                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
2168                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
2169                                rdev->wiphy.max_num_csa_counters))
2170                         goto nla_put_failure;
2171
2172                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2173                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
2174                         goto nla_put_failure;
2175
2176                 if (rdev->wiphy.max_sched_scan_reqs &&
2177                     nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
2178                                 rdev->wiphy.max_sched_scan_reqs))
2179                         goto nla_put_failure;
2180
2181                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2182                             sizeof(rdev->wiphy.ext_features),
2183                             rdev->wiphy.ext_features))
2184                         goto nla_put_failure;
2185
2186                 if (rdev->wiphy.bss_select_support) {
2187                         struct nlattr *nested;
2188                         u32 bss_select_support = rdev->wiphy.bss_select_support;
2189
2190                         nested = nla_nest_start(msg, NL80211_ATTR_BSS_SELECT);
2191                         if (!nested)
2192                                 goto nla_put_failure;
2193
2194                         i = 0;
2195                         while (bss_select_support) {
2196                                 if ((bss_select_support & 1) &&
2197                                     nla_put_flag(msg, i))
2198                                         goto nla_put_failure;
2199                                 i++;
2200                                 bss_select_support >>= 1;
2201                         }
2202                         nla_nest_end(msg, nested);
2203                 }
2204
2205                 state->split_start++;
2206                 break;
2207         case 13:
2208                 if (rdev->wiphy.num_iftype_ext_capab &&
2209                     rdev->wiphy.iftype_ext_capab) {
2210                         struct nlattr *nested_ext_capab, *nested;
2211
2212                         nested = nla_nest_start(msg,
2213                                                 NL80211_ATTR_IFTYPE_EXT_CAPA);
2214                         if (!nested)
2215                                 goto nla_put_failure;
2216
2217                         for (i = state->capa_start;
2218                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
2219                                 const struct wiphy_iftype_ext_capab *capab;
2220
2221                                 capab = &rdev->wiphy.iftype_ext_capab[i];
2222
2223                                 nested_ext_capab = nla_nest_start(msg, i);
2224                                 if (!nested_ext_capab ||
2225                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
2226                                                 capab->iftype) ||
2227                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
2228                                             capab->extended_capabilities_len,
2229                                             capab->extended_capabilities) ||
2230                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2231                                             capab->extended_capabilities_len,
2232                                             capab->extended_capabilities_mask))
2233                                         goto nla_put_failure;
2234
2235                                 nla_nest_end(msg, nested_ext_capab);
2236                                 if (state->split)
2237                                         break;
2238                         }
2239                         nla_nest_end(msg, nested);
2240                         if (i < rdev->wiphy.num_iftype_ext_capab) {
2241                                 state->capa_start = i + 1;
2242                                 break;
2243                         }
2244                 }
2245
2246                 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
2247                                 rdev->wiphy.nan_supported_bands))
2248                         goto nla_put_failure;
2249
2250                 if (wiphy_ext_feature_isset(&rdev->wiphy,
2251                                             NL80211_EXT_FEATURE_TXQS)) {
2252                         struct cfg80211_txq_stats txqstats = {};
2253                         int res;
2254
2255                         res = rdev_get_txq_stats(rdev, NULL, &txqstats);
2256                         if (!res &&
2257                             !nl80211_put_txq_stats(msg, &txqstats,
2258                                                    NL80211_ATTR_TXQ_STATS))
2259                                 goto nla_put_failure;
2260
2261                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
2262                                         rdev->wiphy.txq_limit))
2263                                 goto nla_put_failure;
2264                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
2265                                         rdev->wiphy.txq_memory_limit))
2266                                 goto nla_put_failure;
2267                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
2268                                         rdev->wiphy.txq_quantum))
2269                                 goto nla_put_failure;
2270                 }
2271
2272                 state->split_start++;
2273                 break;
2274         case 14:
2275                 if (nl80211_send_pmsr_capa(rdev, msg))
2276                         goto nla_put_failure;
2277
2278                 state->split_start++;
2279                 break;
2280         case 15:
2281                 if (rdev->wiphy.akm_suites &&
2282                     nla_put(msg, NL80211_ATTR_AKM_SUITES,
2283                             sizeof(u32) * rdev->wiphy.n_akm_suites,
2284                             rdev->wiphy.akm_suites))
2285                         goto nla_put_failure;
2286
2287                 /* done */
2288                 state->split_start = 0;
2289                 break;
2290         }
2291  finish:
2292         genlmsg_end(msg, hdr);
2293         return 0;
2294
2295  nla_put_failure:
2296         genlmsg_cancel(msg, hdr);
2297         return -EMSGSIZE;
2298 }
2299
2300 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
2301                                     struct netlink_callback *cb,
2302                                     struct nl80211_dump_wiphy_state *state)
2303 {
2304         struct nlattr **tb = genl_family_attrbuf(&nl80211_fam);
2305         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, tb,
2306                               nl80211_fam.maxattr, nl80211_policy, NULL);
2307         /* ignore parse errors for backward compatibility */
2308         if (ret)
2309                 return 0;
2310
2311         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
2312         if (tb[NL80211_ATTR_WIPHY])
2313                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
2314         if (tb[NL80211_ATTR_WDEV])
2315                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
2316         if (tb[NL80211_ATTR_IFINDEX]) {
2317                 struct net_device *netdev;
2318                 struct cfg80211_registered_device *rdev;
2319                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2320
2321                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2322                 if (!netdev)
2323                         return -ENODEV;
2324                 if (netdev->ieee80211_ptr) {
2325                         rdev = wiphy_to_rdev(
2326                                 netdev->ieee80211_ptr->wiphy);
2327                         state->filter_wiphy = rdev->wiphy_idx;
2328                 }
2329         }
2330
2331         return 0;
2332 }
2333
2334 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
2335 {
2336         int idx = 0, ret;
2337         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
2338         struct cfg80211_registered_device *rdev;
2339
2340         rtnl_lock();
2341         if (!state) {
2342                 state = kzalloc(sizeof(*state), GFP_KERNEL);
2343                 if (!state) {
2344                         rtnl_unlock();
2345                         return -ENOMEM;
2346                 }
2347                 state->filter_wiphy = -1;
2348                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
2349                 if (ret) {
2350                         kfree(state);
2351                         rtnl_unlock();
2352                         return ret;
2353                 }
2354                 cb->args[0] = (long)state;
2355         }
2356
2357         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2358                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2359                         continue;
2360                 if (++idx <= state->start)
2361                         continue;
2362                 if (state->filter_wiphy != -1 &&
2363                     state->filter_wiphy != rdev->wiphy_idx)
2364                         continue;
2365                 /* attempt to fit multiple wiphy data chunks into the skb */
2366                 do {
2367                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
2368                                                  skb,
2369                                                  NETLINK_CB(cb->skb).portid,
2370                                                  cb->nlh->nlmsg_seq,
2371                                                  NLM_F_MULTI, state);
2372                         if (ret < 0) {
2373                                 /*
2374                                  * If sending the wiphy data didn't fit (ENOBUFS
2375                                  * or EMSGSIZE returned), this SKB is still
2376                                  * empty (so it's not too big because another
2377                                  * wiphy dataset is already in the skb) and
2378                                  * we've not tried to adjust the dump allocation
2379                                  * yet ... then adjust the alloc size to be
2380                                  * bigger, and return 1 but with the empty skb.
2381                                  * This results in an empty message being RX'ed
2382                                  * in userspace, but that is ignored.
2383                                  *
2384                                  * We can then retry with the larger buffer.
2385                                  */
2386                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
2387                                     !skb->len && !state->split &&
2388                                     cb->min_dump_alloc < 4096) {
2389                                         cb->min_dump_alloc = 4096;
2390                                         state->split_start = 0;
2391                                         rtnl_unlock();
2392                                         return 1;
2393                                 }
2394                                 idx--;
2395                                 break;
2396                         }
2397                 } while (state->split_start > 0);
2398                 break;
2399         }
2400         rtnl_unlock();
2401
2402         state->start = idx;
2403
2404         return skb->len;
2405 }
2406
2407 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
2408 {
2409         kfree((void *)cb->args[0]);
2410         return 0;
2411 }
2412
2413 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
2414 {
2415         struct sk_buff *msg;
2416         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2417         struct nl80211_dump_wiphy_state state = {};
2418
2419         msg = nlmsg_new(4096, GFP_KERNEL);
2420         if (!msg)
2421                 return -ENOMEM;
2422
2423         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
2424                                info->snd_portid, info->snd_seq, 0,
2425                                &state) < 0) {
2426                 nlmsg_free(msg);
2427                 return -ENOBUFS;
2428         }
2429
2430         return genlmsg_reply(msg, info);
2431 }
2432
2433 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2434         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
2435         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
2436         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
2437         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
2438         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
2439 };
2440
2441 static int parse_txq_params(struct nlattr *tb[],
2442                             struct ieee80211_txq_params *txq_params)
2443 {
2444         u8 ac;
2445
2446         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2447             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2448             !tb[NL80211_TXQ_ATTR_AIFS])
2449                 return -EINVAL;
2450
2451         ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2452         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2453         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2454         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2455         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2456
2457         if (ac >= NL80211_NUM_ACS)
2458                 return -EINVAL;
2459         txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
2460         return 0;
2461 }
2462
2463 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2464 {
2465         /*
2466          * You can only set the channel explicitly for WDS interfaces,
2467          * all others have their channel managed via their respective
2468          * "establish a connection" command (connect, join, ...)
2469          *
2470          * For AP/GO and mesh mode, the channel can be set with the
2471          * channel userspace API, but is only stored and passed to the
2472          * low-level driver when the AP starts or the mesh is joined.
2473          * This is for backward compatibility, userspace can also give
2474          * the channel in the start-ap or join-mesh commands instead.
2475          *
2476          * Monitors are special as they are normally slaved to
2477          * whatever else is going on, so they have their own special
2478          * operation to set the monitor channel if possible.
2479          */
2480         return !wdev ||
2481                 wdev->iftype == NL80211_IFTYPE_AP ||
2482                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2483                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
2484                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
2485 }
2486
2487 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2488                           struct genl_info *info,
2489                           struct cfg80211_chan_def *chandef)
2490 {
2491         struct netlink_ext_ack *extack = info->extack;
2492         struct nlattr **attrs = info->attrs;
2493         u32 control_freq;
2494
2495         if (!attrs[NL80211_ATTR_WIPHY_FREQ])
2496                 return -EINVAL;
2497
2498         control_freq = nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ]);
2499
2500         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
2501         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2502         chandef->center_freq1 = control_freq;
2503         chandef->center_freq2 = 0;
2504
2505         /* Primary channel not allowed */
2506         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) {
2507                 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
2508                                     "Channel is disabled");
2509                 return -EINVAL;
2510         }
2511
2512         if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2513                 enum nl80211_channel_type chantype;
2514
2515                 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2516
2517                 switch (chantype) {
2518                 case NL80211_CHAN_NO_HT:
2519                 case NL80211_CHAN_HT20:
2520                 case NL80211_CHAN_HT40PLUS:
2521                 case NL80211_CHAN_HT40MINUS:
2522                         cfg80211_chandef_create(chandef, chandef->chan,
2523                                                 chantype);
2524                         /* user input for center_freq is incorrect */
2525                         if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
2526                             chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
2527                                 NL_SET_ERR_MSG_ATTR(extack,
2528                                                     attrs[NL80211_ATTR_CENTER_FREQ1],
2529                                                     "bad center frequency 1");
2530                                 return -EINVAL;
2531                         }
2532                         /* center_freq2 must be zero */
2533                         if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
2534                             nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
2535                                 NL_SET_ERR_MSG_ATTR(extack,
2536                                                     attrs[NL80211_ATTR_CENTER_FREQ2],
2537                                                     "center frequency 2 can't be used");
2538                                 return -EINVAL;
2539                         }
2540                         break;
2541                 default:
2542                         NL_SET_ERR_MSG_ATTR(extack,
2543                                             attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
2544                                             "invalid channel type");
2545                         return -EINVAL;
2546                 }
2547         } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2548                 chandef->width =
2549                         nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2550                 if (attrs[NL80211_ATTR_CENTER_FREQ1])
2551                         chandef->center_freq1 =
2552                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
2553                 if (attrs[NL80211_ATTR_CENTER_FREQ2])
2554                         chandef->center_freq2 =
2555                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
2556         }
2557
2558         if (!cfg80211_chandef_valid(chandef)) {
2559                 NL_SET_ERR_MSG(extack, "invalid channel definition");
2560                 return -EINVAL;
2561         }
2562
2563         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2564                                      IEEE80211_CHAN_DISABLED)) {
2565                 NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
2566                 return -EINVAL;
2567         }
2568
2569         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2570              chandef->width == NL80211_CHAN_WIDTH_10) &&
2571             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
2572                 NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
2573                 return -EINVAL;
2574         }
2575
2576         return 0;
2577 }
2578
2579 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
2580                                  struct net_device *dev,
2581                                  struct genl_info *info)
2582 {
2583         struct cfg80211_chan_def chandef;
2584         int result;
2585         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2586         struct wireless_dev *wdev = NULL;
2587
2588         if (dev)
2589                 wdev = dev->ieee80211_ptr;
2590         if (!nl80211_can_set_dev_channel(wdev))
2591                 return -EOPNOTSUPP;
2592         if (wdev)
2593                 iftype = wdev->iftype;
2594
2595         result = nl80211_parse_chandef(rdev, info, &chandef);
2596         if (result)
2597                 return result;
2598
2599         switch (iftype) {
2600         case NL80211_IFTYPE_AP:
2601         case NL80211_IFTYPE_P2P_GO:
2602                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2603                                                    iftype)) {
2604                         result = -EINVAL;
2605                         break;
2606                 }
2607                 if (wdev->beacon_interval) {
2608                         if (!dev || !rdev->ops->set_ap_chanwidth ||
2609                             !(rdev->wiphy.features &
2610                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2611                                 result = -EBUSY;
2612                                 break;
2613                         }
2614
2615                         /* Only allow dynamic channel width changes */
2616                         if (chandef.chan != wdev->preset_chandef.chan) {
2617                                 result = -EBUSY;
2618                                 break;
2619                         }
2620                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2621                         if (result)
2622                                 break;
2623                 }
2624                 wdev->preset_chandef = chandef;
2625                 result = 0;
2626                 break;
2627         case NL80211_IFTYPE_MESH_POINT:
2628                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2629                 break;
2630         case NL80211_IFTYPE_MONITOR:
2631                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2632                 break;
2633         default:
2634                 result = -EINVAL;
2635         }
2636
2637         return result;
2638 }
2639
2640 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2641 {
2642         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2643         struct net_device *netdev = info->user_ptr[1];
2644
2645         return __nl80211_set_channel(rdev, netdev, info);
2646 }
2647
2648 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2649 {
2650         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2651         struct net_device *dev = info->user_ptr[1];
2652         struct wireless_dev *wdev = dev->ieee80211_ptr;
2653         const u8 *bssid;
2654
2655         if (!info->attrs[NL80211_ATTR_MAC])
2656                 return -EINVAL;
2657
2658         if (netif_running(dev))
2659                 return -EBUSY;
2660
2661         if (!rdev->ops->set_wds_peer)
2662                 return -EOPNOTSUPP;
2663
2664         if (wdev->iftype != NL80211_IFTYPE_WDS)
2665                 return -EOPNOTSUPP;
2666
2667         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2668         return rdev_set_wds_peer(rdev, dev, bssid);
2669 }
2670
2671 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2672 {
2673         struct cfg80211_registered_device *rdev;
2674         struct net_device *netdev = NULL;
2675         struct wireless_dev *wdev;
2676         int result = 0, rem_txq_params = 0;
2677         struct nlattr *nl_txq_params;
2678         u32 changed;
2679         u8 retry_short = 0, retry_long = 0;
2680         u32 frag_threshold = 0, rts_threshold = 0;
2681         u8 coverage_class = 0;
2682         u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
2683
2684         ASSERT_RTNL();
2685
2686         /*
2687          * Try to find the wiphy and netdev. Normally this
2688          * function shouldn't need the netdev, but this is
2689          * done for backward compatibility -- previously
2690          * setting the channel was done per wiphy, but now
2691          * it is per netdev. Previous userland like hostapd
2692          * also passed a netdev to set_wiphy, so that it is
2693          * possible to let that go to the right netdev!
2694          */
2695
2696         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2697                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2698
2699                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2700                 if (netdev && netdev->ieee80211_ptr)
2701                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2702                 else
2703                         netdev = NULL;
2704         }
2705
2706         if (!netdev) {
2707                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2708                                                   info->attrs);
2709                 if (IS_ERR(rdev))
2710                         return PTR_ERR(rdev);
2711                 wdev = NULL;
2712                 netdev = NULL;
2713                 result = 0;
2714         } else
2715                 wdev = netdev->ieee80211_ptr;
2716
2717         /*
2718          * end workaround code, by now the rdev is available
2719          * and locked, and wdev may or may not be NULL.
2720          */
2721
2722         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2723                 result = cfg80211_dev_rename(
2724                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2725
2726         if (result)
2727                 return result;
2728
2729         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2730                 struct ieee80211_txq_params txq_params;
2731                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2732
2733                 if (!rdev->ops->set_txq_params)
2734                         return -EOPNOTSUPP;
2735
2736                 if (!netdev)
2737                         return -EINVAL;
2738
2739                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2740                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2741                         return -EINVAL;
2742
2743                 if (!netif_running(netdev))
2744                         return -ENETDOWN;
2745
2746                 nla_for_each_nested(nl_txq_params,
2747                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2748                                     rem_txq_params) {
2749                         result = nla_parse_nested(tb, NL80211_TXQ_ATTR_MAX,
2750                                                   nl_txq_params,
2751                                                   txq_params_policy,
2752                                                   info->extack);
2753                         if (result)
2754                                 return result;
2755                         result = parse_txq_params(tb, &txq_params);
2756                         if (result)
2757                                 return result;
2758
2759                         result = rdev_set_txq_params(rdev, netdev,
2760                                                      &txq_params);
2761                         if (result)
2762                                 return result;
2763                 }
2764         }
2765
2766         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2767                 result = __nl80211_set_channel(
2768                         rdev,
2769                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2770                         info);
2771                 if (result)
2772                         return result;
2773         }
2774
2775         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2776                 struct wireless_dev *txp_wdev = wdev;
2777                 enum nl80211_tx_power_setting type;
2778                 int idx, mbm = 0;
2779
2780                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2781                         txp_wdev = NULL;
2782
2783                 if (!rdev->ops->set_tx_power)
2784                         return -EOPNOTSUPP;
2785
2786                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2787                 type = nla_get_u32(info->attrs[idx]);
2788
2789                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2790                     (type != NL80211_TX_POWER_AUTOMATIC))
2791                         return -EINVAL;
2792
2793                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2794                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2795                         mbm = nla_get_u32(info->attrs[idx]);
2796                 }
2797
2798                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2799                 if (result)
2800                         return result;
2801         }
2802
2803         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2804             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2805                 u32 tx_ant, rx_ant;
2806
2807                 if ((!rdev->wiphy.available_antennas_tx &&
2808                      !rdev->wiphy.available_antennas_rx) ||
2809                     !rdev->ops->set_antenna)
2810                         return -EOPNOTSUPP;
2811
2812                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2813                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2814
2815                 /* reject antenna configurations which don't match the
2816                  * available antenna masks, except for the "all" mask */
2817                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2818                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2819                         return -EINVAL;
2820
2821                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2822                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2823
2824                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2825                 if (result)
2826                         return result;
2827         }
2828
2829         changed = 0;
2830
2831         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2832                 retry_short = nla_get_u8(
2833                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2834
2835                 changed |= WIPHY_PARAM_RETRY_SHORT;
2836         }
2837
2838         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2839                 retry_long = nla_get_u8(
2840                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2841
2842                 changed |= WIPHY_PARAM_RETRY_LONG;
2843         }
2844
2845         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2846                 frag_threshold = nla_get_u32(
2847                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2848                 if (frag_threshold < 256)
2849                         return -EINVAL;
2850
2851                 if (frag_threshold != (u32) -1) {
2852                         /*
2853                          * Fragments (apart from the last one) are required to
2854                          * have even length. Make the fragmentation code
2855                          * simpler by stripping LSB should someone try to use
2856                          * odd threshold value.
2857                          */
2858                         frag_threshold &= ~0x1;
2859                 }
2860                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2861         }
2862
2863         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2864                 rts_threshold = nla_get_u32(
2865                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2866                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2867         }
2868
2869         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2870                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2871                         return -EINVAL;
2872
2873                 coverage_class = nla_get_u8(
2874                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2875                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2876         }
2877
2878         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2879                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2880                         return -EOPNOTSUPP;
2881
2882                 changed |= WIPHY_PARAM_DYN_ACK;
2883         }
2884
2885         if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
2886                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2887                                              NL80211_EXT_FEATURE_TXQS))
2888                         return -EOPNOTSUPP;
2889                 txq_limit = nla_get_u32(
2890                         info->attrs[NL80211_ATTR_TXQ_LIMIT]);
2891                 changed |= WIPHY_PARAM_TXQ_LIMIT;
2892         }
2893
2894         if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
2895                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2896                                              NL80211_EXT_FEATURE_TXQS))
2897                         return -EOPNOTSUPP;
2898                 txq_memory_limit = nla_get_u32(
2899                         info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
2900                 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
2901         }
2902
2903         if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
2904                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2905                                              NL80211_EXT_FEATURE_TXQS))
2906                         return -EOPNOTSUPP;
2907                 txq_quantum = nla_get_u32(
2908                         info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
2909                 changed |= WIPHY_PARAM_TXQ_QUANTUM;
2910         }
2911
2912         if (changed) {
2913                 u8 old_retry_short, old_retry_long;
2914                 u32 old_frag_threshold, old_rts_threshold;
2915                 u8 old_coverage_class;
2916                 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
2917
2918                 if (!rdev->ops->set_wiphy_params)
2919                         return -EOPNOTSUPP;
2920
2921                 old_retry_short = rdev->wiphy.retry_short;
2922                 old_retry_long = rdev->wiphy.retry_long;
2923                 old_frag_threshold = rdev->wiphy.frag_threshold;
2924                 old_rts_threshold = rdev->wiphy.rts_threshold;
2925                 old_coverage_class = rdev->wiphy.coverage_class;
2926                 old_txq_limit = rdev->wiphy.txq_limit;
2927                 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
2928                 old_txq_quantum = rdev->wiphy.txq_quantum;
2929
2930                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2931                         rdev->wiphy.retry_short = retry_short;
2932                 if (changed & WIPHY_PARAM_RETRY_LONG)
2933                         rdev->wiphy.retry_long = retry_long;
2934                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2935                         rdev->wiphy.frag_threshold = frag_threshold;
2936                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2937                         rdev->wiphy.rts_threshold = rts_threshold;
2938                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2939                         rdev->wiphy.coverage_class = coverage_class;
2940                 if (changed & WIPHY_PARAM_TXQ_LIMIT)
2941                         rdev->wiphy.txq_limit = txq_limit;
2942                 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
2943                         rdev->wiphy.txq_memory_limit = txq_memory_limit;
2944                 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
2945                         rdev->wiphy.txq_quantum = txq_quantum;
2946
2947                 result = rdev_set_wiphy_params(rdev, changed);
2948                 if (result) {
2949                         rdev->wiphy.retry_short = old_retry_short;
2950                         rdev->wiphy.retry_long = old_retry_long;
2951                         rdev->wiphy.frag_threshold = old_frag_threshold;
2952                         rdev->wiphy.rts_threshold = old_rts_threshold;
2953                         rdev->wiphy.coverage_class = old_coverage_class;
2954                         rdev->wiphy.txq_limit = old_txq_limit;
2955                         rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
2956                         rdev->wiphy.txq_quantum = old_txq_quantum;
2957                         return result;
2958                 }
2959         }
2960         return 0;
2961 }
2962
2963 static int nl80211_send_chandef(struct sk_buff *msg,
2964                                 const struct cfg80211_chan_def *chandef)
2965 {
2966         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2967                 return -EINVAL;
2968
2969         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2970                         chandef->chan->center_freq))
2971                 return -ENOBUFS;
2972         switch (chandef->width) {
2973         case NL80211_CHAN_WIDTH_20_NOHT:
2974         case NL80211_CHAN_WIDTH_20:
2975         case NL80211_CHAN_WIDTH_40:
2976                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2977                                 cfg80211_get_chandef_type(chandef)))
2978                         return -ENOBUFS;
2979                 break;
2980         default:
2981                 break;
2982         }
2983         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2984                 return -ENOBUFS;
2985         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2986                 return -ENOBUFS;
2987         if (chandef->center_freq2 &&
2988             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2989                 return -ENOBUFS;
2990         return 0;
2991 }
2992
2993 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2994                               struct cfg80211_registered_device *rdev,
2995                               struct wireless_dev *wdev,
2996                               enum nl80211_commands cmd)
2997 {
2998         struct net_device *dev = wdev->netdev;
2999         void *hdr;
3000
3001         WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
3002                 cmd != NL80211_CMD_DEL_INTERFACE &&
3003                 cmd != NL80211_CMD_SET_INTERFACE);
3004
3005         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3006         if (!hdr)
3007                 return -1;
3008
3009         if (dev &&
3010             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3011              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
3012                 goto nla_put_failure;
3013
3014         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
3015             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
3016             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
3017                               NL80211_ATTR_PAD) ||
3018             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
3019             nla_put_u32(msg, NL80211_ATTR_GENERATION,
3020                         rdev->devlist_generation ^
3021                         (cfg80211_rdev_list_generation << 2)) ||
3022             nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr))
3023                 goto nla_put_failure;
3024
3025         if (rdev->ops->get_channel) {
3026                 int ret;
3027                 struct cfg80211_chan_def chandef;
3028
3029                 ret = rdev_get_channel(rdev, wdev, &chandef);
3030                 if (ret == 0) {
3031                         if (nl80211_send_chandef(msg, &chandef))
3032                                 goto nla_put_failure;
3033                 }
3034         }
3035
3036         if (rdev->ops->get_tx_power) {
3037                 int dbm, ret;
3038
3039                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
3040                 if (ret == 0 &&
3041                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
3042                                 DBM_TO_MBM(dbm)))
3043                         goto nla_put_failure;
3044         }
3045
3046         wdev_lock(wdev);
3047         switch (wdev->iftype) {
3048         case NL80211_IFTYPE_AP:
3049                 if (wdev->ssid_len &&
3050                     nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
3051                         goto nla_put_failure_locked;
3052                 break;
3053         case NL80211_IFTYPE_STATION:
3054         case NL80211_IFTYPE_P2P_CLIENT:
3055         case NL80211_IFTYPE_ADHOC: {
3056                 const u8 *ssid_ie;
3057                 if (!wdev->current_bss)
3058                         break;
3059                 rcu_read_lock();
3060                 ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
3061                                                WLAN_EID_SSID);
3062                 if (ssid_ie &&
3063                     nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2))
3064                         goto nla_put_failure_rcu_locked;
3065                 rcu_read_unlock();
3066                 break;
3067                 }
3068         default:
3069                 /* nothing */
3070                 break;
3071         }
3072         wdev_unlock(wdev);
3073
3074         if (rdev->ops->get_txq_stats) {
3075                 struct cfg80211_txq_stats txqstats = {};
3076                 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
3077
3078                 if (ret == 0 &&
3079                     !nl80211_put_txq_stats(msg, &txqstats,
3080                                            NL80211_ATTR_TXQ_STATS))
3081                         goto nla_put_failure;
3082         }
3083
3084         genlmsg_end(msg, hdr);
3085         return 0;
3086
3087  nla_put_failure_rcu_locked:
3088         rcu_read_unlock();
3089  nla_put_failure_locked:
3090         wdev_unlock(wdev);
3091  nla_put_failure:
3092         genlmsg_cancel(msg, hdr);
3093         return -EMSGSIZE;
3094 }
3095
3096 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
3097 {
3098         int wp_idx = 0;
3099         int if_idx = 0;
3100         int wp_start = cb->args[0];
3101         int if_start = cb->args[1];
3102         int filter_wiphy = -1;
3103         struct cfg80211_registered_device *rdev;
3104         struct wireless_dev *wdev;
3105         int ret;
3106
3107         rtnl_lock();
3108         if (!cb->args[2]) {
3109                 struct nl80211_dump_wiphy_state state = {
3110                         .filter_wiphy = -1,
3111                 };
3112
3113                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
3114                 if (ret)
3115                         goto out_unlock;
3116
3117                 filter_wiphy = state.filter_wiphy;
3118
3119                 /*
3120                  * if filtering, set cb->args[2] to +1 since 0 is the default
3121                  * value needed to determine that parsing is necessary.
3122                  */
3123                 if (filter_wiphy >= 0)
3124                         cb->args[2] = filter_wiphy + 1;
3125                 else
3126                         cb->args[2] = -1;
3127         } else if (cb->args[2] > 0) {
3128                 filter_wiphy = cb->args[2] - 1;
3129         }
3130
3131         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3132                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3133                         continue;
3134                 if (wp_idx < wp_start) {
3135                         wp_idx++;
3136                         continue;
3137                 }
3138
3139                 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
3140                         continue;
3141
3142                 if_idx = 0;
3143
3144                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3145                         if (if_idx < if_start) {
3146                                 if_idx++;
3147                                 continue;
3148                         }
3149                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
3150                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
3151                                                rdev, wdev,
3152                                                NL80211_CMD_NEW_INTERFACE) < 0) {
3153                                 goto out;
3154                         }
3155                         if_idx++;
3156                 }
3157
3158                 wp_idx++;
3159         }
3160  out:
3161         cb->args[0] = wp_idx;
3162         cb->args[1] = if_idx;
3163
3164         ret = skb->len;
3165  out_unlock:
3166         rtnl_unlock();
3167
3168         return ret;
3169 }
3170
3171 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
3172 {
3173         struct sk_buff *msg;
3174         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3175         struct wireless_dev *wdev = info->user_ptr[1];
3176
3177         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3178         if (!msg)
3179                 return -ENOMEM;
3180
3181         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3182                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
3183                 nlmsg_free(msg);
3184                 return -ENOBUFS;
3185         }
3186
3187         return genlmsg_reply(msg, info);
3188 }
3189
3190 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
3191         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
3192         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
3193         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
3194         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
3195         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
3196         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
3197 };
3198
3199 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
3200 {
3201         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
3202         int flag;
3203
3204         *mntrflags = 0;
3205
3206         if (!nla)
3207                 return -EINVAL;
3208
3209         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX, nla,
3210                              mntr_flags_policy, NULL))
3211                 return -EINVAL;
3212
3213         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
3214                 if (flags[flag])
3215                         *mntrflags |= (1<<flag);
3216
3217         *mntrflags |= MONITOR_FLAG_CHANGED;
3218
3219         return 0;
3220 }
3221
3222 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
3223                                      enum nl80211_iftype type,
3224                                      struct genl_info *info,
3225                                      struct vif_params *params)
3226 {
3227         bool change = false;
3228         int err;
3229
3230         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
3231                 if (type != NL80211_IFTYPE_MONITOR)
3232                         return -EINVAL;
3233
3234                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
3235                                           &params->flags);
3236                 if (err)
3237                         return err;
3238
3239                 change = true;
3240         }
3241
3242         if (params->flags & MONITOR_FLAG_ACTIVE &&
3243             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
3244                 return -EOPNOTSUPP;
3245
3246         if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
3247                 const u8 *mumimo_groups;
3248                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3249
3250                 if (type != NL80211_IFTYPE_MONITOR)
3251                         return -EINVAL;
3252
3253                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3254                         return -EOPNOTSUPP;
3255
3256                 mumimo_groups =
3257                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
3258
3259                 /* bits 0 and 63 are reserved and must be zero */
3260                 if ((mumimo_groups[0] & BIT(0)) ||
3261                     (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
3262                         return -EINVAL;
3263
3264                 params->vht_mumimo_groups = mumimo_groups;
3265                 change = true;
3266         }
3267
3268         if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
3269                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3270
3271                 if (type != NL80211_IFTYPE_MONITOR)
3272                         return -EINVAL;
3273
3274                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3275                         return -EOPNOTSUPP;
3276
3277                 params->vht_mumimo_follow_addr =
3278                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
3279                 change = true;
3280         }
3281
3282         return change ? 1 : 0;
3283 }
3284
3285 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
3286                                struct net_device *netdev, u8 use_4addr,
3287                                enum nl80211_iftype iftype)
3288 {
3289         if (!use_4addr) {
3290                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
3291                         return -EBUSY;
3292                 return 0;
3293         }
3294
3295         switch (iftype) {
3296         case NL80211_IFTYPE_AP_VLAN:
3297                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
3298                         return 0;
3299                 break;
3300         case NL80211_IFTYPE_STATION:
3301                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
3302                         return 0;
3303                 break;
3304         default:
3305                 break;
3306         }
3307
3308         return -EOPNOTSUPP;
3309 }
3310
3311 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
3312 {
3313         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3314         struct vif_params params;
3315         int err;
3316         enum nl80211_iftype otype, ntype;
3317         struct net_device *dev = info->user_ptr[1];
3318         bool change = false;
3319
3320         memset(&params, 0, sizeof(params));
3321
3322         otype = ntype = dev->ieee80211_ptr->iftype;
3323
3324         if (info->attrs[NL80211_ATTR_IFTYPE]) {
3325                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3326                 if (otype != ntype)
3327                         change = true;
3328         }
3329
3330         if (info->attrs[NL80211_ATTR_MESH_ID]) {
3331                 struct wireless_dev *wdev = dev->ieee80211_ptr;
3332
3333                 if (ntype != NL80211_IFTYPE_MESH_POINT)
3334                         return -EINVAL;
3335                 if (netif_running(dev))
3336                         return -EBUSY;
3337
3338                 wdev_lock(wdev);
3339                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3340                              IEEE80211_MAX_MESH_ID_LEN);
3341                 wdev->mesh_id_up_len =
3342                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3343                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3344                        wdev->mesh_id_up_len);
3345                 wdev_unlock(wdev);
3346         }
3347
3348         if (info->attrs[NL80211_ATTR_4ADDR]) {
3349                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3350                 change = true;
3351                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
3352                 if (err)
3353                         return err;
3354         } else {
3355                 params.use_4addr = -1;
3356         }
3357
3358         err = nl80211_parse_mon_options(rdev, ntype, info, &params);
3359         if (err < 0)
3360                 return err;
3361         if (err > 0)
3362                 change = true;
3363
3364         if (change)
3365                 err = cfg80211_change_iface(rdev, dev, ntype, &params);
3366         else
3367                 err = 0;
3368
3369         if (!err && params.use_4addr != -1)
3370                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
3371
3372         if (change && !err) {
3373                 struct wireless_dev *wdev = dev->ieee80211_ptr;
3374
3375                 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
3376         }
3377
3378         return err;
3379 }
3380
3381 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
3382 {
3383         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3384         struct vif_params params;
3385         struct wireless_dev *wdev;
3386         struct sk_buff *msg;
3387         int err;
3388         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
3389
3390         /* to avoid failing a new interface creation due to pending removal */
3391         cfg80211_destroy_ifaces(rdev);
3392
3393         memset(&params, 0, sizeof(params));
3394
3395         if (!info->attrs[NL80211_ATTR_IFNAME])
3396                 return -EINVAL;
3397
3398         if (info->attrs[NL80211_ATTR_IFTYPE])
3399                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3400
3401         if (!rdev->ops->add_virtual_intf ||
3402             !(rdev->wiphy.interface_modes & (1 << type)))
3403                 return -EOPNOTSUPP;
3404
3405         if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
3406              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
3407             info->attrs[NL80211_ATTR_MAC]) {
3408                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
3409                            ETH_ALEN);
3410                 if (!is_valid_ether_addr(params.macaddr))
3411                         return -EADDRNOTAVAIL;
3412         }
3413
3414         if (info->attrs[NL80211_ATTR_4ADDR]) {
3415                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3416                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
3417                 if (err)
3418                         return err;
3419         }
3420
3421         err = nl80211_parse_mon_options(rdev, type, info, &params);
3422         if (err < 0)
3423                 return err;
3424
3425         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3426         if (!msg)
3427                 return -ENOMEM;
3428
3429         wdev = rdev_add_virtual_intf(rdev,
3430                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
3431                                 NET_NAME_USER, type, &params);
3432         if (WARN_ON(!wdev)) {
3433                 nlmsg_free(msg);
3434                 return -EPROTO;
3435         } else if (IS_ERR(wdev)) {
3436                 nlmsg_free(msg);
3437                 return PTR_ERR(wdev);
3438         }
3439
3440         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
3441                 wdev->owner_nlportid = info->snd_portid;
3442
3443         switch (type) {
3444         case NL80211_IFTYPE_MESH_POINT:
3445                 if (!info->attrs[NL80211_ATTR_MESH_ID])
3446                         break;
3447                 wdev_lock(wdev);
3448                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3449                              IEEE80211_MAX_MESH_ID_LEN);
3450                 wdev->mesh_id_up_len =
3451                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3452                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3453                        wdev->mesh_id_up_len);
3454                 wdev_unlock(wdev);
3455                 break;
3456         case NL80211_IFTYPE_NAN:
3457         case NL80211_IFTYPE_P2P_DEVICE:
3458                 /*
3459                  * P2P Device and NAN do not have a netdev, so don't go
3460                  * through the netdev notifier and must be added here
3461                  */
3462                 cfg80211_init_wdev(rdev, wdev);
3463                 break;
3464         default:
3465                 break;
3466         }
3467
3468         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3469                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
3470                 nlmsg_free(msg);
3471                 return -ENOBUFS;
3472         }
3473
3474         return genlmsg_reply(msg, info);
3475 }
3476
3477 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
3478 {
3479         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3480         struct wireless_dev *wdev = info->user_ptr[1];
3481
3482         if (!rdev->ops->del_virtual_intf)
3483                 return -EOPNOTSUPP;
3484
3485         /*
3486          * If we remove a wireless device without a netdev then clear
3487          * user_ptr[1] so that nl80211_post_doit won't dereference it
3488          * to check if it needs to do dev_put(). Otherwise it crashes
3489          * since the wdev has been freed, unlike with a netdev where
3490          * we need the dev_put() for the netdev to really be freed.
3491          */
3492         if (!wdev->netdev)
3493                 info->user_ptr[1] = NULL;
3494
3495         return rdev_del_virtual_intf(rdev, wdev);
3496 }
3497
3498 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
3499 {
3500         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3501         struct net_device *dev = info->user_ptr[1];
3502         u16 noack_map;
3503
3504         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
3505                 return -EINVAL;
3506
3507         if (!rdev->ops->set_noack_map)
3508                 return -EOPNOTSUPP;
3509
3510         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
3511
3512         return rdev_set_noack_map(rdev, dev, noack_map);
3513 }
3514
3515 struct get_key_cookie {
3516         struct sk_buff *msg;
3517         int error;
3518         int idx;
3519 };
3520
3521 static void get_key_callback(void *c, struct key_params *params)
3522 {
3523         struct nlattr *key;
3524         struct get_key_cookie *cookie = c;
3525
3526         if ((params->key &&
3527              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
3528                      params->key_len, params->key)) ||
3529             (params->seq &&
3530              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
3531                      params->seq_len, params->seq)) ||
3532             (params->cipher &&
3533              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
3534                          params->cipher)))
3535                 goto nla_put_failure;
3536
3537         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
3538         if (!key)
3539                 goto nla_put_failure;
3540
3541         if ((params->key &&
3542              nla_put(cookie->msg, NL80211_KEY_DATA,
3543                      params->key_len, params->key)) ||
3544             (params->seq &&
3545              nla_put(cookie->msg, NL80211_KEY_SEQ,
3546                      params->seq_len, params->seq)) ||
3547             (params->cipher &&
3548              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
3549                          params->cipher)))
3550                 goto nla_put_failure;
3551
3552         if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
3553                 goto nla_put_failure;
3554
3555         nla_nest_end(cookie->msg, key);
3556
3557         return;
3558  nla_put_failure:
3559         cookie->error = 1;
3560 }
3561
3562 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
3563 {
3564         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3565         int err;
3566         struct net_device *dev = info->user_ptr[1];
3567         u8 key_idx = 0;
3568         const u8 *mac_addr = NULL;
3569         bool pairwise;
3570         struct get_key_cookie cookie = {
3571                 .error = 0,
3572         };
3573         void *hdr;
3574         struct sk_buff *msg;
3575
3576         if (info->attrs[NL80211_ATTR_KEY_IDX])
3577                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
3578
3579         if (info->attrs[NL80211_ATTR_MAC])
3580                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3581
3582         pairwise = !!mac_addr;
3583         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
3584                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
3585
3586                 if (kt != NL80211_KEYTYPE_GROUP &&
3587                     kt != NL80211_KEYTYPE_PAIRWISE)
3588                         return -EINVAL;
3589                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
3590         }
3591
3592         if (!rdev->ops->get_key)
3593                 return -EOPNOTSUPP;
3594
3595         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3596                 return -ENOENT;
3597
3598         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3599         if (!msg)
3600                 return -ENOMEM;
3601
3602         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3603                              NL80211_CMD_NEW_KEY);
3604         if (!hdr)
3605                 goto nla_put_failure;
3606
3607         cookie.msg = msg;
3608         cookie.idx = key_idx;
3609
3610         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3611             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
3612                 goto nla_put_failure;
3613         if (mac_addr &&
3614             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
3615                 goto nla_put_failure;
3616
3617         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
3618                            get_key_callback);
3619
3620         if (err)
3621                 goto free_msg;
3622
3623         if (cookie.error)
3624                 goto nla_put_failure;
3625
3626         genlmsg_end(msg, hdr);
3627         return genlmsg_reply(msg, info);
3628
3629  nla_put_failure:
3630         err = -ENOBUFS;
3631  free_msg:
3632         nlmsg_free(msg);
3633         return err;
3634 }
3635
3636 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
3637 {
3638         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3639         struct key_parse key;
3640         int err;
3641         struct net_device *dev = info->user_ptr[1];
3642
3643         err = nl80211_parse_key(info, &key);
3644         if (err)
3645                 return err;
3646
3647         if (key.idx < 0)
3648                 return -EINVAL;
3649
3650         /* Only support setting default key and
3651          * Extended Key ID action NL80211_KEY_SET_TX.
3652          */
3653         if (!key.def && !key.defmgmt &&
3654             !(key.p.mode == NL80211_KEY_SET_TX))
3655                 return -EINVAL;
3656
3657         wdev_lock(dev->ieee80211_ptr);
3658
3659         if (key.def) {
3660                 if (!rdev->ops->set_default_key) {
3661                         err = -EOPNOTSUPP;
3662                         goto out;
3663                 }
3664
3665                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3666                 if (err)
3667                         goto out;
3668
3669                 err = rdev_set_default_key(rdev, dev, key.idx,
3670                                                  key.def_uni, key.def_multi);
3671
3672                 if (err)
3673                         goto out;
3674
3675 #ifdef CONFIG_CFG80211_WEXT
3676                 dev->ieee80211_ptr->wext.default_key = key.idx;
3677 #endif
3678         } else if (key.defmgmt) {
3679                 if (key.def_uni || !key.def_multi) {
3680                         err = -EINVAL;
3681                         goto out;
3682                 }
3683
3684                 if (!rdev->ops->set_default_mgmt_key) {
3685                         err = -EOPNOTSUPP;
3686                         goto out;
3687                 }
3688
3689                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3690                 if (err)
3691                         goto out;
3692
3693                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
3694                 if (err)
3695                         goto out;
3696
3697 #ifdef CONFIG_CFG80211_WEXT
3698                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3699 #endif
3700         } else if (key.p.mode == NL80211_KEY_SET_TX &&
3701                    wiphy_ext_feature_isset(&rdev->wiphy,
3702                                            NL80211_EXT_FEATURE_EXT_KEY_ID)) {
3703                 u8 *mac_addr = NULL;
3704
3705                 if (info->attrs[NL80211_ATTR_MAC])
3706                         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3707
3708                 if (!mac_addr || key.idx < 0 || key.idx > 1) {
3709                         err = -EINVAL;
3710                         goto out;
3711                 }
3712
3713                 err = rdev_add_key(rdev, dev, key.idx,
3714                                    NL80211_KEYTYPE_PAIRWISE,
3715                                    mac_addr, &key.p);
3716         } else {
3717                 err = -EINVAL;
3718         }
3719  out:
3720         wdev_unlock(dev->ieee80211_ptr);
3721
3722         return err;
3723 }
3724
3725 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3726 {
3727         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3728         int err;
3729         struct net_device *dev = info->user_ptr[1];
3730         struct key_parse key;
3731         const u8 *mac_addr = NULL;
3732
3733         err = nl80211_parse_key(info, &key);
3734         if (err)
3735                 return err;
3736
3737         if (!key.p.key)
3738                 return -EINVAL;
3739
3740         if (info->attrs[NL80211_ATTR_MAC])
3741                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3742
3743         if (key.type == -1) {
3744                 if (mac_addr)
3745                         key.type = NL80211_KEYTYPE_PAIRWISE;
3746                 else
3747                         key.type = NL80211_KEYTYPE_GROUP;
3748         }
3749
3750         /* for now */
3751         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3752             key.type != NL80211_KEYTYPE_GROUP)
3753                 return -EINVAL;
3754
3755         if (!rdev->ops->add_key)
3756                 return -EOPNOTSUPP;
3757
3758         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3759                                            key.type == NL80211_KEYTYPE_PAIRWISE,
3760                                            mac_addr))
3761                 return -EINVAL;
3762
3763         wdev_lock(dev->ieee80211_ptr);
3764         err = nl80211_key_allowed(dev->ieee80211_ptr);
3765         if (!err)
3766                 err = rdev_add_key(rdev, dev, key.idx,
3767                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3768                                     mac_addr, &key.p);
3769         wdev_unlock(dev->ieee80211_ptr);
3770
3771         return err;
3772 }
3773
3774 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3775 {
3776         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3777         int err;
3778         struct net_device *dev = info->user_ptr[1];
3779         u8 *mac_addr = NULL;
3780         struct key_parse key;
3781
3782         err = nl80211_parse_key(info, &key);
3783         if (err)
3784                 return err;
3785
3786         if (info->attrs[NL80211_ATTR_MAC])
3787                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3788
3789         if (key.type == -1) {
3790                 if (mac_addr)
3791                         key.type = NL80211_KEYTYPE_PAIRWISE;
3792                 else
3793                         key.type = NL80211_KEYTYPE_GROUP;
3794         }
3795
3796         /* for now */
3797         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3798             key.type != NL80211_KEYTYPE_GROUP)
3799                 return -EINVAL;
3800
3801         if (!rdev->ops->del_key)
3802                 return -EOPNOTSUPP;
3803
3804         wdev_lock(dev->ieee80211_ptr);
3805         err = nl80211_key_allowed(dev->ieee80211_ptr);
3806
3807         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3808             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3809                 err = -ENOENT;
3810
3811         if (!err)
3812                 err = rdev_del_key(rdev, dev, key.idx,
3813                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3814                                    mac_addr);
3815
3816 #ifdef CONFIG_CFG80211_WEXT
3817         if (!err) {
3818                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3819                         dev->ieee80211_ptr->wext.default_key = -1;
3820                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3821                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3822         }
3823 #endif
3824         wdev_unlock(dev->ieee80211_ptr);
3825
3826         return err;
3827 }
3828
3829 /* This function returns an error or the number of nested attributes */
3830 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3831 {
3832         struct nlattr *attr;
3833         int n_entries = 0, tmp;
3834
3835         nla_for_each_nested(attr, nl_attr, tmp) {
3836                 if (nla_len(attr) != ETH_ALEN)
3837                         return -EINVAL;
3838
3839                 n_entries++;
3840         }
3841
3842         return n_entries;
3843 }
3844
3845 /*
3846  * This function parses ACL information and allocates memory for ACL data.
3847  * On successful return, the calling function is responsible to free the
3848  * ACL buffer returned by this function.
3849  */
3850 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3851                                                 struct genl_info *info)
3852 {
3853         enum nl80211_acl_policy acl_policy;
3854         struct nlattr *attr;
3855         struct cfg80211_acl_data *acl;
3856         int i = 0, n_entries, tmp;
3857
3858         if (!wiphy->max_acl_mac_addrs)
3859                 return ERR_PTR(-EOPNOTSUPP);
3860
3861         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3862                 return ERR_PTR(-EINVAL);
3863
3864         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3865         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3866             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3867                 return ERR_PTR(-EINVAL);
3868
3869         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3870                 return ERR_PTR(-EINVAL);
3871
3872         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3873         if (n_entries < 0)
3874                 return ERR_PTR(n_entries);
3875
3876         if (n_entries > wiphy->max_acl_mac_addrs)
3877                 return ERR_PTR(-ENOTSUPP);
3878
3879         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3880                       GFP_KERNEL);
3881         if (!acl)
3882                 return ERR_PTR(-ENOMEM);
3883
3884         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3885                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3886                 i++;
3887         }
3888
3889         acl->n_acl_entries = n_entries;
3890         acl->acl_policy = acl_policy;
3891
3892         return acl;
3893 }
3894
3895 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3896 {
3897         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3898         struct net_device *dev = info->user_ptr[1];
3899         struct cfg80211_acl_data *acl;
3900         int err;
3901
3902         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3903             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3904                 return -EOPNOTSUPP;
3905
3906         if (!dev->ieee80211_ptr->beacon_interval)
3907                 return -EINVAL;
3908
3909         acl = parse_acl_data(&rdev->wiphy, info);
3910         if (IS_ERR(acl))
3911                 return PTR_ERR(acl);
3912
3913         err = rdev_set_mac_acl(rdev, dev, acl);
3914
3915         kfree(acl);
3916
3917         return err;
3918 }
3919
3920 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
3921                            u8 *rates, u8 rates_len)
3922 {
3923         u8 i;
3924         u32 mask = 0;
3925
3926         for (i = 0; i < rates_len; i++) {
3927                 int rate = (rates[i] & 0x7f) * 5;
3928                 int ridx;
3929
3930                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
3931                         struct ieee80211_rate *srate =
3932                                 &sband->bitrates[ridx];
3933                         if (rate == srate->bitrate) {
3934                                 mask |= 1 << ridx;
3935                                 break;
3936                         }
3937                 }
3938                 if (ridx == sband->n_bitrates)
3939                         return 0; /* rate not found */
3940         }
3941
3942         return mask;
3943 }
3944
3945 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
3946                                u8 *rates, u8 rates_len,
3947                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
3948 {
3949         u8 i;
3950
3951         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
3952
3953         for (i = 0; i < rates_len; i++) {
3954                 int ridx, rbit;
3955
3956                 ridx = rates[i] / 8;
3957                 rbit = BIT(rates[i] % 8);
3958
3959                 /* check validity */
3960                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
3961                         return false;
3962
3963                 /* check availability */
3964                 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
3965                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
3966                         mcs[ridx] |= rbit;
3967                 else
3968                         return false;
3969         }
3970
3971         return true;
3972 }
3973
3974 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
3975 {
3976         u16 mcs_mask = 0;
3977
3978         switch (vht_mcs_map) {
3979         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
3980                 break;
3981         case IEEE80211_VHT_MCS_SUPPORT_0_7:
3982                 mcs_mask = 0x00FF;
3983                 break;
3984         case IEEE80211_VHT_MCS_SUPPORT_0_8:
3985                 mcs_mask = 0x01FF;
3986                 break;
3987         case IEEE80211_VHT_MCS_SUPPORT_0_9:
3988                 mcs_mask = 0x03FF;
3989                 break;
3990         default:
3991                 break;
3992         }
3993
3994         return mcs_mask;
3995 }
3996
3997 static void vht_build_mcs_mask(u16 vht_mcs_map,
3998                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
3999 {
4000         u8 nss;
4001
4002         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
4003                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
4004                 vht_mcs_map >>= 2;
4005         }
4006 }
4007
4008 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
4009                              struct nl80211_txrate_vht *txrate,
4010                              u16 mcs[NL80211_VHT_NSS_MAX])
4011 {
4012         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4013         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
4014         u8 i;
4015
4016         if (!sband->vht_cap.vht_supported)
4017                 return false;
4018
4019         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
4020
4021         /* Build vht_mcs_mask from VHT capabilities */
4022         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
4023
4024         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
4025                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
4026                         mcs[i] = txrate->mcs[i];
4027                 else
4028                         return false;
4029         }
4030
4031         return true;
4032 }
4033
4034 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
4035         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
4036                                     .len = NL80211_MAX_SUPP_RATES },
4037         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
4038                                 .len = NL80211_MAX_SUPP_HT_RATES },
4039         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
4040         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
4041 };
4042
4043 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
4044                                          struct cfg80211_bitrate_mask *mask)
4045 {
4046         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
4047         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4048         int rem, i;
4049         struct nlattr *tx_rates;
4050         struct ieee80211_supported_band *sband;
4051         u16 vht_tx_mcs_map;
4052
4053         memset(mask, 0, sizeof(*mask));
4054         /* Default to all rates enabled */
4055         for (i = 0; i < NUM_NL80211_BANDS; i++) {
4056                 sband = rdev->wiphy.bands[i];
4057
4058                 if (!sband)
4059                         continue;
4060
4061                 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
4062                 memcpy(mask->control[i].ht_mcs,
4063                        sband->ht_cap.mcs.rx_mask,
4064                        sizeof(mask->control[i].ht_mcs));
4065
4066                 if (!sband->vht_cap.vht_supported)
4067                         continue;
4068
4069                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4070                 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
4071         }
4072
4073         /* if no rates are given set it back to the defaults */
4074         if (!info->attrs[NL80211_ATTR_TX_RATES])
4075                 goto out;
4076
4077         /* The nested attribute uses enum nl80211_band as the index. This maps
4078          * directly to the enum nl80211_band values used in cfg80211.
4079          */
4080         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
4081         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
4082                 enum nl80211_band band = nla_type(tx_rates);
4083                 int err;
4084
4085                 if (band < 0 || band >= NUM_NL80211_BANDS)
4086                         return -EINVAL;
4087                 sband = rdev->wiphy.bands[band];
4088                 if (sband == NULL)
4089                         return -EINVAL;
4090                 err = nla_parse_nested(tb, NL80211_TXRATE_MAX, tx_rates,
4091                                        nl80211_txattr_policy, info->extack);
4092                 if (err)
4093                         return err;
4094                 if (tb[NL80211_TXRATE_LEGACY]) {
4095                         mask->control[band].legacy = rateset_to_mask(
4096                                 sband,
4097                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
4098                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
4099                         if ((mask->control[band].legacy == 0) &&
4100                             nla_len(tb[NL80211_TXRATE_LEGACY]))
4101                                 return -EINVAL;
4102                 }
4103                 if (tb[NL80211_TXRATE_HT]) {
4104                         if (!ht_rateset_to_mask(
4105                                         sband,
4106                                         nla_data(tb[NL80211_TXRATE_HT]),
4107                                         nla_len(tb[NL80211_TXRATE_HT]),
4108                                         mask->control[band].ht_mcs))
4109                                 return -EINVAL;
4110                 }
4111                 if (tb[NL80211_TXRATE_VHT]) {
4112                         if (!vht_set_mcs_mask(
4113                                         sband,
4114                                         nla_data(tb[NL80211_TXRATE_VHT]),
4115                                         mask->control[band].vht_mcs))
4116                                 return -EINVAL;
4117                 }
4118                 if (tb[NL80211_TXRATE_GI]) {
4119                         mask->control[band].gi =
4120                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
4121                         if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
4122                                 return -EINVAL;
4123                 }
4124
4125                 if (mask->control[band].legacy == 0) {
4126                         /* don't allow empty legacy rates if HT or VHT
4127                          * are not even supported.
4128                          */
4129                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
4130                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
4131                                 return -EINVAL;
4132
4133                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
4134                                 if (mask->control[band].ht_mcs[i])
4135                                         goto out;
4136
4137                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
4138                                 if (mask->control[band].vht_mcs[i])
4139                                         goto out;
4140
4141                         /* legacy and mcs rates may not be both empty */
4142                         return -EINVAL;
4143                 }
4144         }
4145
4146 out:
4147         return 0;
4148 }
4149
4150 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
4151                                    enum nl80211_band band,
4152                                    struct cfg80211_bitrate_mask *beacon_rate)
4153 {
4154         u32 count_ht, count_vht, i;
4155         u32 rate = beacon_rate->control[band].legacy;
4156
4157         /* Allow only one rate */
4158         if (hweight32(rate) > 1)
4159                 return -EINVAL;
4160
4161         count_ht = 0;
4162         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
4163                 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
4164                         return -EINVAL;
4165                 } else if (beacon_rate->control[band].ht_mcs[i]) {
4166                         count_ht++;
4167                         if (count_ht > 1)
4168                                 return -EINVAL;
4169                 }
4170                 if (count_ht && rate)
4171                         return -EINVAL;
4172         }
4173
4174         count_vht = 0;
4175         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
4176                 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
4177                         return -EINVAL;
4178                 } else if (beacon_rate->control[band].vht_mcs[i]) {
4179                         count_vht++;
4180                         if (count_vht > 1)
4181                                 return -EINVAL;
4182                 }
4183                 if (count_vht && rate)
4184                         return -EINVAL;
4185         }
4186
4187         if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht))
4188                 return -EINVAL;
4189
4190         if (rate &&
4191             !wiphy_ext_feature_isset(&rdev->wiphy,
4192                                      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
4193                 return -EINVAL;
4194         if (count_ht &&
4195             !wiphy_ext_feature_isset(&rdev->wiphy,
4196                                      NL80211_EXT_FEATURE_BEACON_RATE_HT))
4197                 return -EINVAL;
4198         if (count_vht &&
4199             !wiphy_ext_feature_isset(&rdev->wiphy,
4200                                      NL80211_EXT_FEATURE_BEACON_RATE_VHT))
4201                 return -EINVAL;
4202
4203         return 0;
4204 }
4205
4206 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
4207                                 struct nlattr *attrs[],
4208                                 struct cfg80211_beacon_data *bcn)
4209 {
4210         bool haveinfo = false;
4211         int err;
4212
4213         memset(bcn, 0, sizeof(*bcn));
4214
4215         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
4216                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
4217                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
4218                 if (!bcn->head_len)
4219                         return -EINVAL;
4220                 haveinfo = true;
4221         }
4222
4223         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
4224                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
4225                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
4226                 haveinfo = true;
4227         }
4228
4229         if (!haveinfo)
4230                 return -EINVAL;
4231
4232         if (attrs[NL80211_ATTR_IE]) {
4233                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
4234                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
4235         }
4236
4237         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
4238                 bcn->proberesp_ies =
4239                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4240                 bcn->proberesp_ies_len =
4241                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4242         }
4243
4244         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
4245                 bcn->assocresp_ies =
4246                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4247                 bcn->assocresp_ies_len =
4248                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4249         }
4250
4251         if (attrs[NL80211_ATTR_PROBE_RESP]) {
4252                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
4253                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
4254         }
4255
4256         if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
4257                 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
4258
4259                 err = nla_parse_nested(tb, NL80211_FTM_RESP_ATTR_MAX,
4260                                        attrs[NL80211_ATTR_FTM_RESPONDER],
4261                                        NULL, NULL);
4262                 if (err)
4263                         return err;
4264
4265                 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
4266                     wiphy_ext_feature_isset(&rdev->wiphy,
4267                                             NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
4268                         bcn->ftm_responder = 1;
4269                 else
4270                         return -EOPNOTSUPP;
4271
4272                 if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
4273                         bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
4274                         bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
4275                 }
4276
4277                 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
4278                         bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
4279                         bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
4280                 }
4281         } else {
4282                 bcn->ftm_responder = -1;
4283         }
4284
4285         return 0;
4286 }
4287
4288 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
4289                                             const u8 *rates)
4290 {
4291         int i;
4292
4293         if (!rates)
4294                 return;
4295
4296         for (i = 0; i < rates[1]; i++) {
4297                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
4298                         params->ht_required = true;
4299                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
4300                         params->vht_required = true;
4301         }
4302 }
4303
4304 /*
4305  * Since the nl80211 API didn't include, from the beginning, attributes about
4306  * HT/VHT requirements/capabilities, we parse them out of the IEs for the
4307  * benefit of drivers that rebuild IEs in the firmware.
4308  */
4309 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
4310 {
4311         const struct cfg80211_beacon_data *bcn = &params->beacon;
4312         size_t ies_len = bcn->tail_len;
4313         const u8 *ies = bcn->tail;
4314         const u8 *rates;
4315         const u8 *cap;
4316
4317         rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len);
4318         nl80211_check_ap_rate_selectors(params, rates);
4319
4320         rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
4321         nl80211_check_ap_rate_selectors(params, rates);
4322
4323         cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len);
4324         if (cap && cap[1] >= sizeof(*params->ht_cap))
4325                 params->ht_cap = (void *)(cap + 2);
4326         cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
4327         if (cap && cap[1] >= sizeof(*params->vht_cap))
4328                 params->vht_cap = (void *)(cap + 2);
4329         cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
4330         if (cap && cap[1] >= sizeof(*params->he_cap) + 1)
4331                 params->he_cap = (void *)(cap + 3);
4332 }
4333
4334 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
4335                                    struct cfg80211_ap_settings *params)
4336 {
4337         struct wireless_dev *wdev;
4338         bool ret = false;
4339
4340         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
4341                 if (wdev->iftype != NL80211_IFTYPE_AP &&
4342                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
4343                         continue;
4344
4345                 if (!wdev->preset_chandef.chan)
4346                         continue;
4347
4348                 params->chandef = wdev->preset_chandef;
4349                 ret = true;
4350                 break;
4351         }
4352
4353         return ret;
4354 }
4355
4356 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
4357                                     enum nl80211_auth_type auth_type,
4358                                     enum nl80211_commands cmd)
4359 {
4360         if (auth_type > NL80211_AUTHTYPE_MAX)
4361                 return false;
4362
4363         switch (cmd) {
4364         case NL80211_CMD_AUTHENTICATE:
4365                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
4366                     auth_type == NL80211_AUTHTYPE_SAE)
4367                         return false;
4368                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
4369                                              NL80211_EXT_FEATURE_FILS_STA) &&
4370                     (auth_type == NL80211_AUTHTYPE_FILS_SK ||
4371                      auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4372                      auth_type == NL80211_AUTHTYPE_FILS_PK))
4373                         return false;
4374                 return true;
4375         case NL80211_CMD_CONNECT:
4376                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
4377                     auth_type == NL80211_AUTHTYPE_SAE)
4378                         return false;
4379
4380                 /* FILS with SK PFS or PK not supported yet */
4381                 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4382                     auth_type == NL80211_AUTHTYPE_FILS_PK)
4383                         return false;
4384                 if (!wiphy_ext_feature_isset(
4385                             &rdev->wiphy,
4386                             NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
4387                     auth_type == NL80211_AUTHTYPE_FILS_SK)
4388                         return false;
4389                 return true;
4390         case NL80211_CMD_START_AP:
4391                 /* SAE not supported yet */
4392                 if (auth_type == NL80211_AUTHTYPE_SAE)
4393                         return false;
4394                 /* FILS not supported yet */
4395                 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
4396                     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4397                     auth_type == NL80211_AUTHTYPE_FILS_PK)
4398                         return false;
4399                 return true;
4400         default:
4401                 return false;
4402         }
4403 }
4404
4405 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
4406 {
4407         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4408         struct net_device *dev = info->user_ptr[1];
4409         struct wireless_dev *wdev = dev->ieee80211_ptr;
4410         struct cfg80211_ap_settings params;
4411         int err;
4412
4413         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4414             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4415                 return -EOPNOTSUPP;
4416
4417         if (!rdev->ops->start_ap)
4418                 return -EOPNOTSUPP;
4419
4420         if (wdev->beacon_interval)
4421                 return -EALREADY;
4422
4423         memset(&params, 0, sizeof(params));
4424
4425         /* these are required for START_AP */
4426         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
4427             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
4428             !info->attrs[NL80211_ATTR_BEACON_HEAD])
4429                 return -EINVAL;
4430
4431         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon);
4432         if (err)
4433                 return err;
4434
4435         params.beacon_interval =
4436                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
4437         params.dtim_period =
4438                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
4439
4440         err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
4441                                            params.beacon_interval);
4442         if (err)
4443                 return err;
4444
4445         /*
4446          * In theory, some of these attributes should be required here
4447          * but since they were not used when the command was originally
4448          * added, keep them optional for old user space programs to let
4449          * them continue to work with drivers that do not need the
4450          * additional information -- drivers must check!
4451          */
4452         if (info->attrs[NL80211_ATTR_SSID]) {
4453                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4454                 params.ssid_len =
4455                         nla_len(info->attrs[NL80211_ATTR_SSID]);
4456                 if (params.ssid_len == 0 ||
4457                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
4458                         return -EINVAL;
4459         }
4460
4461         if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
4462                 params.hidden_ssid = nla_get_u32(
4463                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
4464
4465         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
4466
4467         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4468                 params.auth_type = nla_get_u32(
4469                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
4470                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
4471                                              NL80211_CMD_START_AP))
4472                         return -EINVAL;
4473         } else
4474                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4475
4476         err = nl80211_crypto_settings(rdev, info, &params.crypto,
4477                                       NL80211_MAX_NR_CIPHER_SUITES);
4478         if (err)
4479                 return err;
4480
4481         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
4482                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
4483                         return -EOPNOTSUPP;
4484                 params.inactivity_timeout = nla_get_u16(
4485                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
4486         }
4487
4488         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4489                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4490                         return -EINVAL;
4491                 params.p2p_ctwindow =
4492                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4493                 if (params.p2p_ctwindow != 0 &&
4494                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4495                         return -EINVAL;
4496         }
4497
4498         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4499                 u8 tmp;
4500
4501                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4502                         return -EINVAL;
4503                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4504                 params.p2p_opp_ps = tmp;
4505                 if (params.p2p_opp_ps != 0 &&
4506                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4507                         return -EINVAL;
4508         }
4509
4510         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4511                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
4512                 if (err)
4513                         return err;
4514         } else if (wdev->preset_chandef.chan) {
4515                 params.chandef = wdev->preset_chandef;
4516         } else if (!nl80211_get_ap_channel(rdev, &params))
4517                 return -EINVAL;
4518
4519         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
4520                                            wdev->iftype))
4521                 return -EINVAL;
4522
4523         if (info->attrs[NL80211_ATTR_TX_RATES]) {
4524                 err = nl80211_parse_tx_bitrate_mask(info, &params.beacon_rate);
4525                 if (err)
4526                         return err;
4527
4528                 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
4529                                               &params.beacon_rate);
4530                 if (err)
4531                         return err;
4532         }
4533
4534         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
4535                 params.smps_mode =
4536                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
4537                 switch (params.smps_mode) {
4538                 case NL80211_SMPS_OFF:
4539                         break;
4540                 case NL80211_SMPS_STATIC:
4541                         if (!(rdev->wiphy.features &
4542                               NL80211_FEATURE_STATIC_SMPS))
4543                                 return -EINVAL;
4544                         break;
4545                 case NL80211_SMPS_DYNAMIC:
4546                         if (!(rdev->wiphy.features &
4547                               NL80211_FEATURE_DYNAMIC_SMPS))
4548                                 return -EINVAL;
4549                         break;
4550                 default:
4551                         return -EINVAL;
4552                 }
4553         } else {
4554                 params.smps_mode = NL80211_SMPS_OFF;
4555         }
4556
4557         params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
4558         if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
4559                 return -EOPNOTSUPP;
4560
4561         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
4562                 params.acl = parse_acl_data(&rdev->wiphy, info);
4563                 if (IS_ERR(params.acl))
4564                         return PTR_ERR(params.acl);
4565         }
4566
4567         nl80211_calculate_ap_params(&params);
4568
4569         if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
4570                 params.flags |= AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
4571
4572         wdev_lock(wdev);
4573         err = rdev_start_ap(rdev, dev, &params);
4574         if (!err) {
4575                 wdev->preset_chandef = params.chandef;
4576                 wdev->beacon_interval = params.beacon_interval;
4577                 wdev->chandef = params.chandef;
4578                 wdev->ssid_len = params.ssid_len;
4579                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
4580
4581                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4582                         wdev->conn_owner_nlportid = info->snd_portid;
4583         }
4584         wdev_unlock(wdev);
4585
4586         kfree(params.acl);
4587
4588         return err;
4589 }
4590
4591 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
4592 {
4593         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4594         struct net_device *dev = info->user_ptr[1];
4595         struct wireless_dev *wdev = dev->ieee80211_ptr;
4596         struct cfg80211_beacon_data params;
4597         int err;
4598
4599         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4600             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4601                 return -EOPNOTSUPP;
4602
4603         if (!rdev->ops->change_beacon)
4604                 return -EOPNOTSUPP;
4605
4606         if (!wdev->beacon_interval)
4607                 return -EINVAL;
4608
4609         err = nl80211_parse_beacon(rdev, info->attrs, &params);
4610         if (err)
4611                 return err;
4612
4613         wdev_lock(wdev);
4614         err = rdev_change_beacon(rdev, dev, &params);
4615         wdev_unlock(wdev);
4616
4617         return err;
4618 }
4619
4620 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
4621 {
4622         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4623         struct net_device *dev = info->user_ptr[1];
4624
4625         return cfg80211_stop_ap(rdev, dev, false);
4626 }
4627
4628 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
4629         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
4630         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
4631         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
4632         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
4633         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
4634         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
4635 };
4636
4637 static int parse_station_flags(struct genl_info *info,
4638                                enum nl80211_iftype iftype,
4639                                struct station_parameters *params)
4640 {
4641         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
4642         struct nlattr *nla;
4643         int flag;
4644
4645         /*
4646          * Try parsing the new attribute first so userspace
4647          * can specify both for older kernels.
4648          */
4649         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
4650         if (nla) {
4651                 struct nl80211_sta_flag_update *sta_flags;
4652
4653                 sta_flags = nla_data(nla);
4654                 params->sta_flags_mask = sta_flags->mask;
4655                 params->sta_flags_set = sta_flags->set;
4656                 params->sta_flags_set &= params->sta_flags_mask;
4657                 if ((params->sta_flags_mask |
4658                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
4659                         return -EINVAL;
4660                 return 0;
4661         }
4662
4663         /* if present, parse the old attribute */
4664
4665         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
4666         if (!nla)
4667                 return 0;
4668
4669         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX, nla,
4670                              sta_flags_policy, info->extack))
4671                 return -EINVAL;
4672
4673         /*
4674          * Only allow certain flags for interface types so that
4675          * other attributes are silently ignored. Remember that
4676          * this is backward compatibility code with old userspace
4677          * and shouldn't be hit in other cases anyway.
4678          */
4679         switch (iftype) {
4680         case NL80211_IFTYPE_AP:
4681         case NL80211_IFTYPE_AP_VLAN:
4682         case NL80211_IFTYPE_P2P_GO:
4683                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4684                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4685                                          BIT(NL80211_STA_FLAG_WME) |
4686                                          BIT(NL80211_STA_FLAG_MFP);
4687                 break;
4688         case NL80211_IFTYPE_P2P_CLIENT:
4689         case NL80211_IFTYPE_STATION:
4690                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4691                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
4692                 break;
4693         case NL80211_IFTYPE_MESH_POINT:
4694                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4695                                          BIT(NL80211_STA_FLAG_MFP) |
4696                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
4697                 break;
4698         default:
4699                 return -EINVAL;
4700         }
4701
4702         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
4703                 if (flags[flag]) {
4704                         params->sta_flags_set |= (1<<flag);
4705
4706                         /* no longer support new API additions in old API */
4707                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
4708                                 return -EINVAL;
4709                 }
4710         }
4711
4712         return 0;
4713 }
4714
4715 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
4716 {
4717         struct nlattr *rate;
4718         u32 bitrate;
4719         u16 bitrate_compat;
4720         enum nl80211_rate_info rate_flg;
4721
4722         rate = nla_nest_start(msg, attr);
4723         if (!rate)
4724                 return false;
4725
4726         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
4727         bitrate = cfg80211_calculate_bitrate(info);
4728         /* report 16-bit bitrate only if we can */
4729         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
4730         if (bitrate > 0 &&
4731             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
4732                 return false;
4733         if (bitrate_compat > 0 &&
4734             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
4735                 return false;
4736
4737         switch (info->bw) {
4738         case RATE_INFO_BW_5:
4739                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
4740                 break;
4741         case RATE_INFO_BW_10:
4742                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
4743                 break;
4744         default:
4745                 WARN_ON(1);
4746                 /* fall through */
4747         case RATE_INFO_BW_20:
4748                 rate_flg = 0;
4749                 break;
4750         case RATE_INFO_BW_40:
4751                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
4752                 break;
4753         case RATE_INFO_BW_80:
4754                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
4755                 break;
4756         case RATE_INFO_BW_160:
4757                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
4758                 break;
4759         case RATE_INFO_BW_HE_RU:
4760                 rate_flg = 0;
4761                 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
4762         }
4763
4764         if (rate_flg && nla_put_flag(msg, rate_flg))
4765                 return false;
4766
4767         if (info->flags & RATE_INFO_FLAGS_MCS) {
4768                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
4769                         return false;
4770                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4771                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4772                         return false;
4773         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
4774                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
4775                         return false;
4776                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
4777                         return false;
4778                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4779                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4780                         return false;
4781         } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
4782                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
4783                         return false;
4784                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
4785                         return false;
4786                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
4787                         return false;
4788                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
4789                         return false;
4790                 if (info->bw == RATE_INFO_BW_HE_RU &&
4791                     nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
4792                                info->he_ru_alloc))
4793                         return false;
4794         }
4795
4796         nla_nest_end(msg, rate);
4797         return true;
4798 }
4799
4800 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
4801                                int id)
4802 {
4803         void *attr;
4804         int i = 0;
4805
4806         if (!mask)
4807                 return true;
4808
4809         attr = nla_nest_start(msg, id);
4810         if (!attr)
4811                 return false;
4812
4813         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
4814                 if (!(mask & BIT(i)))
4815                         continue;
4816
4817                 if (nla_put_u8(msg, i, signal[i]))
4818                         return false;
4819         }
4820
4821         nla_nest_end(msg, attr);
4822
4823         return true;
4824 }
4825
4826 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
4827                                 u32 seq, int flags,
4828                                 struct cfg80211_registered_device *rdev,
4829                                 struct net_device *dev,
4830                                 const u8 *mac_addr, struct station_info *sinfo)
4831 {
4832         void *hdr;
4833         struct nlattr *sinfoattr, *bss_param;
4834
4835         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
4836         if (!hdr)
4837                 return -1;
4838
4839         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4840             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
4841             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
4842                 goto nla_put_failure;
4843
4844         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
4845         if (!sinfoattr)
4846                 goto nla_put_failure;
4847
4848 #define PUT_SINFO(attr, memb, type) do {                                \
4849         BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
4850         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
4851             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
4852                              sinfo->memb))                              \
4853                 goto nla_put_failure;                                   \
4854         } while (0)
4855 #define PUT_SINFO_U64(attr, memb) do {                                  \
4856         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
4857             nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
4858                               sinfo->memb, NL80211_STA_INFO_PAD))       \
4859                 goto nla_put_failure;                                   \
4860         } while (0)
4861
4862         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
4863         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
4864
4865         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
4866                              BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
4867             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
4868                         (u32)sinfo->rx_bytes))
4869                 goto nla_put_failure;
4870
4871         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
4872                              BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
4873             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
4874                         (u32)sinfo->tx_bytes))
4875                 goto nla_put_failure;
4876
4877         PUT_SINFO_U64(RX_BYTES64, rx_bytes);
4878         PUT_SINFO_U64(TX_BYTES64, tx_bytes);
4879         PUT_SINFO(LLID, llid, u16);
4880         PUT_SINFO(PLID, plid, u16);
4881         PUT_SINFO(PLINK_STATE, plink_state, u8);
4882         PUT_SINFO_U64(RX_DURATION, rx_duration);
4883         PUT_SINFO_U64(TX_DURATION, tx_duration);
4884
4885         if (wiphy_ext_feature_isset(&rdev->wiphy,
4886                                     NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
4887                 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
4888
4889         switch (rdev->wiphy.signal_type) {
4890         case CFG80211_SIGNAL_TYPE_MBM:
4891                 PUT_SINFO(SIGNAL, signal, u8);
4892                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
4893                 break;
4894         default:
4895                 break;
4896         }
4897         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
4898                 if (!nl80211_put_signal(msg, sinfo->chains,
4899                                         sinfo->chain_signal,
4900                                         NL80211_STA_INFO_CHAIN_SIGNAL))
4901                         goto nla_put_failure;
4902         }
4903         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
4904                 if (!nl80211_put_signal(msg, sinfo->chains,
4905                                         sinfo->chain_signal_avg,
4906                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
4907                         goto nla_put_failure;
4908         }
4909         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
4910                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
4911                                           NL80211_STA_INFO_TX_BITRATE))
4912                         goto nla_put_failure;
4913         }
4914         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
4915                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
4916                                           NL80211_STA_INFO_RX_BITRATE))
4917                         goto nla_put_failure;
4918         }
4919
4920         PUT_SINFO(RX_PACKETS, rx_packets, u32);
4921         PUT_SINFO(TX_PACKETS, tx_packets, u32);
4922         PUT_SINFO(TX_RETRIES, tx_retries, u32);
4923         PUT_SINFO(TX_FAILED, tx_failed, u32);
4924         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
4925         PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32);
4926         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
4927         PUT_SINFO(LOCAL_PM, local_pm, u32);
4928         PUT_SINFO(PEER_PM, peer_pm, u32);
4929         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
4930         PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8);
4931
4932         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
4933                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
4934                 if (!bss_param)
4935                         goto nla_put_failure;
4936
4937                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
4938                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
4939                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
4940                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
4941                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
4942                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
4943                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
4944                                sinfo->bss_param.dtim_period) ||
4945                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
4946                                 sinfo->bss_param.beacon_interval))
4947                         goto nla_put_failure;
4948
4949                 nla_nest_end(msg, bss_param);
4950         }
4951         if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
4952             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
4953                     sizeof(struct nl80211_sta_flag_update),
4954                     &sinfo->sta_flags))
4955                 goto nla_put_failure;
4956
4957         PUT_SINFO_U64(T_OFFSET, t_offset);
4958         PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
4959         PUT_SINFO_U64(BEACON_RX, rx_beacon);
4960         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
4961         PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
4962         PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
4963         if (wiphy_ext_feature_isset(&rdev->wiphy,
4964                                     NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
4965                 PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
4966                 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
4967         }
4968
4969 #undef PUT_SINFO
4970 #undef PUT_SINFO_U64
4971
4972         if (sinfo->pertid) {
4973                 struct nlattr *tidsattr;
4974                 int tid;
4975
4976                 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS);
4977                 if (!tidsattr)
4978                         goto nla_put_failure;
4979
4980                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
4981                         struct cfg80211_tid_stats *tidstats;
4982                         struct nlattr *tidattr;
4983
4984                         tidstats = &sinfo->pertid[tid];
4985
4986                         if (!tidstats->filled)
4987                                 continue;
4988
4989                         tidattr = nla_nest_start(msg, tid + 1);
4990                         if (!tidattr)
4991                                 goto nla_put_failure;
4992
4993 #define PUT_TIDVAL_U64(attr, memb) do {                                 \
4994         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
4995             nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,          \
4996                               tidstats->memb, NL80211_TID_STATS_PAD))   \
4997                 goto nla_put_failure;                                   \
4998         } while (0)
4999
5000                         PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
5001                         PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
5002                         PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
5003                         PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
5004
5005 #undef PUT_TIDVAL_U64
5006                         if ((tidstats->filled &
5007                              BIT(NL80211_TID_STATS_TXQ_STATS)) &&
5008                             !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
5009                                                    NL80211_TID_STATS_TXQ_STATS))
5010                                 goto nla_put_failure;
5011
5012                         nla_nest_end(msg, tidattr);
5013                 }
5014
5015                 nla_nest_end(msg, tidsattr);
5016         }
5017
5018         nla_nest_end(msg, sinfoattr);
5019
5020         if (sinfo->assoc_req_ies_len &&
5021             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
5022                     sinfo->assoc_req_ies))
5023                 goto nla_put_failure;
5024
5025         cfg80211_sinfo_release_content(sinfo);
5026         genlmsg_end(msg, hdr);
5027         return 0;
5028
5029  nla_put_failure:
5030         cfg80211_sinfo_release_content(sinfo);
5031         genlmsg_cancel(msg, hdr);
5032         return -EMSGSIZE;
5033 }
5034
5035 static int nl80211_dump_station(struct sk_buff *skb,
5036                                 struct netlink_callback *cb)
5037 {
5038         struct station_info sinfo;
5039         struct cfg80211_registered_device *rdev;
5040         struct wireless_dev *wdev;
5041         u8 mac_addr[ETH_ALEN];
5042         int sta_idx = cb->args[2];
5043         int err;
5044
5045         rtnl_lock();
5046         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
5047         if (err)
5048                 goto out_err;
5049
5050         if (!wdev->netdev) {
5051                 err = -EINVAL;
5052                 goto out_err;
5053         }
5054
5055         if (!rdev->ops->dump_station) {
5056                 err = -EOPNOTSUPP;
5057                 goto out_err;
5058         }
5059
5060         while (1) {
5061                 memset(&sinfo, 0, sizeof(sinfo));
5062                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
5063                                         mac_addr, &sinfo);
5064                 if (err == -ENOENT)
5065                         break;
5066                 if (err)
5067                         goto out_err;
5068
5069                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
5070                                 NETLINK_CB(cb->skb).portid,
5071                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5072                                 rdev, wdev->netdev, mac_addr,
5073                                 &sinfo) < 0)
5074                         goto out;
5075
5076                 sta_idx++;
5077         }
5078
5079  out:
5080         cb->args[2] = sta_idx;
5081         err = skb->len;
5082  out_err:
5083         rtnl_unlock();
5084
5085         return err;
5086 }
5087
5088 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
5089 {
5090         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5091         struct net_device *dev = info->user_ptr[1];
5092         struct station_info sinfo;
5093         struct sk_buff *msg;
5094         u8 *mac_addr = NULL;
5095         int err;
5096
5097         memset(&sinfo, 0, sizeof(sinfo));
5098
5099         if (!info->attrs[NL80211_ATTR_MAC])
5100                 return -EINVAL;
5101
5102         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5103
5104         if (!rdev->ops->get_station)
5105                 return -EOPNOTSUPP;
5106
5107         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
5108         if (err)
5109                 return err;
5110
5111         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5112         if (!msg) {
5113                 cfg80211_sinfo_release_content(&sinfo);
5114                 return -ENOMEM;
5115         }
5116
5117         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
5118                                  info->snd_portid, info->snd_seq, 0,
5119                                  rdev, dev, mac_addr, &sinfo) < 0) {
5120                 nlmsg_free(msg);
5121                 return -ENOBUFS;
5122         }
5123
5124         return genlmsg_reply(msg, info);
5125 }
5126
5127 int cfg80211_check_station_change(struct wiphy *wiphy,
5128                                   struct station_parameters *params,
5129                                   enum cfg80211_station_type statype)
5130 {
5131         if (params->listen_interval != -1 &&
5132             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
5133                 return -EINVAL;
5134
5135         if (params->support_p2p_ps != -1 &&
5136             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
5137                 return -EINVAL;
5138
5139         if (params->aid &&
5140             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
5141             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
5142                 return -EINVAL;
5143
5144         /* When you run into this, adjust the code below for the new flag */
5145         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
5146
5147         switch (statype) {
5148         case CFG80211_STA_MESH_PEER_KERNEL:
5149         case CFG80211_STA_MESH_PEER_USER:
5150                 /*
5151                  * No ignoring the TDLS flag here -- the userspace mesh
5152                  * code doesn't have the bug of including TDLS in the
5153                  * mask everywhere.
5154                  */
5155                 if (params->sta_flags_mask &
5156                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5157                                   BIT(NL80211_STA_FLAG_MFP) |
5158                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
5159                         return -EINVAL;
5160                 break;
5161         case CFG80211_STA_TDLS_PEER_SETUP:
5162         case CFG80211_STA_TDLS_PEER_ACTIVE:
5163                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
5164                         return -EINVAL;
5165                 /* ignore since it can't change */
5166                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5167                 break;
5168         default:
5169                 /* disallow mesh-specific things */
5170                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
5171                         return -EINVAL;
5172                 if (params->local_pm)
5173                         return -EINVAL;
5174                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
5175                         return -EINVAL;
5176         }
5177
5178         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
5179             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
5180                 /* TDLS can't be set, ... */
5181                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
5182                         return -EINVAL;
5183                 /*
5184                  * ... but don't bother the driver with it. This works around
5185                  * a hostapd/wpa_supplicant issue -- it always includes the
5186                  * TLDS_PEER flag in the mask even for AP mode.
5187                  */
5188                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5189         }
5190
5191         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
5192             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
5193                 /* reject other things that can't change */
5194                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
5195                         return -EINVAL;
5196                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
5197                         return -EINVAL;
5198                 if (params->supported_rates)
5199                         return -EINVAL;
5200                 if (params->ext_capab || params->ht_capa || params->vht_capa ||
5201                     params->he_capa)
5202                         return -EINVAL;
5203         }
5204
5205         if (statype != CFG80211_STA_AP_CLIENT &&
5206             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
5207                 if (params->vlan)
5208                         return -EINVAL;
5209         }
5210
5211         switch (statype) {
5212         case CFG80211_STA_AP_MLME_CLIENT:
5213                 /* Use this only for authorizing/unauthorizing a station */
5214                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
5215                         return -EOPNOTSUPP;
5216                 break;
5217         case CFG80211_STA_AP_CLIENT:
5218         case CFG80211_STA_AP_CLIENT_UNASSOC:
5219                 /* accept only the listed bits */
5220                 if (params->sta_flags_mask &
5221                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
5222                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5223                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
5224                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
5225                                   BIT(NL80211_STA_FLAG_WME) |
5226                                   BIT(NL80211_STA_FLAG_MFP)))
5227                         return -EINVAL;
5228
5229                 /* but authenticated/associated only if driver handles it */
5230                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5231                     params->sta_flags_mask &
5232                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5233                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
5234                         return -EINVAL;
5235                 break;
5236         case CFG80211_STA_IBSS:
5237         case CFG80211_STA_AP_STA:
5238                 /* reject any changes other than AUTHORIZED */
5239                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
5240                         return -EINVAL;
5241                 break;
5242         case CFG80211_STA_TDLS_PEER_SETUP:
5243                 /* reject any changes other than AUTHORIZED or WME */
5244                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
5245                                                BIT(NL80211_STA_FLAG_WME)))
5246                         return -EINVAL;
5247                 /* force (at least) rates when authorizing */
5248                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
5249                     !params->supported_rates)
5250                         return -EINVAL;
5251                 break;
5252         case CFG80211_STA_TDLS_PEER_ACTIVE:
5253                 /* reject any changes */
5254                 return -EINVAL;
5255         case CFG80211_STA_MESH_PEER_KERNEL:
5256                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
5257                         return -EINVAL;
5258                 break;
5259         case CFG80211_STA_MESH_PEER_USER:
5260                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
5261                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
5262                         return -EINVAL;
5263                 break;
5264         }
5265
5266         /*
5267          * Older kernel versions ignored this attribute entirely, so don't
5268          * reject attempts to update it but mark it as unused instead so the
5269          * driver won't look at the data.
5270          */
5271         if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
5272             statype != CFG80211_STA_TDLS_PEER_SETUP)
5273                 params->opmode_notif_used = false;
5274
5275         return 0;
5276 }
5277 EXPORT_SYMBOL(cfg80211_check_station_change);
5278
5279 /*
5280  * Get vlan interface making sure it is running and on the right wiphy.
5281  */
5282 static struct net_device *get_vlan(struct genl_info *info,
5283                                    struct cfg80211_registered_device *rdev)
5284 {
5285         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
5286         struct net_device *v;
5287         int ret;
5288
5289         if (!vlanattr)
5290                 return NULL;
5291
5292         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
5293         if (!v)
5294                 return ERR_PTR(-ENODEV);
5295
5296         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
5297                 ret = -EINVAL;
5298                 goto error;
5299         }
5300
5301         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5302             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5303             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
5304                 ret = -EINVAL;
5305                 goto error;
5306         }
5307
5308         if (!netif_running(v)) {
5309                 ret = -ENETDOWN;
5310                 goto error;
5311         }
5312
5313         return v;
5314  error:
5315         dev_put(v);
5316         return ERR_PTR(ret);
5317 }
5318
5319 static const struct nla_policy
5320 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
5321         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
5322         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
5323 };
5324
5325 static int nl80211_parse_sta_wme(struct genl_info *info,
5326                                  struct station_parameters *params)
5327 {
5328         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
5329         struct nlattr *nla;
5330         int err;
5331
5332         /* parse WME attributes if present */
5333         if (!info->attrs[NL80211_ATTR_STA_WME])
5334                 return 0;
5335
5336         nla = info->attrs[NL80211_ATTR_STA_WME];
5337         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
5338                                nl80211_sta_wme_policy, info->extack);
5339         if (err)
5340                 return err;
5341
5342         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
5343                 params->uapsd_queues = nla_get_u8(
5344                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
5345         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
5346                 return -EINVAL;
5347
5348         if (tb[NL80211_STA_WME_MAX_SP])
5349                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
5350
5351         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
5352                 return -EINVAL;
5353
5354         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
5355
5356         return 0;
5357 }
5358
5359 static int nl80211_parse_sta_channel_info(struct genl_info *info,
5360                                       struct station_parameters *params)
5361 {
5362         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
5363                 params->supported_channels =
5364                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
5365                 params->supported_channels_len =
5366                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
5367                 /*
5368                  * Need to include at least one (first channel, number of
5369                  * channels) tuple for each subband, and must have proper
5370                  * tuples for the rest of the data as well.
5371                  */
5372                 if (params->supported_channels_len < 2)
5373                         return -EINVAL;
5374                 if (params->supported_channels_len % 2)
5375                         return -EINVAL;
5376         }
5377
5378         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
5379                 params->supported_oper_classes =
5380                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
5381                 params->supported_oper_classes_len =
5382                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
5383                 /*
5384                  * The value of the Length field of the Supported Operating
5385                  * Classes element is between 2 and 253.
5386                  */
5387                 if (params->supported_oper_classes_len < 2 ||
5388                     params->supported_oper_classes_len > 253)
5389                         return -EINVAL;
5390         }
5391         return 0;
5392 }
5393
5394 static int nl80211_set_station_tdls(struct genl_info *info,
5395                                     struct station_parameters *params)
5396 {
5397         int err;
5398         /* Dummy STA entry gets updated once the peer capabilities are known */
5399         if (info->attrs[NL80211_ATTR_PEER_AID])
5400                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5401         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5402                 params->ht_capa =
5403                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5404         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5405                 params->vht_capa =
5406                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5407         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
5408                 params->he_capa =
5409                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5410                 params->he_capa_len =
5411                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5412
5413                 if (params->he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN)
5414                         return -EINVAL;
5415         }
5416
5417         err = nl80211_parse_sta_channel_info(info, params);
5418         if (err)
5419                 return err;
5420
5421         return nl80211_parse_sta_wme(info, params);
5422 }
5423
5424 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
5425 {
5426         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5427         struct net_device *dev = info->user_ptr[1];
5428         struct station_parameters params;
5429         u8 *mac_addr;
5430         int err;
5431
5432         memset(&params, 0, sizeof(params));
5433
5434         if (!rdev->ops->change_station)
5435                 return -EOPNOTSUPP;
5436
5437         /*
5438          * AID and listen_interval properties can be set only for unassociated
5439          * station. Include these parameters here and will check them in
5440          * cfg80211_check_station_change().
5441          */
5442         if (info->attrs[NL80211_ATTR_STA_AID])
5443                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5444
5445         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5446                 params.listen_interval =
5447                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5448         else
5449                 params.listen_interval = -1;
5450
5451         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
5452                 params.support_p2p_ps =
5453                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5454         else
5455                 params.support_p2p_ps = -1;
5456
5457         if (!info->attrs[NL80211_ATTR_MAC])
5458                 return -EINVAL;
5459
5460         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5461
5462         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
5463                 params.supported_rates =
5464                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5465                 params.supported_rates_len =
5466                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5467         }
5468
5469         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5470                 params.capability =
5471                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5472                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5473         }
5474
5475         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5476                 params.ext_capab =
5477                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5478                 params.ext_capab_len =
5479                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5480         }
5481
5482         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5483                 return -EINVAL;
5484
5485         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
5486                 params.plink_action =
5487                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5488
5489         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
5490                 params.plink_state =
5491                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
5492                 if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
5493                         params.peer_aid = nla_get_u16(
5494                                 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
5495                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
5496         }
5497
5498         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
5499                 params.local_pm = nla_get_u32(
5500                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
5501
5502         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5503                 params.opmode_notif_used = true;
5504                 params.opmode_notif =
5505                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5506         }
5507
5508         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
5509                 params.airtime_weight =
5510                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
5511
5512         if (params.airtime_weight &&
5513             !wiphy_ext_feature_isset(&rdev->wiphy,
5514                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
5515                 return -EOPNOTSUPP;
5516
5517         /* Include parameters for TDLS peer (will check later) */
5518         err = nl80211_set_station_tdls(info, &params);
5519         if (err)
5520                 return err;
5521
5522         params.vlan = get_vlan(info, rdev);
5523         if (IS_ERR(params.vlan))
5524                 return PTR_ERR(params.vlan);
5525
5526         switch (dev->ieee80211_ptr->iftype) {
5527         case NL80211_IFTYPE_AP:
5528         case NL80211_IFTYPE_AP_VLAN:
5529         case NL80211_IFTYPE_P2P_GO:
5530         case NL80211_IFTYPE_P2P_CLIENT:
5531         case NL80211_IFTYPE_STATION:
5532         case NL80211_IFTYPE_ADHOC:
5533         case NL80211_IFTYPE_MESH_POINT:
5534                 break;
5535         default:
5536                 err = -EOPNOTSUPP;
5537                 goto out_put_vlan;
5538         }
5539
5540         /* driver will call cfg80211_check_station_change() */
5541         err = rdev_change_station(rdev, dev, mac_addr, &params);
5542
5543  out_put_vlan:
5544         if (params.vlan)
5545                 dev_put(params.vlan);
5546
5547         return err;
5548 }
5549
5550 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
5551 {
5552         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5553         int err;
5554         struct net_device *dev = info->user_ptr[1];
5555         struct station_parameters params;
5556         u8 *mac_addr = NULL;
5557         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5558                          BIT(NL80211_STA_FLAG_ASSOCIATED);
5559
5560         memset(&params, 0, sizeof(params));
5561
5562         if (!rdev->ops->add_station)
5563                 return -EOPNOTSUPP;
5564
5565         if (!info->attrs[NL80211_ATTR_MAC])
5566                 return -EINVAL;
5567
5568         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5569                 return -EINVAL;
5570
5571         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
5572                 return -EINVAL;
5573
5574         if (!info->attrs[NL80211_ATTR_STA_AID] &&
5575             !info->attrs[NL80211_ATTR_PEER_AID])
5576                 return -EINVAL;
5577
5578         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5579         params.supported_rates =
5580                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5581         params.supported_rates_len =
5582                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5583         params.listen_interval =
5584                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5585
5586         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
5587                 params.support_p2p_ps =
5588                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5589         } else {
5590                 /*
5591                  * if not specified, assume it's supported for P2P GO interface,
5592                  * and is NOT supported for AP interface
5593                  */
5594                 params.support_p2p_ps =
5595                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
5596         }
5597
5598         if (info->attrs[NL80211_ATTR_PEER_AID])
5599                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5600         else
5601                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5602
5603         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5604                 params.capability =
5605                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5606                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5607         }
5608
5609         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5610                 params.ext_capab =
5611                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5612                 params.ext_capab_len =
5613                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5614         }
5615
5616         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5617                 params.ht_capa =
5618                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5619
5620         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5621                 params.vht_capa =
5622                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5623
5624         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
5625                 params.he_capa =
5626                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5627                 params.he_capa_len =
5628                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5629
5630                 /* max len is validated in nla policy */
5631                 if (params.he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN)
5632                         return -EINVAL;
5633         }
5634
5635         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5636                 params.opmode_notif_used = true;
5637                 params.opmode_notif =
5638                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5639         }
5640
5641         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
5642                 params.plink_action =
5643                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5644
5645         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
5646                 params.airtime_weight =
5647                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
5648
5649         if (params.airtime_weight &&
5650             !wiphy_ext_feature_isset(&rdev->wiphy,
5651                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
5652                 return -EOPNOTSUPP;
5653
5654         err = nl80211_parse_sta_channel_info(info, &params);
5655         if (err)
5656                 return err;
5657
5658         err = nl80211_parse_sta_wme(info, &params);
5659         if (err)
5660                 return err;
5661
5662         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5663                 return -EINVAL;
5664
5665         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
5666          * as userspace might just pass through the capabilities from the IEs
5667          * directly, rather than enforcing this restriction and returning an
5668          * error in this case.
5669          */
5670         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
5671                 params.ht_capa = NULL;
5672                 params.vht_capa = NULL;
5673
5674                 /* HE requires WME */
5675                 if (params.he_capa_len)
5676                         return -EINVAL;
5677         }
5678
5679         /* When you run into this, adjust the code below for the new flag */
5680         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
5681
5682         switch (dev->ieee80211_ptr->iftype) {
5683         case NL80211_IFTYPE_AP:
5684         case NL80211_IFTYPE_AP_VLAN:
5685         case NL80211_IFTYPE_P2P_GO:
5686                 /* ignore WME attributes if iface/sta is not capable */
5687                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
5688                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
5689                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5690
5691                 /* TDLS peers cannot be added */
5692                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5693                     info->attrs[NL80211_ATTR_PEER_AID])
5694                         return -EINVAL;
5695                 /* but don't bother the driver with it */
5696                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5697
5698                 /* allow authenticated/associated only if driver handles it */
5699                 if (!(rdev->wiphy.features &
5700                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5701                     params.sta_flags_mask & auth_assoc)
5702                         return -EINVAL;
5703
5704                 /* Older userspace, or userspace wanting to be compatible with
5705                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
5706                  * and assoc flags in the mask, but assumes the station will be
5707                  * added as associated anyway since this was the required driver
5708                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
5709                  * introduced.
5710                  * In order to not bother drivers with this quirk in the API
5711                  * set the flags in both the mask and set for new stations in
5712                  * this case.
5713                  */
5714                 if (!(params.sta_flags_mask & auth_assoc)) {
5715                         params.sta_flags_mask |= auth_assoc;
5716                         params.sta_flags_set |= auth_assoc;
5717                 }
5718
5719                 /* must be last in here for error handling */
5720                 params.vlan = get_vlan(info, rdev);
5721                 if (IS_ERR(params.vlan))
5722                         return PTR_ERR(params.vlan);
5723                 break;
5724         case NL80211_IFTYPE_MESH_POINT:
5725                 /* ignore uAPSD data */
5726                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5727
5728                 /* associated is disallowed */
5729                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
5730                         return -EINVAL;
5731                 /* TDLS peers cannot be added */
5732                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5733                     info->attrs[NL80211_ATTR_PEER_AID])
5734                         return -EINVAL;
5735                 break;
5736         case NL80211_IFTYPE_STATION:
5737         case NL80211_IFTYPE_P2P_CLIENT:
5738                 /* ignore uAPSD data */
5739                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5740
5741                 /* these are disallowed */
5742                 if (params.sta_flags_mask &
5743                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
5744                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
5745                         return -EINVAL;
5746                 /* Only TDLS peers can be added */
5747                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
5748                         return -EINVAL;
5749                 /* Can only add if TDLS ... */
5750                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
5751                         return -EOPNOTSUPP;
5752                 /* ... with external setup is supported */
5753                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
5754                         return -EOPNOTSUPP;
5755                 /*
5756                  * Older wpa_supplicant versions always mark the TDLS peer
5757                  * as authorized, but it shouldn't yet be.
5758                  */
5759                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
5760                 break;
5761         default:
5762                 return -EOPNOTSUPP;
5763         }
5764
5765         /* be aware of params.vlan when changing code here */
5766
5767         err = rdev_add_station(rdev, dev, mac_addr, &params);
5768
5769         if (params.vlan)
5770                 dev_put(params.vlan);
5771         return err;
5772 }
5773
5774 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
5775 {
5776         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5777         struct net_device *dev = info->user_ptr[1];
5778         struct station_del_parameters params;
5779
5780         memset(&params, 0, sizeof(params));
5781
5782         if (info->attrs[NL80211_ATTR_MAC])
5783                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
5784
5785         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5786             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5787             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5788             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5789                 return -EINVAL;
5790
5791         if (!rdev->ops->del_station)
5792                 return -EOPNOTSUPP;
5793
5794         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
5795                 params.subtype =
5796                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
5797                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
5798                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
5799                         return -EINVAL;
5800         } else {
5801                 /* Default to Deauthentication frame */
5802                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
5803         }
5804
5805         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
5806                 params.reason_code =
5807                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5808                 if (params.reason_code == 0)
5809                         return -EINVAL; /* 0 is reserved */
5810         } else {
5811                 /* Default to reason code 2 */
5812                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
5813         }
5814
5815         return rdev_del_station(rdev, dev, &params);
5816 }
5817
5818 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
5819                                 int flags, struct net_device *dev,
5820                                 u8 *dst, u8 *next_hop,
5821                                 struct mpath_info *pinfo)
5822 {
5823         void *hdr;
5824         struct nlattr *pinfoattr;
5825
5826         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
5827         if (!hdr)
5828                 return -1;
5829
5830         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5831             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
5832             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
5833             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
5834                 goto nla_put_failure;
5835
5836         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
5837         if (!pinfoattr)
5838                 goto nla_put_failure;
5839         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
5840             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
5841                         pinfo->frame_qlen))
5842                 goto nla_put_failure;
5843         if (((pinfo->filled & MPATH_INFO_SN) &&
5844              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
5845             ((pinfo->filled & MPATH_INFO_METRIC) &&
5846              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
5847                          pinfo->metric)) ||
5848             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
5849              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
5850                          pinfo->exptime)) ||
5851             ((pinfo->filled & MPATH_INFO_FLAGS) &&
5852              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
5853                         pinfo->flags)) ||
5854             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
5855              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
5856                          pinfo->discovery_timeout)) ||
5857             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
5858              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
5859                         pinfo->discovery_retries)) ||
5860             ((pinfo->filled & MPATH_INFO_HOP_COUNT) &&
5861              nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT,
5862                         pinfo->hop_count)) ||
5863             ((pinfo->filled & MPATH_INFO_PATH_CHANGE) &&
5864              nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE,
5865                          pinfo->path_change_count)))
5866                 goto nla_put_failure;
5867
5868         nla_nest_end(msg, pinfoattr);
5869
5870         genlmsg_end(msg, hdr);
5871         return 0;
5872
5873  nla_put_failure:
5874         genlmsg_cancel(msg, hdr);
5875         return -EMSGSIZE;
5876 }
5877
5878 static int nl80211_dump_mpath(struct sk_buff *skb,
5879                               struct netlink_callback *cb)
5880 {
5881         struct mpath_info pinfo;
5882         struct cfg80211_registered_device *rdev;
5883         struct wireless_dev *wdev;
5884         u8 dst[ETH_ALEN];
5885         u8 next_hop[ETH_ALEN];
5886         int path_idx = cb->args[2];
5887         int err;
5888
5889         rtnl_lock();
5890         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
5891         if (err)
5892                 goto out_err;
5893
5894         if (!rdev->ops->dump_mpath) {
5895                 err = -EOPNOTSUPP;
5896                 goto out_err;
5897         }
5898
5899         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5900                 err = -EOPNOTSUPP;
5901                 goto out_err;
5902         }
5903
5904         while (1) {
5905                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
5906                                       next_hop, &pinfo);
5907                 if (err == -ENOENT)
5908                         break;
5909                 if (err)
5910                         goto out_err;
5911
5912                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5913                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
5914                                        wdev->netdev, dst, next_hop,
5915                                        &pinfo) < 0)
5916                         goto out;
5917
5918                 path_idx++;
5919         }
5920
5921  out:
5922         cb->args[2] = path_idx;
5923         err = skb->len;
5924  out_err:
5925         rtnl_unlock();
5926         return err;
5927 }
5928
5929 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
5930 {
5931         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5932         int err;
5933         struct net_device *dev = info->user_ptr[1];
5934         struct mpath_info pinfo;
5935         struct sk_buff *msg;
5936         u8 *dst = NULL;
5937         u8 next_hop[ETH_ALEN];
5938
5939         memset(&pinfo, 0, sizeof(pinfo));
5940
5941         if (!info->attrs[NL80211_ATTR_MAC])
5942                 return -EINVAL;
5943
5944         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5945
5946         if (!rdev->ops->get_mpath)
5947                 return -EOPNOTSUPP;
5948
5949         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5950                 return -EOPNOTSUPP;
5951
5952         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
5953         if (err)
5954                 return err;
5955
5956         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5957         if (!msg)
5958                 return -ENOMEM;
5959
5960         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5961                                  dev, dst, next_hop, &pinfo) < 0) {
5962                 nlmsg_free(msg);
5963                 return -ENOBUFS;
5964         }
5965
5966         return genlmsg_reply(msg, info);
5967 }
5968
5969 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
5970 {
5971         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5972         struct net_device *dev = info->user_ptr[1];
5973         u8 *dst = NULL;
5974         u8 *next_hop = NULL;
5975
5976         if (!info->attrs[NL80211_ATTR_MAC])
5977                 return -EINVAL;
5978
5979         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5980                 return -EINVAL;
5981
5982         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5983         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5984
5985         if (!rdev->ops->change_mpath)
5986                 return -EOPNOTSUPP;
5987
5988         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5989                 return -EOPNOTSUPP;
5990
5991         return rdev_change_mpath(rdev, dev, dst, next_hop);
5992 }
5993
5994 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
5995 {
5996         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5997         struct net_device *dev = info->user_ptr[1];
5998         u8 *dst = NULL;
5999         u8 *next_hop = NULL;
6000
6001         if (!info->attrs[NL80211_ATTR_MAC])
6002                 return -EINVAL;
6003
6004         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
6005                 return -EINVAL;
6006
6007         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6008         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
6009
6010         if (!rdev->ops->add_mpath)
6011                 return -EOPNOTSUPP;
6012
6013         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6014                 return -EOPNOTSUPP;
6015
6016         return rdev_add_mpath(rdev, dev, dst, next_hop);
6017 }
6018
6019 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
6020 {
6021         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6022         struct net_device *dev = info->user_ptr[1];
6023         u8 *dst = NULL;
6024
6025         if (info->attrs[NL80211_ATTR_MAC])
6026                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6027
6028         if (!rdev->ops->del_mpath)
6029                 return -EOPNOTSUPP;
6030
6031         return rdev_del_mpath(rdev, dev, dst);
6032 }
6033
6034 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
6035 {
6036         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6037         int err;
6038         struct net_device *dev = info->user_ptr[1];
6039         struct mpath_info pinfo;
6040         struct sk_buff *msg;
6041         u8 *dst = NULL;
6042         u8 mpp[ETH_ALEN];
6043
6044         memset(&pinfo, 0, sizeof(pinfo));
6045
6046         if (!info->attrs[NL80211_ATTR_MAC])
6047                 return -EINVAL;
6048
6049         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6050
6051         if (!rdev->ops->get_mpp)
6052                 return -EOPNOTSUPP;
6053
6054         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6055                 return -EOPNOTSUPP;
6056
6057         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
6058         if (err)
6059                 return err;
6060
6061         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6062         if (!msg)
6063                 return -ENOMEM;
6064
6065         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
6066                                dev, dst, mpp, &pinfo) < 0) {
6067                 nlmsg_free(msg);
6068                 return -ENOBUFS;
6069         }
6070
6071         return genlmsg_reply(msg, info);
6072 }
6073
6074 static int nl80211_dump_mpp(struct sk_buff *skb,
6075                             struct netlink_callback *cb)
6076 {
6077         struct mpath_info pinfo;
6078         struct cfg80211_registered_device *rdev;
6079         struct wireless_dev *wdev;
6080         u8 dst[ETH_ALEN];
6081         u8 mpp[ETH_ALEN];
6082         int path_idx = cb->args[2];
6083         int err;
6084
6085         rtnl_lock();
6086         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
6087         if (err)
6088                 goto out_err;
6089
6090         if (!rdev->ops->dump_mpp) {
6091                 err = -EOPNOTSUPP;
6092                 goto out_err;
6093         }
6094
6095         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
6096                 err = -EOPNOTSUPP;
6097                 goto out_err;
6098         }
6099
6100         while (1) {
6101                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
6102                                     mpp, &pinfo);
6103                 if (err == -ENOENT)
6104                         break;
6105                 if (err)
6106                         goto out_err;
6107
6108                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
6109                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
6110                                        wdev->netdev, dst, mpp,
6111                                        &pinfo) < 0)
6112                         goto out;
6113
6114                 path_idx++;
6115         }
6116
6117  out:
6118         cb->args[2] = path_idx;
6119         err = skb->len;
6120  out_err:
6121         rtnl_unlock();
6122         return err;
6123 }
6124
6125 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
6126 {
6127         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6128         struct net_device *dev = info->user_ptr[1];
6129         struct wireless_dev *wdev = dev->ieee80211_ptr;
6130         struct bss_parameters params;
6131         int err;
6132
6133         memset(&params, 0, sizeof(params));
6134         /* default to not changing parameters */
6135         params.use_cts_prot = -1;
6136         params.use_short_preamble = -1;
6137         params.use_short_slot_time = -1;
6138         params.ap_isolate = -1;
6139         params.ht_opmode = -1;
6140         params.p2p_ctwindow = -1;
6141         params.p2p_opp_ps = -1;
6142
6143         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
6144                 params.use_cts_prot =
6145                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
6146         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
6147                 params.use_short_preamble =
6148                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
6149         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
6150                 params.use_short_slot_time =
6151                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
6152         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6153                 params.basic_rates =
6154                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6155                 params.basic_rates_len =
6156                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6157         }
6158         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
6159                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
6160         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
6161                 params.ht_opmode =
6162                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
6163
6164         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
6165                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6166                         return -EINVAL;
6167                 params.p2p_ctwindow =
6168                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
6169                 if (params.p2p_ctwindow != 0 &&
6170                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
6171                         return -EINVAL;
6172         }
6173
6174         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
6175                 u8 tmp;
6176
6177                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6178                         return -EINVAL;
6179                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
6180                 params.p2p_opp_ps = tmp;
6181                 if (params.p2p_opp_ps &&
6182                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
6183                         return -EINVAL;
6184         }
6185
6186         if (!rdev->ops->change_bss)
6187                 return -EOPNOTSUPP;
6188
6189         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6190             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6191                 return -EOPNOTSUPP;
6192
6193         wdev_lock(wdev);
6194         err = rdev_change_bss(rdev, dev, &params);
6195         wdev_unlock(wdev);
6196
6197         return err;
6198 }
6199
6200 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
6201 {
6202         char *data = NULL;
6203         bool is_indoor;
6204         enum nl80211_user_reg_hint_type user_reg_hint_type;
6205         u32 owner_nlportid;
6206
6207         /*
6208          * You should only get this when cfg80211 hasn't yet initialized
6209          * completely when built-in to the kernel right between the time
6210          * window between nl80211_init() and regulatory_init(), if that is
6211          * even possible.
6212          */
6213         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
6214                 return -EINPROGRESS;
6215
6216         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
6217                 user_reg_hint_type =
6218                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
6219         else
6220                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
6221
6222         switch (user_reg_hint_type) {
6223         case NL80211_USER_REG_HINT_USER:
6224         case NL80211_USER_REG_HINT_CELL_BASE:
6225                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6226                         return -EINVAL;
6227
6228                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6229                 return regulatory_hint_user(data, user_reg_hint_type);
6230         case NL80211_USER_REG_HINT_INDOOR:
6231                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
6232                         owner_nlportid = info->snd_portid;
6233                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
6234                 } else {
6235                         owner_nlportid = 0;
6236                         is_indoor = true;
6237                 }
6238
6239                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
6240         default:
6241                 return -EINVAL;
6242         }
6243 }
6244
6245 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
6246 {
6247         return reg_reload_regdb();
6248 }
6249
6250 static int nl80211_get_mesh_config(struct sk_buff *skb,
6251                                    struct genl_info *info)
6252 {
6253         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6254         struct net_device *dev = info->user_ptr[1];
6255         struct wireless_dev *wdev = dev->ieee80211_ptr;
6256         struct mesh_config cur_params;
6257         int err = 0;
6258         void *hdr;
6259         struct nlattr *pinfoattr;
6260         struct sk_buff *msg;
6261
6262         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6263                 return -EOPNOTSUPP;
6264
6265         if (!rdev->ops->get_mesh_config)
6266                 return -EOPNOTSUPP;
6267
6268         wdev_lock(wdev);
6269         /* If not connected, get default parameters */
6270         if (!wdev->mesh_id_len)
6271                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
6272         else
6273                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
6274         wdev_unlock(wdev);
6275
6276         if (err)
6277                 return err;
6278
6279         /* Draw up a netlink message to send back */
6280         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6281         if (!msg)
6282                 return -ENOMEM;
6283         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6284                              NL80211_CMD_GET_MESH_CONFIG);
6285         if (!hdr)
6286                 goto out;
6287         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
6288         if (!pinfoattr)
6289                 goto nla_put_failure;
6290         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6291             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
6292                         cur_params.dot11MeshRetryTimeout) ||
6293             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
6294                         cur_params.dot11MeshConfirmTimeout) ||
6295             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
6296                         cur_params.dot11MeshHoldingTimeout) ||
6297             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
6298                         cur_params.dot11MeshMaxPeerLinks) ||
6299             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
6300                        cur_params.dot11MeshMaxRetries) ||
6301             nla_put_u8(msg, NL80211_MESHCONF_TTL,
6302                        cur_params.dot11MeshTTL) ||
6303             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
6304                        cur_params.element_ttl) ||
6305             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
6306                        cur_params.auto_open_plinks) ||
6307             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
6308                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
6309             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
6310                        cur_params.dot11MeshHWMPmaxPREQretries) ||
6311             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
6312                         cur_params.path_refresh_time) ||
6313             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
6314                         cur_params.min_discovery_timeout) ||
6315             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
6316                         cur_params.dot11MeshHWMPactivePathTimeout) ||
6317             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
6318                         cur_params.dot11MeshHWMPpreqMinInterval) ||
6319             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
6320                         cur_params.dot11MeshHWMPperrMinInterval) ||
6321             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
6322                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
6323             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
6324                        cur_params.dot11MeshHWMPRootMode) ||
6325             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
6326                         cur_params.dot11MeshHWMPRannInterval) ||
6327             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
6328                        cur_params.dot11MeshGateAnnouncementProtocol) ||
6329             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
6330                        cur_params.dot11MeshForwarding) ||
6331             nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
6332                         cur_params.rssi_threshold) ||
6333             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
6334                         cur_params.ht_opmode) ||
6335             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6336                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
6337             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6338                         cur_params.dot11MeshHWMProotInterval) ||
6339             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6340                         cur_params.dot11MeshHWMPconfirmationInterval) ||
6341             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
6342                         cur_params.power_mode) ||
6343             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
6344                         cur_params.dot11MeshAwakeWindowDuration) ||
6345             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
6346                         cur_params.plink_timeout) ||
6347             nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE,
6348                        cur_params.dot11MeshConnectedToMeshGate))
6349                 goto nla_put_failure;
6350         nla_nest_end(msg, pinfoattr);
6351         genlmsg_end(msg, hdr);
6352         return genlmsg_reply(msg, info);
6353
6354  nla_put_failure:
6355  out:
6356         nlmsg_free(msg);
6357         return -ENOBUFS;
6358 }
6359
6360 static const struct nla_policy
6361 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
6362         [NL80211_MESHCONF_RETRY_TIMEOUT] =
6363                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
6364         [NL80211_MESHCONF_CONFIRM_TIMEOUT] =
6365                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
6366         [NL80211_MESHCONF_HOLDING_TIMEOUT] =
6367                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
6368         [NL80211_MESHCONF_MAX_PEER_LINKS] =
6369                 NLA_POLICY_RANGE(NLA_U16, 0, 255),
6370         [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
6371         [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
6372         [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
6373         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
6374         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
6375                 NLA_POLICY_RANGE(NLA_U32, 1, 255),
6376         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
6377         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
6378         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
6379         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
6380         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
6381                 NLA_POLICY_MIN(NLA_U16, 1),
6382         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
6383                 NLA_POLICY_MIN(NLA_U16, 1),
6384         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
6385                 NLA_POLICY_MIN(NLA_U16, 1),
6386         [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
6387         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
6388                 NLA_POLICY_MIN(NLA_U16, 1),
6389         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
6390         [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
6391         [NL80211_MESHCONF_RSSI_THRESHOLD] =
6392                 NLA_POLICY_RANGE(NLA_S32, -255, 0),
6393         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
6394         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
6395         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
6396                 NLA_POLICY_MIN(NLA_U16, 1),
6397         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
6398                 NLA_POLICY_MIN(NLA_U16, 1),
6399         [NL80211_MESHCONF_POWER_MODE] =
6400                 NLA_POLICY_RANGE(NLA_U32,
6401                                  NL80211_MESH_POWER_ACTIVE,
6402                                  NL80211_MESH_POWER_MAX),
6403         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
6404         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
6405         [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
6406 };
6407
6408 static const struct nla_policy
6409         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
6410         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
6411         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
6412         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
6413         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
6414         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
6415         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
6416         [NL80211_MESH_SETUP_IE] =
6417                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
6418                                        IEEE80211_MAX_DATA_LEN),
6419         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
6420 };
6421
6422 static int nl80211_parse_mesh_config(struct genl_info *info,
6423                                      struct mesh_config *cfg,
6424                                      u32 *mask_out)
6425 {
6426         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
6427         u32 mask = 0;
6428         u16 ht_opmode;
6429
6430 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn)       \
6431 do {                                                                    \
6432         if (tb[attr]) {                                                 \
6433                 cfg->param = fn(tb[attr]);                              \
6434                 mask |= BIT((attr) - 1);                                \
6435         }                                                               \
6436 } while (0)
6437
6438         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
6439                 return -EINVAL;
6440         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
6441                              info->attrs[NL80211_ATTR_MESH_CONFIG],
6442                              nl80211_meshconf_params_policy, info->extack))
6443                 return -EINVAL;
6444
6445         /* This makes sure that there aren't more than 32 mesh config
6446          * parameters (otherwise our bitfield scheme would not work.) */
6447         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
6448
6449         /* Fill in the params struct */
6450         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
6451                                   NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
6452         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
6453                                   NL80211_MESHCONF_CONFIRM_TIMEOUT,
6454                                   nla_get_u16);
6455         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
6456                                   NL80211_MESHCONF_HOLDING_TIMEOUT,
6457                                   nla_get_u16);
6458         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
6459                                   NL80211_MESHCONF_MAX_PEER_LINKS,
6460                                   nla_get_u16);
6461         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
6462                                   NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
6463         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
6464                                   NL80211_MESHCONF_TTL, nla_get_u8);
6465         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
6466                                   NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
6467         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
6468                                   NL80211_MESHCONF_AUTO_OPEN_PLINKS,
6469                                   nla_get_u8);
6470         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
6471                                   mask,
6472                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
6473                                   nla_get_u32);
6474         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
6475                                   NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
6476                                   nla_get_u8);
6477         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
6478                                   NL80211_MESHCONF_PATH_REFRESH_TIME,
6479                                   nla_get_u32);
6480         if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
6481             (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
6482                 return -EINVAL;
6483         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
6484                                   NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
6485                                   nla_get_u16);
6486         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
6487                                   mask,
6488                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
6489                                   nla_get_u32);
6490         if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
6491             (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
6492              cfg->dot11MeshHWMPactivePathTimeout > 65535))
6493                 return -EINVAL;
6494         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
6495                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
6496                                   nla_get_u16);
6497         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
6498                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
6499                                   nla_get_u16);
6500         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6501                                   dot11MeshHWMPnetDiameterTraversalTime, mask,
6502                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
6503                                   nla_get_u16);
6504         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
6505                                   NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
6506         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
6507                                   NL80211_MESHCONF_HWMP_RANN_INTERVAL,
6508                                   nla_get_u16);
6509         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
6510                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
6511                                   nla_get_u8);
6512         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
6513                                   NL80211_MESHCONF_FORWARDING, nla_get_u8);
6514         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
6515                                   NL80211_MESHCONF_RSSI_THRESHOLD,
6516                                   nla_get_s32);
6517         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask,
6518                                   NL80211_MESHCONF_CONNECTED_TO_GATE,
6519                                   nla_get_u8);
6520         /*
6521          * Check HT operation mode based on
6522          * IEEE 802.11-2016 9.4.2.57 HT Operation element.
6523          */
6524         if (tb[NL80211_MESHCONF_HT_OPMODE]) {
6525                 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
6526
6527                 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
6528                                   IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
6529                                   IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
6530                         return -EINVAL;
6531
6532                 /* NON_HT_STA bit is reserved, but some programs set it */
6533                 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
6534
6535                 cfg->ht_opmode = ht_opmode;
6536                 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
6537         }
6538         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6539                                   dot11MeshHWMPactivePathToRootTimeout, mask,
6540                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6541                                   nla_get_u32);
6542         if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
6543             (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
6544              cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
6545                 return -EINVAL;
6546         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
6547                                   NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6548                                   nla_get_u16);
6549         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
6550                                   mask,
6551                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6552                                   nla_get_u16);
6553         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
6554                                   NL80211_MESHCONF_POWER_MODE, nla_get_u32);
6555         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
6556                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
6557         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
6558                                   NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
6559         if (mask_out)
6560                 *mask_out = mask;
6561
6562         return 0;
6563
6564 #undef FILL_IN_MESH_PARAM_IF_SET
6565 }
6566
6567 static int nl80211_parse_mesh_setup(struct genl_info *info,
6568                                      struct mesh_setup *setup)
6569 {
6570         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6571         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
6572
6573         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
6574                 return -EINVAL;
6575         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
6576                              info->attrs[NL80211_ATTR_MESH_SETUP],
6577                              nl80211_mesh_setup_params_policy, info->extack))
6578                 return -EINVAL;
6579
6580         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
6581                 setup->sync_method =
6582                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
6583                  IEEE80211_SYNC_METHOD_VENDOR :
6584                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
6585
6586         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
6587                 setup->path_sel_proto =
6588                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
6589                  IEEE80211_PATH_PROTOCOL_VENDOR :
6590                  IEEE80211_PATH_PROTOCOL_HWMP;
6591
6592         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
6593                 setup->path_metric =
6594                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
6595                  IEEE80211_PATH_METRIC_VENDOR :
6596                  IEEE80211_PATH_METRIC_AIRTIME;
6597
6598         if (tb[NL80211_MESH_SETUP_IE]) {
6599                 struct nlattr *ieattr =
6600                         tb[NL80211_MESH_SETUP_IE];
6601                 setup->ie = nla_data(ieattr);
6602                 setup->ie_len = nla_len(ieattr);
6603         }
6604         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
6605             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
6606                 return -EINVAL;
6607         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
6608         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
6609         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
6610         if (setup->is_secure)
6611                 setup->user_mpm = true;
6612
6613         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
6614                 if (!setup->user_mpm)
6615                         return -EINVAL;
6616                 setup->auth_id =
6617                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
6618         }
6619
6620         return 0;
6621 }
6622
6623 static int nl80211_update_mesh_config(struct sk_buff *skb,
6624                                       struct genl_info *info)
6625 {
6626         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6627         struct net_device *dev = info->user_ptr[1];
6628         struct wireless_dev *wdev = dev->ieee80211_ptr;
6629         struct mesh_config cfg;
6630         u32 mask;
6631         int err;
6632
6633         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6634                 return -EOPNOTSUPP;
6635
6636         if (!rdev->ops->update_mesh_config)
6637                 return -EOPNOTSUPP;
6638
6639         err = nl80211_parse_mesh_config(info, &cfg, &mask);
6640         if (err)
6641                 return err;
6642
6643         wdev_lock(wdev);
6644         if (!wdev->mesh_id_len)
6645                 err = -ENOLINK;
6646
6647         if (!err)
6648                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
6649
6650         wdev_unlock(wdev);
6651
6652         return err;
6653 }
6654
6655 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
6656                               struct sk_buff *msg)
6657 {
6658         struct nlattr *nl_reg_rules;
6659         unsigned int i;
6660
6661         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
6662             (regdom->dfs_region &&
6663              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
6664                 goto nla_put_failure;
6665
6666         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
6667         if (!nl_reg_rules)
6668                 goto nla_put_failure;
6669
6670         for (i = 0; i < regdom->n_reg_rules; i++) {
6671                 struct nlattr *nl_reg_rule;
6672                 const struct ieee80211_reg_rule *reg_rule;
6673                 const struct ieee80211_freq_range *freq_range;
6674                 const struct ieee80211_power_rule *power_rule;
6675                 unsigned int max_bandwidth_khz;
6676
6677                 reg_rule = &regdom->reg_rules[i];
6678                 freq_range = &reg_rule->freq_range;
6679                 power_rule = &reg_rule->power_rule;
6680
6681                 nl_reg_rule = nla_nest_start(msg, i);
6682                 if (!nl_reg_rule)
6683                         goto nla_put_failure;
6684
6685                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
6686                 if (!max_bandwidth_khz)
6687                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
6688                                                                   reg_rule);
6689
6690                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
6691                                 reg_rule->flags) ||
6692                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
6693                                 freq_range->start_freq_khz) ||
6694                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
6695                                 freq_range->end_freq_khz) ||
6696                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
6697                                 max_bandwidth_khz) ||
6698                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
6699                                 power_rule->max_antenna_gain) ||
6700                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
6701                                 power_rule->max_eirp) ||
6702                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
6703                                 reg_rule->dfs_cac_ms))
6704                         goto nla_put_failure;
6705
6706                 nla_nest_end(msg, nl_reg_rule);
6707         }
6708
6709         nla_nest_end(msg, nl_reg_rules);
6710         return 0;
6711
6712 nla_put_failure:
6713         return -EMSGSIZE;
6714 }
6715
6716 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
6717 {
6718         const struct ieee80211_regdomain *regdom = NULL;
6719         struct cfg80211_registered_device *rdev;
6720         struct wiphy *wiphy = NULL;
6721         struct sk_buff *msg;
6722         void *hdr;
6723
6724         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6725         if (!msg)
6726                 return -ENOBUFS;
6727
6728         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6729                              NL80211_CMD_GET_REG);
6730         if (!hdr)
6731                 goto put_failure;
6732
6733         if (info->attrs[NL80211_ATTR_WIPHY]) {
6734                 bool self_managed;
6735
6736                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
6737                 if (IS_ERR(rdev)) {
6738                         nlmsg_free(msg);
6739                         return PTR_ERR(rdev);
6740                 }
6741
6742                 wiphy = &rdev->wiphy;
6743                 self_managed = wiphy->regulatory_flags &
6744                                REGULATORY_WIPHY_SELF_MANAGED;
6745                 regdom = get_wiphy_regdom(wiphy);
6746
6747                 /* a self-managed-reg device must have a private regdom */
6748                 if (WARN_ON(!regdom && self_managed)) {
6749                         nlmsg_free(msg);
6750                         return -EINVAL;
6751                 }
6752
6753                 if (regdom &&
6754                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6755                         goto nla_put_failure;
6756         }
6757
6758         if (!wiphy && reg_last_request_cell_base() &&
6759             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6760                         NL80211_USER_REG_HINT_CELL_BASE))
6761                 goto nla_put_failure;
6762
6763         rcu_read_lock();
6764
6765         if (!regdom)
6766                 regdom = rcu_dereference(cfg80211_regdomain);
6767
6768         if (nl80211_put_regdom(regdom, msg))
6769                 goto nla_put_failure_rcu;
6770
6771         rcu_read_unlock();
6772
6773         genlmsg_end(msg, hdr);
6774         return genlmsg_reply(msg, info);
6775
6776 nla_put_failure_rcu:
6777         rcu_read_unlock();
6778 nla_put_failure:
6779 put_failure:
6780         nlmsg_free(msg);
6781         return -EMSGSIZE;
6782 }
6783
6784 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
6785                                u32 seq, int flags, struct wiphy *wiphy,
6786                                const struct ieee80211_regdomain *regdom)
6787 {
6788         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6789                                    NL80211_CMD_GET_REG);
6790
6791         if (!hdr)
6792                 return -1;
6793
6794         genl_dump_check_consistent(cb, hdr);
6795
6796         if (nl80211_put_regdom(regdom, msg))
6797                 goto nla_put_failure;
6798
6799         if (!wiphy && reg_last_request_cell_base() &&
6800             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6801                         NL80211_USER_REG_HINT_CELL_BASE))
6802                 goto nla_put_failure;
6803
6804         if (wiphy &&
6805             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6806                 goto nla_put_failure;
6807
6808         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
6809             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
6810                 goto nla_put_failure;
6811
6812         genlmsg_end(msg, hdr);
6813         return 0;
6814
6815 nla_put_failure:
6816         genlmsg_cancel(msg, hdr);
6817         return -EMSGSIZE;
6818 }
6819
6820 static int nl80211_get_reg_dump(struct sk_buff *skb,
6821                                 struct netlink_callback *cb)
6822 {
6823         const struct ieee80211_regdomain *regdom = NULL;
6824         struct cfg80211_registered_device *rdev;
6825         int err, reg_idx, start = cb->args[2];
6826
6827         rtnl_lock();
6828
6829         if (cfg80211_regdomain && start == 0) {
6830                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6831                                           NLM_F_MULTI, NULL,
6832                                           rtnl_dereference(cfg80211_regdomain));
6833                 if (err < 0)
6834                         goto out_err;
6835         }
6836
6837         /* the global regdom is idx 0 */
6838         reg_idx = 1;
6839         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
6840                 regdom = get_wiphy_regdom(&rdev->wiphy);
6841                 if (!regdom)
6842                         continue;
6843
6844                 if (++reg_idx <= start)
6845                         continue;
6846
6847                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6848                                           NLM_F_MULTI, &rdev->wiphy, regdom);
6849                 if (err < 0) {
6850                         reg_idx--;
6851                         break;
6852                 }
6853         }
6854
6855         cb->args[2] = reg_idx;
6856         err = skb->len;
6857 out_err:
6858         rtnl_unlock();
6859         return err;
6860 }
6861
6862 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
6863 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
6864         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
6865         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
6866         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
6867         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
6868         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
6869         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
6870         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
6871 };
6872
6873 static int parse_reg_rule(struct nlattr *tb[],
6874         struct ieee80211_reg_rule *reg_rule)
6875 {
6876         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
6877         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
6878
6879         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
6880                 return -EINVAL;
6881         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
6882                 return -EINVAL;
6883         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
6884                 return -EINVAL;
6885         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
6886                 return -EINVAL;
6887         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
6888                 return -EINVAL;
6889
6890         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
6891
6892         freq_range->start_freq_khz =
6893                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
6894         freq_range->end_freq_khz =
6895                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
6896         freq_range->max_bandwidth_khz =
6897                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
6898
6899         power_rule->max_eirp =
6900                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
6901
6902         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
6903                 power_rule->max_antenna_gain =
6904                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
6905
6906         if (tb[NL80211_ATTR_DFS_CAC_TIME])
6907                 reg_rule->dfs_cac_ms =
6908                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
6909
6910         return 0;
6911 }
6912
6913 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
6914 {
6915         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
6916         struct nlattr *nl_reg_rule;
6917         char *alpha2;
6918         int rem_reg_rules, r;
6919         u32 num_rules = 0, rule_idx = 0, size_of_regd;
6920         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
6921         struct ieee80211_regdomain *rd;
6922
6923         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6924                 return -EINVAL;
6925
6926         if (!info->attrs[NL80211_ATTR_REG_RULES])
6927                 return -EINVAL;
6928
6929         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6930
6931         if (info->attrs[NL80211_ATTR_DFS_REGION])
6932                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
6933
6934         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6935                             rem_reg_rules) {
6936                 num_rules++;
6937                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
6938                         return -EINVAL;
6939         }
6940
6941         if (!reg_is_valid_request(alpha2))
6942                 return -EINVAL;
6943
6944         size_of_regd = sizeof(struct ieee80211_regdomain) +
6945                        num_rules * sizeof(struct ieee80211_reg_rule);
6946
6947         rd = kzalloc(size_of_regd, GFP_KERNEL);
6948         if (!rd)
6949                 return -ENOMEM;
6950
6951         rd->n_reg_rules = num_rules;
6952         rd->alpha2[0] = alpha2[0];
6953         rd->alpha2[1] = alpha2[1];
6954
6955         /*
6956          * Disable DFS master mode if the DFS region was
6957          * not supported or known on this kernel.
6958          */
6959         if (reg_supported_dfs_region(dfs_region))
6960                 rd->dfs_region = dfs_region;
6961
6962         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6963                             rem_reg_rules) {
6964                 r = nla_parse_nested(tb, NL80211_REG_RULE_ATTR_MAX,
6965                                      nl_reg_rule, reg_rule_policy,
6966                                      info->extack);
6967                 if (r)
6968                         goto bad_reg;
6969                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
6970                 if (r)
6971                         goto bad_reg;
6972
6973                 rule_idx++;
6974
6975                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
6976                         r = -EINVAL;
6977                         goto bad_reg;
6978                 }
6979         }
6980
6981         /* set_regdom takes ownership of rd */
6982         return set_regdom(rd, REGD_SOURCE_CRDA);
6983  bad_reg:
6984         kfree(rd);
6985         return r;
6986 }
6987 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
6988
6989 static int validate_scan_freqs(struct nlattr *freqs)
6990 {
6991         struct nlattr *attr1, *attr2;
6992         int n_channels = 0, tmp1, tmp2;
6993
6994         nla_for_each_nested(attr1, freqs, tmp1)
6995                 if (nla_len(attr1) != sizeof(u32))
6996                         return 0;
6997
6998         nla_for_each_nested(attr1, freqs, tmp1) {
6999                 n_channels++;
7000                 /*
7001                  * Some hardware has a limited channel list for
7002                  * scanning, and it is pretty much nonsensical
7003                  * to scan for a channel twice, so disallow that
7004                  * and don't require drivers to check that the
7005                  * channel list they get isn't longer than what
7006                  * they can scan, as long as they can scan all
7007                  * the channels they registered at once.
7008                  */
7009                 nla_for_each_nested(attr2, freqs, tmp2)
7010                         if (attr1 != attr2 &&
7011                             nla_get_u32(attr1) == nla_get_u32(attr2))
7012                                 return 0;
7013         }
7014
7015         return n_channels;
7016 }
7017
7018 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
7019 {
7020         return b < NUM_NL80211_BANDS && wiphy->bands[b];
7021 }
7022
7023 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
7024                             struct cfg80211_bss_selection *bss_select)
7025 {
7026         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
7027         struct nlattr *nest;
7028         int err;
7029         bool found = false;
7030         int i;
7031
7032         /* only process one nested attribute */
7033         nest = nla_data(nla);
7034         if (!nla_ok(nest, nla_len(nest)))
7035                 return -EINVAL;
7036
7037         err = nla_parse_nested(attr, NL80211_BSS_SELECT_ATTR_MAX, nest,
7038                                nl80211_bss_select_policy, NULL);
7039         if (err)
7040                 return err;
7041
7042         /* only one attribute may be given */
7043         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
7044                 if (attr[i]) {
7045                         if (found)
7046                                 return -EINVAL;
7047                         found = true;
7048                 }
7049         }
7050
7051         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
7052
7053         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
7054                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
7055
7056         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
7057                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
7058                 bss_select->param.band_pref =
7059                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
7060                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
7061                         return -EINVAL;
7062         }
7063
7064         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
7065                 struct nl80211_bss_select_rssi_adjust *adj_param;
7066
7067                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
7068                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
7069                 bss_select->param.adjust.band = adj_param->band;
7070                 bss_select->param.adjust.delta = adj_param->delta;
7071                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
7072                         return -EINVAL;
7073         }
7074
7075         /* user-space did not provide behaviour attribute */
7076         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
7077                 return -EINVAL;
7078
7079         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
7080                 return -EINVAL;
7081
7082         return 0;
7083 }
7084
7085 int nl80211_parse_random_mac(struct nlattr **attrs,
7086                              u8 *mac_addr, u8 *mac_addr_mask)
7087 {
7088         int i;
7089
7090         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
7091                 eth_zero_addr(mac_addr);
7092                 eth_zero_addr(mac_addr_mask);
7093                 mac_addr[0] = 0x2;
7094                 mac_addr_mask[0] = 0x3;
7095
7096                 return 0;
7097         }
7098
7099         /* need both or none */
7100         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
7101                 return -EINVAL;
7102
7103         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
7104         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
7105
7106         /* don't allow or configure an mcast address */
7107         if (!is_multicast_ether_addr(mac_addr_mask) ||
7108             is_multicast_ether_addr(mac_addr))
7109                 return -EINVAL;
7110
7111         /*
7112          * allow users to pass a MAC address that has bits set outside
7113          * of the mask, but don't bother drivers with having to deal
7114          * with such bits
7115          */
7116         for (i = 0; i < ETH_ALEN; i++)
7117                 mac_addr[i] &= mac_addr_mask[i];
7118
7119         return 0;
7120 }
7121
7122 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev)
7123 {
7124         ASSERT_WDEV_LOCK(wdev);
7125
7126         if (!cfg80211_beaconing_iface_active(wdev))
7127                 return true;
7128
7129         if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR))
7130                 return true;
7131
7132         return regulatory_pre_cac_allowed(wdev->wiphy);
7133 }
7134
7135 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
7136                                     enum nl80211_ext_feature_index feat)
7137 {
7138         if (!(flags & flag))
7139                 return true;
7140         if (wiphy_ext_feature_isset(wiphy, feat))
7141                 return true;
7142         return false;
7143 }
7144
7145 static int
7146 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
7147                          void *request, struct nlattr **attrs,
7148                          bool is_sched_scan)
7149 {
7150         u8 *mac_addr, *mac_addr_mask;
7151         u32 *flags;
7152         enum nl80211_feature_flags randomness_flag;
7153
7154         if (!attrs[NL80211_ATTR_SCAN_FLAGS])
7155                 return 0;
7156
7157         if (is_sched_scan) {
7158                 struct cfg80211_sched_scan_request *req = request;
7159
7160                 randomness_flag = wdev ?
7161                                   NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
7162                                   NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
7163                 flags = &req->flags;
7164                 mac_addr = req->mac_addr;
7165                 mac_addr_mask = req->mac_addr_mask;
7166         } else {
7167                 struct cfg80211_scan_request *req = request;
7168
7169                 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
7170                 flags = &req->flags;
7171                 mac_addr = req->mac_addr;
7172                 mac_addr_mask = req->mac_addr_mask;
7173         }
7174
7175         *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
7176
7177         if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
7178              !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
7179             !nl80211_check_scan_feat(wiphy, *flags,
7180                                      NL80211_SCAN_FLAG_LOW_SPAN,
7181                                      NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
7182             !nl80211_check_scan_feat(wiphy, *flags,
7183                                      NL80211_SCAN_FLAG_LOW_POWER,
7184                                      NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
7185             !nl80211_check_scan_feat(wiphy, *flags,
7186                                      NL80211_SCAN_FLAG_HIGH_ACCURACY,
7187                                      NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
7188             !nl80211_check_scan_feat(wiphy, *flags,
7189                                      NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
7190                                      NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
7191             !nl80211_check_scan_feat(wiphy, *flags,
7192                                      NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
7193                                      NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
7194             !nl80211_check_scan_feat(wiphy, *flags,
7195                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
7196                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
7197             !nl80211_check_scan_feat(wiphy, *flags,
7198                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
7199                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
7200             !nl80211_check_scan_feat(wiphy, *flags,
7201                                      NL80211_SCAN_FLAG_RANDOM_SN,
7202                                      NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
7203             !nl80211_check_scan_feat(wiphy, *flags,
7204                                      NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
7205                                      NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
7206                 return -EOPNOTSUPP;
7207
7208         if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
7209                 int err;
7210
7211                 if (!(wiphy->features & randomness_flag) ||
7212                     (wdev && wdev->current_bss))
7213                         return -EOPNOTSUPP;
7214
7215                 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
7216                 if (err)
7217                         return err;
7218         }
7219
7220         return 0;
7221 }
7222
7223 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
7224 {
7225         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7226         struct wireless_dev *wdev = info->user_ptr[1];
7227         struct cfg80211_scan_request *request;
7228         struct nlattr *attr;
7229         struct wiphy *wiphy;
7230         int err, tmp, n_ssids = 0, n_channels, i;
7231         size_t ie_len;
7232
7233         wiphy = &rdev->wiphy;
7234
7235         if (wdev->iftype == NL80211_IFTYPE_NAN)
7236                 return -EOPNOTSUPP;
7237
7238         if (!rdev->ops->scan)
7239                 return -EOPNOTSUPP;
7240
7241         if (rdev->scan_req || rdev->scan_msg) {
7242                 err = -EBUSY;
7243                 goto unlock;
7244         }
7245
7246         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7247                 n_channels = validate_scan_freqs(
7248                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7249                 if (!n_channels) {
7250                         err = -EINVAL;
7251                         goto unlock;
7252                 }
7253         } else {
7254                 n_channels = ieee80211_get_num_supported_channels(wiphy);
7255         }
7256
7257         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
7258                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
7259                         n_ssids++;
7260
7261         if (n_ssids > wiphy->max_scan_ssids) {
7262                 err = -EINVAL;
7263                 goto unlock;
7264         }
7265
7266         if (info->attrs[NL80211_ATTR_IE])
7267                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7268         else
7269                 ie_len = 0;
7270
7271         if (ie_len > wiphy->max_scan_ie_len) {
7272                 err = -EINVAL;
7273                 goto unlock;
7274         }
7275
7276         request = kzalloc(sizeof(*request)
7277                         + sizeof(*request->ssids) * n_ssids
7278                         + sizeof(*request->channels) * n_channels
7279                         + ie_len, GFP_KERNEL);
7280         if (!request) {
7281                 err = -ENOMEM;
7282                 goto unlock;
7283         }
7284
7285         if (n_ssids)
7286                 request->ssids = (void *)&request->channels[n_channels];
7287         request->n_ssids = n_ssids;
7288         if (ie_len) {
7289                 if (n_ssids)
7290                         request->ie = (void *)(request->ssids + n_ssids);
7291                 else
7292                         request->ie = (void *)(request->channels + n_channels);
7293         }
7294
7295         i = 0;
7296         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7297                 /* user specified, bail out if channel not found */
7298                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
7299                         struct ieee80211_channel *chan;
7300
7301                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7302
7303                         if (!chan) {
7304                                 err = -EINVAL;
7305                                 goto out_free;
7306                         }
7307
7308                         /* ignore disabled channels */
7309                         if (chan->flags & IEEE80211_CHAN_DISABLED)
7310                                 continue;
7311
7312                         request->channels[i] = chan;
7313                         i++;
7314                 }
7315         } else {
7316                 enum nl80211_band band;
7317
7318                 /* all channels */
7319                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7320                         int j;
7321
7322                         if (!wiphy->bands[band])
7323                                 continue;
7324                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7325                                 struct ieee80211_channel *chan;
7326
7327                                 chan = &wiphy->bands[band]->channels[j];
7328
7329                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
7330                                         continue;
7331
7332                                 request->channels[i] = chan;
7333                                 i++;
7334                         }
7335                 }
7336         }
7337
7338         if (!i) {
7339                 err = -EINVAL;
7340                 goto out_free;
7341         }
7342
7343         request->n_channels = i;
7344
7345         wdev_lock(wdev);
7346         if (!cfg80211_off_channel_oper_allowed(wdev)) {
7347                 struct ieee80211_channel *chan;
7348
7349                 if (request->n_channels != 1) {
7350                         wdev_unlock(wdev);
7351                         err = -EBUSY;
7352                         goto out_free;
7353                 }
7354
7355                 chan = request->channels[0];
7356                 if (chan->center_freq != wdev->chandef.chan->center_freq) {
7357                         wdev_unlock(wdev);
7358                         err = -EBUSY;
7359                         goto out_free;
7360                 }
7361         }
7362         wdev_unlock(wdev);
7363
7364         i = 0;
7365         if (n_ssids) {
7366                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
7367                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7368                                 err = -EINVAL;
7369                                 goto out_free;
7370                         }
7371                         request->ssids[i].ssid_len = nla_len(attr);
7372                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
7373                         i++;
7374                 }
7375         }
7376
7377         if (info->attrs[NL80211_ATTR_IE]) {
7378                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7379                 memcpy((void *)request->ie,
7380                        nla_data(info->attrs[NL80211_ATTR_IE]),
7381                        request->ie_len);
7382         }
7383
7384         for (i = 0; i < NUM_NL80211_BANDS; i++)
7385                 if (wiphy->bands[i])
7386                         request->rates[i] =
7387                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
7388
7389         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
7390                 nla_for_each_nested(attr,
7391                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
7392                                     tmp) {
7393                         enum nl80211_band band = nla_type(attr);
7394
7395                         if (band < 0 || band >= NUM_NL80211_BANDS) {
7396                                 err = -EINVAL;
7397                                 goto out_free;
7398                         }
7399
7400                         if (!wiphy->bands[band])
7401                                 continue;
7402
7403                         err = ieee80211_get_ratemask(wiphy->bands[band],
7404                                                      nla_data(attr),
7405                                                      nla_len(attr),
7406                                                      &request->rates[band]);
7407                         if (err)
7408                                 goto out_free;
7409                 }
7410         }
7411
7412         if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
7413                 if (!wiphy_ext_feature_isset(wiphy,
7414                                         NL80211_EXT_FEATURE_SET_SCAN_DWELL)) {
7415                         err = -EOPNOTSUPP;
7416                         goto out_free;
7417                 }
7418
7419                 request->duration =
7420                         nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
7421                 request->duration_mandatory =
7422                         nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
7423         }
7424
7425         err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
7426                                        false);
7427         if (err)
7428                 goto out_free;
7429
7430         request->no_cck =
7431                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7432
7433         /* Initial implementation used NL80211_ATTR_MAC to set the specific
7434          * BSSID to scan for. This was problematic because that same attribute
7435          * was already used for another purpose (local random MAC address). The
7436          * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
7437          * compatibility with older userspace components, also use the
7438          * NL80211_ATTR_MAC value here if it can be determined to be used for
7439          * the specific BSSID use case instead of the random MAC address
7440          * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
7441          */
7442         if (info->attrs[NL80211_ATTR_BSSID])
7443                 memcpy(request->bssid,
7444                        nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
7445         else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
7446                  info->attrs[NL80211_ATTR_MAC])
7447                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
7448                        ETH_ALEN);
7449         else
7450                 eth_broadcast_addr(request->bssid);
7451
7452         request->wdev = wdev;
7453         request->wiphy = &rdev->wiphy;
7454         request->scan_start = jiffies;
7455
7456         rdev->scan_req = request;
7457         err = rdev_scan(rdev, request);
7458
7459         if (!err) {
7460                 nl80211_send_scan_start(rdev, wdev);
7461                 if (wdev->netdev)
7462                         dev_hold(wdev->netdev);
7463         } else {
7464  out_free:
7465                 rdev->scan_req = NULL;
7466                 kfree(request);
7467         }
7468
7469  unlock:
7470         return err;
7471 }
7472
7473 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
7474 {
7475         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7476         struct wireless_dev *wdev = info->user_ptr[1];
7477
7478         if (!rdev->ops->abort_scan)
7479                 return -EOPNOTSUPP;
7480
7481         if (rdev->scan_msg)
7482                 return 0;
7483
7484         if (!rdev->scan_req)
7485                 return -ENOENT;
7486
7487         rdev_abort_scan(rdev, wdev);
7488         return 0;
7489 }
7490
7491 static int
7492 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
7493                                struct cfg80211_sched_scan_request *request,
7494                                struct nlattr **attrs)
7495 {
7496         int tmp, err, i = 0;
7497         struct nlattr *attr;
7498
7499         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7500                 u32 interval;
7501
7502                 /*
7503                  * If scan plans are not specified,
7504                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
7505                  * case one scan plan will be set with the specified scan
7506                  * interval and infinite number of iterations.
7507                  */
7508                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
7509                 if (!interval)
7510                         return -EINVAL;
7511
7512                 request->scan_plans[0].interval =
7513                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
7514                 if (!request->scan_plans[0].interval)
7515                         return -EINVAL;
7516
7517                 if (request->scan_plans[0].interval >
7518                     wiphy->max_sched_scan_plan_interval)
7519                         request->scan_plans[0].interval =
7520                                 wiphy->max_sched_scan_plan_interval;
7521
7522                 return 0;
7523         }
7524
7525         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
7526                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
7527
7528                 if (WARN_ON(i >= n_plans))
7529                         return -EINVAL;
7530
7531                 err = nla_parse_nested(plan, NL80211_SCHED_SCAN_PLAN_MAX,
7532                                        attr, nl80211_plan_policy, NULL);
7533                 if (err)
7534                         return err;
7535
7536                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
7537                         return -EINVAL;
7538
7539                 request->scan_plans[i].interval =
7540                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
7541                 if (!request->scan_plans[i].interval ||
7542                     request->scan_plans[i].interval >
7543                     wiphy->max_sched_scan_plan_interval)
7544                         return -EINVAL;
7545
7546                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
7547                         request->scan_plans[i].iterations =
7548                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
7549                         if (!request->scan_plans[i].iterations ||
7550                             (request->scan_plans[i].iterations >
7551                              wiphy->max_sched_scan_plan_iterations))
7552                                 return -EINVAL;
7553                 } else if (i < n_plans - 1) {
7554                         /*
7555                          * All scan plans but the last one must specify
7556                          * a finite number of iterations
7557                          */
7558                         return -EINVAL;
7559                 }
7560
7561                 i++;
7562         }
7563
7564         /*
7565          * The last scan plan must not specify the number of
7566          * iterations, it is supposed to run infinitely
7567          */
7568         if (request->scan_plans[n_plans - 1].iterations)
7569                 return  -EINVAL;
7570
7571         return 0;
7572 }
7573
7574 static int
7575 nl80211_parse_sched_scan_per_band_rssi(struct wiphy *wiphy,
7576                                        struct cfg80211_match_set *match_sets,
7577                                        struct nlattr *tb_band_rssi,
7578                                        s32 rssi_thold)
7579 {
7580         struct nlattr *attr;
7581         int i, tmp, ret = 0;
7582
7583         if (!wiphy_ext_feature_isset(wiphy,
7584                     NL80211_EXT_FEATURE_SCHED_SCAN_BAND_SPECIFIC_RSSI_THOLD)) {
7585                 if (tb_band_rssi)
7586                         ret = -EOPNOTSUPP;
7587                 else
7588                         for (i = 0; i < NUM_NL80211_BANDS; i++)
7589                                 match_sets->per_band_rssi_thold[i] =
7590                                         NL80211_SCAN_RSSI_THOLD_OFF;
7591                 return ret;
7592         }
7593
7594         for (i = 0; i < NUM_NL80211_BANDS; i++)
7595                 match_sets->per_band_rssi_thold[i] = rssi_thold;
7596
7597         nla_for_each_nested(attr, tb_band_rssi, tmp) {
7598                 enum nl80211_band band = nla_type(attr);
7599
7600                 if (band < 0 || band >= NUM_NL80211_BANDS)
7601                         return -EINVAL;
7602
7603                 match_sets->per_band_rssi_thold[band] = nla_get_s32(attr);
7604         }
7605
7606         return 0;
7607 }
7608
7609 static struct cfg80211_sched_scan_request *
7610 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
7611                          struct nlattr **attrs, int max_match_sets)
7612 {
7613         struct cfg80211_sched_scan_request *request;
7614         struct nlattr *attr;
7615         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
7616         enum nl80211_band band;
7617         size_t ie_len;
7618         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
7619         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
7620
7621         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7622                 n_channels = validate_scan_freqs(
7623                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7624                 if (!n_channels)
7625                         return ERR_PTR(-EINVAL);
7626         } else {
7627                 n_channels = ieee80211_get_num_supported_channels(wiphy);
7628         }
7629
7630         if (attrs[NL80211_ATTR_SCAN_SSIDS])
7631                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7632                                     tmp)
7633                         n_ssids++;
7634
7635         if (n_ssids > wiphy->max_sched_scan_ssids)
7636                 return ERR_PTR(-EINVAL);
7637
7638         /*
7639          * First, count the number of 'real' matchsets. Due to an issue with
7640          * the old implementation, matchsets containing only the RSSI attribute
7641          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
7642          * RSSI for all matchsets, rather than their own matchset for reporting
7643          * all APs with a strong RSSI. This is needed to be compatible with
7644          * older userspace that treated a matchset with only the RSSI as the
7645          * global RSSI for all other matchsets - if there are other matchsets.
7646          */
7647         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7648                 nla_for_each_nested(attr,
7649                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7650                                     tmp) {
7651                         struct nlattr *rssi;
7652
7653                         err = nla_parse_nested(tb,
7654                                                NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7655                                                attr, nl80211_match_policy,
7656                                                NULL);
7657                         if (err)
7658                                 return ERR_PTR(err);
7659
7660                         /* SSID and BSSID are mutually exclusive */
7661                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
7662                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
7663                                 return ERR_PTR(-EINVAL);
7664
7665                         /* add other standalone attributes here */
7666                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
7667                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
7668                                 n_match_sets++;
7669                                 continue;
7670                         }
7671                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7672                         if (rssi)
7673                                 default_match_rssi = nla_get_s32(rssi);
7674                 }
7675         }
7676
7677         /* However, if there's no other matchset, add the RSSI one */
7678         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
7679                 n_match_sets = 1;
7680
7681         if (n_match_sets > max_match_sets)
7682                 return ERR_PTR(-EINVAL);
7683
7684         if (attrs[NL80211_ATTR_IE])
7685                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
7686         else
7687                 ie_len = 0;
7688
7689         if (ie_len > wiphy->max_sched_scan_ie_len)
7690                 return ERR_PTR(-EINVAL);
7691
7692         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7693                 /*
7694                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
7695                  * each scan plan already specifies its own interval
7696                  */
7697                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7698                         return ERR_PTR(-EINVAL);
7699
7700                 nla_for_each_nested(attr,
7701                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
7702                         n_plans++;
7703         } else {
7704                 /*
7705                  * The scan interval attribute is kept for backward
7706                  * compatibility. If no scan plans are specified and sched scan
7707                  * interval is specified, one scan plan will be set with this
7708                  * scan interval and infinite number of iterations.
7709                  */
7710                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7711                         return ERR_PTR(-EINVAL);
7712
7713                 n_plans = 1;
7714         }
7715
7716         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
7717                 return ERR_PTR(-EINVAL);
7718
7719         if (!wiphy_ext_feature_isset(
7720                     wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
7721             (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
7722              attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
7723                 return ERR_PTR(-EINVAL);
7724
7725         request = kzalloc(sizeof(*request)
7726                         + sizeof(*request->ssids) * n_ssids
7727                         + sizeof(*request->match_sets) * n_match_sets
7728                         + sizeof(*request->scan_plans) * n_plans
7729                         + sizeof(*request->channels) * n_channels
7730                         + ie_len, GFP_KERNEL);
7731         if (!request)
7732                 return ERR_PTR(-ENOMEM);
7733
7734         if (n_ssids)
7735                 request->ssids = (void *)&request->channels[n_channels];
7736         request->n_ssids = n_ssids;
7737         if (ie_len) {
7738                 if (n_ssids)
7739                         request->ie = (void *)(request->ssids + n_ssids);
7740                 else
7741                         request->ie = (void *)(request->channels + n_channels);
7742         }
7743
7744         if (n_match_sets) {
7745                 if (request->ie)
7746                         request->match_sets = (void *)(request->ie + ie_len);
7747                 else if (n_ssids)
7748                         request->match_sets =
7749                                 (void *)(request->ssids + n_ssids);
7750                 else
7751                         request->match_sets =
7752                                 (void *)(request->channels + n_channels);
7753         }
7754         request->n_match_sets = n_match_sets;
7755
7756         if (n_match_sets)
7757                 request->scan_plans = (void *)(request->match_sets +
7758                                                n_match_sets);
7759         else if (request->ie)
7760                 request->scan_plans = (void *)(request->ie + ie_len);
7761         else if (n_ssids)
7762                 request->scan_plans = (void *)(request->ssids + n_ssids);
7763         else
7764                 request->scan_plans = (void *)(request->channels + n_channels);
7765
7766         request->n_scan_plans = n_plans;
7767
7768         i = 0;
7769         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7770                 /* user specified, bail out if channel not found */
7771                 nla_for_each_nested(attr,
7772                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
7773                                     tmp) {
7774                         struct ieee80211_channel *chan;
7775
7776                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7777
7778                         if (!chan) {
7779                                 err = -EINVAL;
7780                                 goto out_free;
7781                         }
7782
7783                         /* ignore disabled channels */
7784                         if (chan->flags & IEEE80211_CHAN_DISABLED)
7785                                 continue;
7786
7787                         request->channels[i] = chan;
7788                         i++;
7789                 }
7790         } else {
7791                 /* all channels */
7792                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7793                         int j;
7794
7795                         if (!wiphy->bands[band])
7796                                 continue;
7797                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7798                                 struct ieee80211_channel *chan;
7799
7800                                 chan = &wiphy->bands[band]->channels[j];
7801
7802                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
7803                                         continue;
7804
7805                                 request->channels[i] = chan;
7806                                 i++;
7807                         }
7808                 }
7809         }
7810
7811         if (!i) {
7812                 err = -EINVAL;
7813                 goto out_free;
7814         }
7815
7816         request->n_channels = i;
7817
7818         i = 0;
7819         if (n_ssids) {
7820                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7821                                     tmp) {
7822                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7823                                 err = -EINVAL;
7824                                 goto out_free;
7825                         }
7826                         request->ssids[i].ssid_len = nla_len(attr);
7827                         memcpy(request->ssids[i].ssid, nla_data(attr),
7828                                nla_len(attr));
7829                         i++;
7830                 }
7831         }
7832
7833         i = 0;
7834         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7835                 nla_for_each_nested(attr,
7836                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7837                                     tmp) {
7838                         struct nlattr *ssid, *bssid, *rssi;
7839
7840                         err = nla_parse_nested(tb,
7841                                                NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7842                                                attr, nl80211_match_policy,
7843                                                NULL);
7844                         if (err)
7845                                 goto out_free;
7846                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
7847                         bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
7848
7849                         if (!ssid && !bssid) {
7850                                 i++;
7851                                 continue;
7852                         }
7853
7854                         if (WARN_ON(i >= n_match_sets)) {
7855                                 /* this indicates a programming error,
7856                                  * the loop above should have verified
7857                                  * things properly
7858                                  */
7859                                 err = -EINVAL;
7860                                 goto out_free;
7861                         }
7862
7863                         if (ssid) {
7864                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
7865                                         err = -EINVAL;
7866                                         goto out_free;
7867                                 }
7868                                 memcpy(request->match_sets[i].ssid.ssid,
7869                                        nla_data(ssid), nla_len(ssid));
7870                                 request->match_sets[i].ssid.ssid_len =
7871                                         nla_len(ssid);
7872                         }
7873                         if (bssid) {
7874                                 if (nla_len(bssid) != ETH_ALEN) {
7875                                         err = -EINVAL;
7876                                         goto out_free;
7877                                 }
7878                                 memcpy(request->match_sets[i].bssid,
7879                                        nla_data(bssid), ETH_ALEN);
7880                         }
7881
7882                         /* special attribute - old implementation w/a */
7883                         request->match_sets[i].rssi_thold = default_match_rssi;
7884                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7885                         if (rssi)
7886                                 request->match_sets[i].rssi_thold =
7887                                         nla_get_s32(rssi);
7888
7889                         /* Parse per band RSSI attribute */
7890                         err = nl80211_parse_sched_scan_per_band_rssi(wiphy,
7891                                 &request->match_sets[i],
7892                                 tb[NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI],
7893                                 request->match_sets[i].rssi_thold);
7894                         if (err)
7895                                 goto out_free;
7896
7897                         i++;
7898                 }
7899
7900                 /* there was no other matchset, so the RSSI one is alone */
7901                 if (i == 0 && n_match_sets)
7902                         request->match_sets[0].rssi_thold = default_match_rssi;
7903
7904                 request->min_rssi_thold = INT_MAX;
7905                 for (i = 0; i < n_match_sets; i++)
7906                         request->min_rssi_thold =
7907                                 min(request->match_sets[i].rssi_thold,
7908                                     request->min_rssi_thold);
7909         } else {
7910                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
7911         }
7912
7913         if (ie_len) {
7914                 request->ie_len = ie_len;
7915                 memcpy((void *)request->ie,
7916                        nla_data(attrs[NL80211_ATTR_IE]),
7917                        request->ie_len);
7918         }
7919
7920         err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
7921         if (err)
7922                 goto out_free;
7923
7924         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
7925                 request->delay =
7926                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
7927
7928         if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
7929                 request->relative_rssi = nla_get_s8(
7930                         attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
7931                 request->relative_rssi_set = true;
7932         }
7933
7934         if (request->relative_rssi_set &&
7935             attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
7936                 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
7937
7938                 rssi_adjust = nla_data(
7939                         attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
7940                 request->rssi_adjust.band = rssi_adjust->band;
7941                 request->rssi_adjust.delta = rssi_adjust->delta;
7942                 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
7943                         err = -EINVAL;
7944                         goto out_free;
7945                 }
7946         }
7947
7948         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
7949         if (err)
7950                 goto out_free;
7951
7952         request->scan_start = jiffies;
7953
7954         return request;
7955
7956 out_free:
7957         kfree(request);
7958         return ERR_PTR(err);
7959 }
7960
7961 static int nl80211_start_sched_scan(struct sk_buff *skb,
7962                                     struct genl_info *info)
7963 {
7964         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7965         struct net_device *dev = info->user_ptr[1];
7966         struct wireless_dev *wdev = dev->ieee80211_ptr;
7967         struct cfg80211_sched_scan_request *sched_scan_req;
7968         bool want_multi;
7969         int err;
7970
7971         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
7972                 return -EOPNOTSUPP;
7973
7974         want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
7975         err = cfg80211_sched_scan_req_possible(rdev, want_multi);
7976         if (err)
7977                 return err;
7978
7979         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
7980                                                   info->attrs,
7981                                                   rdev->wiphy.max_match_sets);
7982
7983         err = PTR_ERR_OR_ZERO(sched_scan_req);
7984         if (err)
7985                 goto out_err;
7986
7987         /* leave request id zero for legacy request
7988          * or if driver does not support multi-scheduled scan
7989          */
7990         if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1) {
7991                 while (!sched_scan_req->reqid)
7992                         sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
7993         }
7994
7995         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
7996         if (err)
7997                 goto out_free;
7998
7999         sched_scan_req->dev = dev;
8000         sched_scan_req->wiphy = &rdev->wiphy;
8001
8002         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
8003                 sched_scan_req->owner_nlportid = info->snd_portid;
8004
8005         cfg80211_add_sched_scan_req(rdev, sched_scan_req);
8006
8007         nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
8008         return 0;
8009
8010 out_free:
8011         kfree(sched_scan_req);
8012 out_err:
8013         return err;
8014 }
8015
8016 static int nl80211_stop_sched_scan(struct sk_buff *skb,
8017                                    struct genl_info *info)
8018 {
8019         struct cfg80211_sched_scan_request *req;
8020         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8021         u64 cookie;
8022
8023         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
8024                 return -EOPNOTSUPP;
8025
8026         if (info->attrs[NL80211_ATTR_COOKIE]) {
8027                 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
8028                 return __cfg80211_stop_sched_scan(rdev, cookie, false);
8029         }
8030
8031         req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
8032                                      struct cfg80211_sched_scan_request,
8033                                      list);
8034         if (!req || req->reqid ||
8035             (req->owner_nlportid &&
8036              req->owner_nlportid != info->snd_portid))
8037                 return -ENOENT;
8038
8039         return cfg80211_stop_sched_scan_req(rdev, req, false);
8040 }
8041
8042 static int nl80211_start_radar_detection(struct sk_buff *skb,
8043                                          struct genl_info *info)
8044 {
8045         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8046         struct net_device *dev = info->user_ptr[1];
8047         struct wireless_dev *wdev = dev->ieee80211_ptr;
8048         struct wiphy *wiphy = wdev->wiphy;
8049         struct cfg80211_chan_def chandef;
8050         enum nl80211_dfs_regions dfs_region;
8051         unsigned int cac_time_ms;
8052         int err;
8053
8054         dfs_region = reg_get_dfs_region(wiphy);
8055         if (dfs_region == NL80211_DFS_UNSET)
8056                 return -EINVAL;
8057
8058         err = nl80211_parse_chandef(rdev, info, &chandef);
8059         if (err)
8060                 return err;
8061
8062         if (netif_carrier_ok(dev))
8063                 return -EBUSY;
8064
8065         if (wdev->cac_started)
8066                 return -EBUSY;
8067
8068         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
8069         if (err < 0)
8070                 return err;
8071
8072         if (err == 0)
8073                 return -EINVAL;
8074
8075         if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
8076                 return -EINVAL;
8077
8078         /* CAC start is offloaded to HW and can't be started manually */
8079         if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
8080                 return -EOPNOTSUPP;
8081
8082         if (!rdev->ops->start_radar_detection)
8083                 return -EOPNOTSUPP;
8084
8085         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
8086         if (WARN_ON(!cac_time_ms))
8087                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
8088
8089         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
8090         if (!err) {
8091                 wdev->chandef = chandef;
8092                 wdev->cac_started = true;
8093                 wdev->cac_start_time = jiffies;
8094                 wdev->cac_time_ms = cac_time_ms;
8095         }
8096         return err;
8097 }
8098
8099 static int nl80211_notify_radar_detection(struct sk_buff *skb,
8100                                           struct genl_info *info)
8101 {
8102         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8103         struct net_device *dev = info->user_ptr[1];
8104         struct wireless_dev *wdev = dev->ieee80211_ptr;
8105         struct wiphy *wiphy = wdev->wiphy;
8106         struct cfg80211_chan_def chandef;
8107         enum nl80211_dfs_regions dfs_region;
8108         int err;
8109
8110         dfs_region = reg_get_dfs_region(wiphy);
8111         if (dfs_region == NL80211_DFS_UNSET) {
8112                 GENL_SET_ERR_MSG(info,
8113                                  "DFS Region is not set. Unexpected Radar indication");
8114                 return -EINVAL;
8115         }
8116
8117         err = nl80211_parse_chandef(rdev, info, &chandef);
8118         if (err) {
8119                 GENL_SET_ERR_MSG(info, "Unable to extract chandef info");
8120                 return err;
8121         }
8122
8123         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
8124         if (err < 0) {
8125                 GENL_SET_ERR_MSG(info, "chandef is invalid");
8126                 return err;
8127         }
8128
8129         if (err == 0) {
8130                 GENL_SET_ERR_MSG(info,
8131                                  "Unexpected Radar indication for chandef/iftype");
8132                 return -EINVAL;
8133         }
8134
8135         /* Do not process this notification if radar is already detected
8136          * by kernel on this channel, and return success.
8137          */
8138         if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE)
8139                 return 0;
8140
8141         cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE);
8142
8143         cfg80211_sched_dfs_chan_update(rdev);
8144
8145         memcpy(&rdev->radar_chandef, &chandef, sizeof(chandef));
8146
8147         /* Propagate this notification to other radios as well */
8148         queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
8149
8150         return 0;
8151 }
8152
8153 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
8154 {
8155         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8156         struct net_device *dev = info->user_ptr[1];
8157         struct wireless_dev *wdev = dev->ieee80211_ptr;
8158         struct cfg80211_csa_settings params;
8159         /* csa_attrs is defined static to avoid waste of stack size - this
8160          * function is called under RTNL lock, so this should not be a problem.
8161          */
8162         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
8163         int err;
8164         bool need_new_beacon = false;
8165         bool need_handle_dfs_flag = true;
8166         int len, i;
8167         u32 cs_count;
8168
8169         if (!rdev->ops->channel_switch ||
8170             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
8171                 return -EOPNOTSUPP;
8172
8173         switch (dev->ieee80211_ptr->iftype) {
8174         case NL80211_IFTYPE_AP:
8175         case NL80211_IFTYPE_P2P_GO:
8176                 need_new_beacon = true;
8177                 /* For all modes except AP the handle_dfs flag needs to be
8178                  * supplied to tell the kernel that userspace will handle radar
8179                  * events when they happen. Otherwise a switch to a channel
8180                  * requiring DFS will be rejected.
8181                  */
8182                 need_handle_dfs_flag = false;
8183
8184                 /* useless if AP is not running */
8185                 if (!wdev->beacon_interval)
8186                         return -ENOTCONN;
8187                 break;
8188         case NL80211_IFTYPE_ADHOC:
8189                 if (!wdev->ssid_len)
8190                         return -ENOTCONN;
8191                 break;
8192         case NL80211_IFTYPE_MESH_POINT:
8193                 if (!wdev->mesh_id_len)
8194                         return -ENOTCONN;
8195                 break;
8196         default:
8197                 return -EOPNOTSUPP;
8198         }
8199
8200         memset(&params, 0, sizeof(params));
8201         params.beacon_csa.ftm_responder = -1;
8202
8203         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
8204             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
8205                 return -EINVAL;
8206
8207         /* only important for AP, IBSS and mesh create IEs internally */
8208         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
8209                 return -EINVAL;
8210
8211         /* Even though the attribute is u32, the specification says
8212          * u8, so let's make sure we don't overflow.
8213          */
8214         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
8215         if (cs_count > 255)
8216                 return -EINVAL;
8217
8218         params.count = cs_count;
8219
8220         if (!need_new_beacon)
8221                 goto skip_beacons;
8222
8223         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_after);
8224         if (err)
8225                 return err;
8226
8227         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
8228                                info->attrs[NL80211_ATTR_CSA_IES],
8229                                nl80211_policy, info->extack);
8230         if (err)
8231                 return err;
8232
8233         err = nl80211_parse_beacon(rdev, csa_attrs, &params.beacon_csa);
8234         if (err)
8235                 return err;
8236
8237         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
8238                 return -EINVAL;
8239
8240         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
8241         if (!len || (len % sizeof(u16)))
8242                 return -EINVAL;
8243
8244         params.n_counter_offsets_beacon = len / sizeof(u16);
8245         if (rdev->wiphy.max_num_csa_counters &&
8246             (params.n_counter_offsets_beacon >
8247              rdev->wiphy.max_num_csa_counters))
8248                 return -EINVAL;
8249
8250         params.counter_offsets_beacon =
8251                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
8252
8253         /* sanity checks - counters should fit and be the same */
8254         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
8255                 u16 offset = params.counter_offsets_beacon[i];
8256
8257                 if (offset >= params.beacon_csa.tail_len)
8258                         return -EINVAL;
8259
8260                 if (params.beacon_csa.tail[offset] != params.count)
8261                         return -EINVAL;
8262         }
8263
8264         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
8265                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
8266                 if (!len || (len % sizeof(u16)))
8267                         return -EINVAL;
8268
8269                 params.n_counter_offsets_presp = len / sizeof(u16);
8270                 if (rdev->wiphy.max_num_csa_counters &&
8271                     (params.n_counter_offsets_presp >
8272                      rdev->wiphy.max_num_csa_counters))
8273                         return -EINVAL;
8274
8275                 params.counter_offsets_presp =
8276                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
8277
8278                 /* sanity checks - counters should fit and be the same */
8279                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
8280                         u16 offset = params.counter_offsets_presp[i];
8281
8282                         if (offset >= params.beacon_csa.probe_resp_len)
8283                                 return -EINVAL;
8284
8285                         if (params.beacon_csa.probe_resp[offset] !=
8286                             params.count)
8287                                 return -EINVAL;
8288                 }
8289         }
8290
8291 skip_beacons:
8292         err = nl80211_parse_chandef(rdev, info, &params.chandef);
8293         if (err)
8294                 return err;
8295
8296         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
8297                                            wdev->iftype))
8298                 return -EINVAL;
8299
8300         err = cfg80211_chandef_dfs_required(wdev->wiphy,
8301                                             &params.chandef,
8302                                             wdev->iftype);
8303         if (err < 0)
8304                 return err;
8305
8306         if (err > 0) {
8307                 params.radar_required = true;
8308                 if (need_handle_dfs_flag &&
8309                     !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
8310                         return -EINVAL;
8311                 }
8312         }
8313
8314         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
8315                 params.block_tx = true;
8316
8317         wdev_lock(wdev);
8318         err = rdev_channel_switch(rdev, dev, &params);
8319         wdev_unlock(wdev);
8320
8321         return err;
8322 }
8323
8324 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
8325                             u32 seq, int flags,
8326                             struct cfg80211_registered_device *rdev,
8327                             struct wireless_dev *wdev,
8328                             struct cfg80211_internal_bss *intbss)
8329 {
8330         struct cfg80211_bss *res = &intbss->pub;
8331         const struct cfg80211_bss_ies *ies;
8332         void *hdr;
8333         struct nlattr *bss;
8334
8335         ASSERT_WDEV_LOCK(wdev);
8336
8337         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
8338                              NL80211_CMD_NEW_SCAN_RESULTS);
8339         if (!hdr)
8340                 return -1;
8341
8342         genl_dump_check_consistent(cb, hdr);
8343
8344         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
8345                 goto nla_put_failure;
8346         if (wdev->netdev &&
8347             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
8348                 goto nla_put_failure;
8349         if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
8350                               NL80211_ATTR_PAD))
8351                 goto nla_put_failure;
8352
8353         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
8354         if (!bss)
8355                 goto nla_put_failure;
8356         if ((!is_zero_ether_addr(res->bssid) &&
8357              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
8358                 goto nla_put_failure;
8359
8360         rcu_read_lock();
8361         /* indicate whether we have probe response data or not */
8362         if (rcu_access_pointer(res->proberesp_ies) &&
8363             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
8364                 goto fail_unlock_rcu;
8365
8366         /* this pointer prefers to be pointed to probe response data
8367          * but is always valid
8368          */
8369         ies = rcu_dereference(res->ies);
8370         if (ies) {
8371                 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
8372                                       NL80211_BSS_PAD))
8373                         goto fail_unlock_rcu;
8374                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
8375                                         ies->len, ies->data))
8376                         goto fail_unlock_rcu;
8377         }
8378
8379         /* and this pointer is always (unless driver didn't know) beacon data */
8380         ies = rcu_dereference(res->beacon_ies);
8381         if (ies && ies->from_beacon) {
8382                 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
8383                                       NL80211_BSS_PAD))
8384                         goto fail_unlock_rcu;
8385                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
8386                                         ies->len, ies->data))
8387                         goto fail_unlock_rcu;
8388         }
8389         rcu_read_unlock();
8390
8391         if (res->beacon_interval &&
8392             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
8393                 goto nla_put_failure;
8394         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
8395             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
8396             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
8397             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
8398                         jiffies_to_msecs(jiffies - intbss->ts)))
8399                 goto nla_put_failure;
8400
8401         if (intbss->parent_tsf &&
8402             (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
8403                                intbss->parent_tsf, NL80211_BSS_PAD) ||
8404              nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
8405                      intbss->parent_bssid)))
8406                 goto nla_put_failure;
8407
8408         if (intbss->ts_boottime &&
8409             nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
8410                               intbss->ts_boottime, NL80211_BSS_PAD))
8411                 goto nla_put_failure;
8412
8413         if (!nl80211_put_signal(msg, intbss->pub.chains,
8414                                 intbss->pub.chain_signal,
8415                                 NL80211_BSS_CHAIN_SIGNAL))
8416                 goto nla_put_failure;
8417
8418         switch (rdev->wiphy.signal_type) {
8419         case CFG80211_SIGNAL_TYPE_MBM:
8420                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
8421                         goto nla_put_failure;
8422                 break;
8423         case CFG80211_SIGNAL_TYPE_UNSPEC:
8424                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
8425                         goto nla_put_failure;
8426                 break;
8427         default:
8428                 break;
8429         }
8430
8431         switch (wdev->iftype) {
8432         case NL80211_IFTYPE_P2P_CLIENT:
8433         case NL80211_IFTYPE_STATION:
8434                 if (intbss == wdev->current_bss &&
8435                     nla_put_u32(msg, NL80211_BSS_STATUS,
8436                                 NL80211_BSS_STATUS_ASSOCIATED))
8437                         goto nla_put_failure;
8438                 break;
8439         case NL80211_IFTYPE_ADHOC:
8440                 if (intbss == wdev->current_bss &&
8441                     nla_put_u32(msg, NL80211_BSS_STATUS,
8442                                 NL80211_BSS_STATUS_IBSS_JOINED))
8443                         goto nla_put_failure;
8444                 break;
8445         default:
8446                 break;
8447         }
8448
8449         nla_nest_end(msg, bss);
8450
8451         genlmsg_end(msg, hdr);
8452         return 0;
8453
8454  fail_unlock_rcu:
8455         rcu_read_unlock();
8456  nla_put_failure:
8457         genlmsg_cancel(msg, hdr);
8458         return -EMSGSIZE;
8459 }
8460
8461 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
8462 {
8463         struct cfg80211_registered_device *rdev;
8464         struct cfg80211_internal_bss *scan;
8465         struct wireless_dev *wdev;
8466         int start = cb->args[2], idx = 0;
8467         int err;
8468
8469         rtnl_lock();
8470         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
8471         if (err) {
8472                 rtnl_unlock();
8473                 return err;
8474         }
8475
8476         wdev_lock(wdev);
8477         spin_lock_bh(&rdev->bss_lock);
8478
8479         /*
8480          * dump_scan will be called multiple times to break up the scan results
8481          * into multiple messages.  It is unlikely that any more bss-es will be
8482          * expired after the first call, so only call only call this on the
8483          * first dump_scan invocation.
8484          */
8485         if (start == 0)
8486                 cfg80211_bss_expire(rdev);
8487
8488         cb->seq = rdev->bss_generation;
8489
8490         list_for_each_entry(scan, &rdev->bss_list, list) {
8491                 if (++idx <= start)
8492                         continue;
8493                 if (nl80211_send_bss(skb, cb,
8494                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8495                                 rdev, wdev, scan) < 0) {
8496                         idx--;
8497                         break;
8498                 }
8499         }
8500
8501         spin_unlock_bh(&rdev->bss_lock);
8502         wdev_unlock(wdev);
8503
8504         cb->args[2] = idx;
8505         rtnl_unlock();
8506
8507         return skb->len;
8508 }
8509
8510 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
8511                                int flags, struct net_device *dev,
8512                                bool allow_radio_stats,
8513                                struct survey_info *survey)
8514 {
8515         void *hdr;
8516         struct nlattr *infoattr;
8517
8518         /* skip radio stats if userspace didn't request them */
8519         if (!survey->channel && !allow_radio_stats)
8520                 return 0;
8521
8522         hdr = nl80211hdr_put(msg, portid, seq, flags,
8523                              NL80211_CMD_NEW_SURVEY_RESULTS);
8524         if (!hdr)
8525                 return -ENOMEM;
8526
8527         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
8528                 goto nla_put_failure;
8529
8530         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
8531         if (!infoattr)
8532                 goto nla_put_failure;
8533
8534         if (survey->channel &&
8535             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
8536                         survey->channel->center_freq))
8537                 goto nla_put_failure;
8538
8539         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
8540             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
8541                 goto nla_put_failure;
8542         if ((survey->filled & SURVEY_INFO_IN_USE) &&
8543             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
8544                 goto nla_put_failure;
8545         if ((survey->filled & SURVEY_INFO_TIME) &&
8546             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
8547                         survey->time, NL80211_SURVEY_INFO_PAD))
8548                 goto nla_put_failure;
8549         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
8550             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
8551                               survey->time_busy, NL80211_SURVEY_INFO_PAD))
8552                 goto nla_put_failure;
8553         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
8554             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
8555                               survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
8556                 goto nla_put_failure;
8557         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
8558             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
8559                               survey->time_rx, NL80211_SURVEY_INFO_PAD))
8560                 goto nla_put_failure;
8561         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
8562             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
8563                               survey->time_tx, NL80211_SURVEY_INFO_PAD))
8564                 goto nla_put_failure;
8565         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
8566             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
8567                               survey->time_scan, NL80211_SURVEY_INFO_PAD))
8568                 goto nla_put_failure;
8569
8570         nla_nest_end(msg, infoattr);
8571
8572         genlmsg_end(msg, hdr);
8573         return 0;
8574
8575  nla_put_failure:
8576         genlmsg_cancel(msg, hdr);
8577         return -EMSGSIZE;
8578 }
8579
8580 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
8581 {
8582         struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
8583         struct survey_info survey;
8584         struct cfg80211_registered_device *rdev;
8585         struct wireless_dev *wdev;
8586         int survey_idx = cb->args[2];
8587         int res;
8588         bool radio_stats;
8589
8590         rtnl_lock();
8591         res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
8592         if (res)
8593                 goto out_err;
8594
8595         /* prepare_wdev_dump parsed the attributes */
8596         radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
8597
8598         if (!wdev->netdev) {
8599                 res = -EINVAL;
8600                 goto out_err;
8601         }
8602
8603         if (!rdev->ops->dump_survey) {
8604                 res = -EOPNOTSUPP;
8605                 goto out_err;
8606         }
8607
8608         while (1) {
8609                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
8610                 if (res == -ENOENT)
8611                         break;
8612                 if (res)
8613                         goto out_err;
8614
8615                 /* don't send disabled channels, but do send non-channel data */
8616                 if (survey.channel &&
8617                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
8618                         survey_idx++;
8619                         continue;
8620                 }
8621
8622                 if (nl80211_send_survey(skb,
8623                                 NETLINK_CB(cb->skb).portid,
8624                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8625                                 wdev->netdev, radio_stats, &survey) < 0)
8626                         goto out;
8627                 survey_idx++;
8628         }
8629
8630  out:
8631         cb->args[2] = survey_idx;
8632         res = skb->len;
8633  out_err:
8634         rtnl_unlock();
8635         return res;
8636 }
8637
8638 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
8639 {
8640         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
8641                                   NL80211_WPA_VERSION_2));
8642 }
8643
8644 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
8645 {
8646         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8647         struct net_device *dev = info->user_ptr[1];
8648         struct ieee80211_channel *chan;
8649         const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL;
8650         int err, ssid_len, ie_len = 0, auth_data_len = 0;
8651         enum nl80211_auth_type auth_type;
8652         struct key_parse key;
8653         bool local_state_change;
8654
8655         if (!info->attrs[NL80211_ATTR_MAC])
8656                 return -EINVAL;
8657
8658         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
8659                 return -EINVAL;
8660
8661         if (!info->attrs[NL80211_ATTR_SSID])
8662                 return -EINVAL;
8663
8664         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
8665                 return -EINVAL;
8666
8667         err = nl80211_parse_key(info, &key);
8668         if (err)
8669                 return err;
8670
8671         if (key.idx >= 0) {
8672                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
8673                         return -EINVAL;
8674                 if (!key.p.key || !key.p.key_len)
8675                         return -EINVAL;
8676                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
8677                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
8678                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
8679                      key.p.key_len != WLAN_KEY_LEN_WEP104))
8680                         return -EINVAL;
8681                 if (key.idx > 3)
8682                         return -EINVAL;
8683         } else {
8684                 key.p.key_len = 0;
8685                 key.p.key = NULL;
8686         }
8687
8688         if (key.idx >= 0) {
8689                 int i;
8690                 bool ok = false;
8691
8692                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
8693                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
8694                                 ok = true;
8695                                 break;
8696                         }
8697                 }
8698                 if (!ok)
8699                         return -EINVAL;
8700         }
8701
8702         if (!rdev->ops->auth)
8703                 return -EOPNOTSUPP;
8704
8705         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8706             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8707                 return -EOPNOTSUPP;
8708
8709         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8710         chan = nl80211_get_valid_chan(&rdev->wiphy,
8711                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8712         if (!chan)
8713                 return -EINVAL;
8714
8715         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8716         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8717
8718         if (info->attrs[NL80211_ATTR_IE]) {
8719                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8720                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8721         }
8722
8723         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8724         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
8725                 return -EINVAL;
8726
8727         if ((auth_type == NL80211_AUTHTYPE_SAE ||
8728              auth_type == NL80211_AUTHTYPE_FILS_SK ||
8729              auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
8730              auth_type == NL80211_AUTHTYPE_FILS_PK) &&
8731             !info->attrs[NL80211_ATTR_AUTH_DATA])
8732                 return -EINVAL;
8733
8734         if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
8735                 if (auth_type != NL80211_AUTHTYPE_SAE &&
8736                     auth_type != NL80211_AUTHTYPE_FILS_SK &&
8737                     auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
8738                     auth_type != NL80211_AUTHTYPE_FILS_PK)
8739                         return -EINVAL;
8740                 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
8741                 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
8742                 /* need to include at least Auth Transaction and Status Code */
8743                 if (auth_data_len < 4)
8744                         return -EINVAL;
8745         }
8746
8747         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8748
8749         /*
8750          * Since we no longer track auth state, ignore
8751          * requests to only change local state.
8752          */
8753         if (local_state_change)
8754                 return 0;
8755
8756         wdev_lock(dev->ieee80211_ptr);
8757         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
8758                                  ssid, ssid_len, ie, ie_len,
8759                                  key.p.key, key.p.key_len, key.idx,
8760                                  auth_data, auth_data_len);
8761         wdev_unlock(dev->ieee80211_ptr);
8762         return err;
8763 }
8764
8765 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
8766                                      struct genl_info *info)
8767 {
8768         if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8769                 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
8770                 return -EINVAL;
8771         }
8772
8773         if (!rdev->ops->tx_control_port ||
8774             !wiphy_ext_feature_isset(&rdev->wiphy,
8775                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
8776                 return -EOPNOTSUPP;
8777
8778         return 0;
8779 }
8780
8781 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
8782                                    struct genl_info *info,
8783                                    struct cfg80211_crypto_settings *settings,
8784                                    int cipher_limit)
8785 {
8786         memset(settings, 0, sizeof(*settings));
8787
8788         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
8789
8790         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
8791                 u16 proto;
8792
8793                 proto = nla_get_u16(
8794                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
8795                 settings->control_port_ethertype = cpu_to_be16(proto);
8796                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
8797                     proto != ETH_P_PAE)
8798                         return -EINVAL;
8799                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
8800                         settings->control_port_no_encrypt = true;
8801         } else
8802                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
8803
8804         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
8805                 int r = validate_pae_over_nl80211(rdev, info);
8806
8807                 if (r < 0)
8808                         return r;
8809
8810                 settings->control_port_over_nl80211 = true;
8811         }
8812
8813         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
8814                 void *data;
8815                 int len, i;
8816
8817                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8818                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8819                 settings->n_ciphers_pairwise = len / sizeof(u32);
8820
8821                 if (len % sizeof(u32))
8822                         return -EINVAL;
8823
8824                 if (settings->n_ciphers_pairwise > cipher_limit)
8825                         return -EINVAL;
8826
8827                 memcpy(settings->ciphers_pairwise, data, len);
8828
8829                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
8830                         if (!cfg80211_supported_cipher_suite(
8831                                         &rdev->wiphy,
8832                                         settings->ciphers_pairwise[i]))
8833                                 return -EINVAL;
8834         }
8835
8836         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
8837                 settings->cipher_group =
8838                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
8839                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
8840                                                      settings->cipher_group))
8841                         return -EINVAL;
8842         }
8843
8844         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
8845                 settings->wpa_versions =
8846                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
8847                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
8848                         return -EINVAL;
8849         }
8850
8851         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
8852                 void *data;
8853                 int len;
8854
8855                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
8856                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
8857                 settings->n_akm_suites = len / sizeof(u32);
8858
8859                 if (len % sizeof(u32))
8860                         return -EINVAL;
8861
8862                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
8863                         return -EINVAL;
8864
8865                 memcpy(settings->akm_suites, data, len);
8866         }
8867
8868         if (info->attrs[NL80211_ATTR_PMK]) {
8869                 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
8870                         return -EINVAL;
8871                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8872                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK))
8873                         return -EINVAL;
8874                 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
8875         }
8876
8877         return 0;
8878 }
8879
8880 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
8881 {
8882         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8883         struct net_device *dev = info->user_ptr[1];
8884         struct ieee80211_channel *chan;
8885         struct cfg80211_assoc_request req = {};
8886         const u8 *bssid, *ssid;
8887         int err, ssid_len = 0;
8888
8889         if (dev->ieee80211_ptr->conn_owner_nlportid &&
8890             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
8891                 return -EPERM;
8892
8893         if (!info->attrs[NL80211_ATTR_MAC] ||
8894             !info->attrs[NL80211_ATTR_SSID] ||
8895             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
8896                 return -EINVAL;
8897
8898         if (!rdev->ops->assoc)
8899                 return -EOPNOTSUPP;
8900
8901         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8902             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8903                 return -EOPNOTSUPP;
8904
8905         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8906
8907         chan = nl80211_get_valid_chan(&rdev->wiphy,
8908                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8909         if (!chan)
8910                 return -EINVAL;
8911
8912         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8913         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8914
8915         if (info->attrs[NL80211_ATTR_IE]) {
8916                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8917                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8918         }
8919
8920         if (info->attrs[NL80211_ATTR_USE_MFP]) {
8921                 enum nl80211_mfp mfp =
8922                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
8923                 if (mfp == NL80211_MFP_REQUIRED)
8924                         req.use_mfp = true;
8925                 else if (mfp != NL80211_MFP_NO)
8926                         return -EINVAL;
8927         }
8928
8929         if (info->attrs[NL80211_ATTR_PREV_BSSID])
8930                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
8931
8932         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
8933                 req.flags |= ASSOC_REQ_DISABLE_HT;
8934
8935         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8936                 memcpy(&req.ht_capa_mask,
8937                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8938                        sizeof(req.ht_capa_mask));
8939
8940         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8941                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8942                         return -EINVAL;
8943                 memcpy(&req.ht_capa,
8944                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8945                        sizeof(req.ht_capa));
8946         }
8947
8948         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
8949                 req.flags |= ASSOC_REQ_DISABLE_VHT;
8950
8951         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8952                 memcpy(&req.vht_capa_mask,
8953                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
8954                        sizeof(req.vht_capa_mask));
8955
8956         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
8957                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8958                         return -EINVAL;
8959                 memcpy(&req.vht_capa,
8960                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
8961                        sizeof(req.vht_capa));
8962         }
8963
8964         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
8965                 if (!((rdev->wiphy.features &
8966                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
8967                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
8968                     !wiphy_ext_feature_isset(&rdev->wiphy,
8969                                              NL80211_EXT_FEATURE_RRM))
8970                         return -EINVAL;
8971                 req.flags |= ASSOC_REQ_USE_RRM;
8972         }
8973
8974         if (info->attrs[NL80211_ATTR_FILS_KEK]) {
8975                 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
8976                 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
8977                 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
8978                         return -EINVAL;
8979                 req.fils_nonces =
8980                         nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
8981         }
8982
8983         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
8984         if (!err) {
8985                 wdev_lock(dev->ieee80211_ptr);
8986
8987                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
8988                                           ssid, ssid_len, &req);
8989
8990                 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8991                         dev->ieee80211_ptr->conn_owner_nlportid =
8992                                 info->snd_portid;
8993                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
8994                                bssid, ETH_ALEN);
8995                 }
8996
8997                 wdev_unlock(dev->ieee80211_ptr);
8998         }
8999
9000         return err;
9001 }
9002
9003 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
9004 {
9005         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9006         struct net_device *dev = info->user_ptr[1];
9007         const u8 *ie = NULL, *bssid;
9008         int ie_len = 0, err;
9009         u16 reason_code;
9010         bool local_state_change;
9011
9012         if (dev->ieee80211_ptr->conn_owner_nlportid &&
9013             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9014                 return -EPERM;
9015
9016         if (!info->attrs[NL80211_ATTR_MAC])
9017                 return -EINVAL;
9018
9019         if (!info->attrs[NL80211_ATTR_REASON_CODE])
9020                 return -EINVAL;
9021
9022         if (!rdev->ops->deauth)
9023                 return -EOPNOTSUPP;
9024
9025         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9026             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9027                 return -EOPNOTSUPP;
9028
9029         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9030
9031         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9032         if (reason_code == 0) {
9033                 /* Reason Code 0 is reserved */
9034                 return -EINVAL;
9035         }
9036
9037         if (info->attrs[NL80211_ATTR_IE]) {
9038                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9039                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9040         }
9041
9042         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
9043
9044         wdev_lock(dev->ieee80211_ptr);
9045         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
9046                                    local_state_change);
9047         wdev_unlock(dev->ieee80211_ptr);
9048         return err;
9049 }
9050
9051 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
9052 {
9053         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9054         struct net_device *dev = info->user_ptr[1];
9055         const u8 *ie = NULL, *bssid;
9056         int ie_len = 0, err;
9057         u16 reason_code;
9058         bool local_state_change;
9059
9060         if (dev->ieee80211_ptr->conn_owner_nlportid &&
9061             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9062                 return -EPERM;
9063
9064         if (!info->attrs[NL80211_ATTR_MAC])
9065                 return -EINVAL;
9066
9067         if (!info->attrs[NL80211_ATTR_REASON_CODE])
9068                 return -EINVAL;
9069
9070         if (!rdev->ops->disassoc)
9071                 return -EOPNOTSUPP;
9072
9073         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9074             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9075                 return -EOPNOTSUPP;
9076
9077         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9078
9079         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9080         if (reason_code == 0) {
9081                 /* Reason Code 0 is reserved */
9082                 return -EINVAL;
9083         }
9084
9085         if (info->attrs[NL80211_ATTR_IE]) {
9086                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9087                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9088         }
9089
9090         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
9091
9092         wdev_lock(dev->ieee80211_ptr);
9093         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
9094                                      local_state_change);
9095         wdev_unlock(dev->ieee80211_ptr);
9096         return err;
9097 }
9098
9099 static bool
9100 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
9101                          int mcast_rate[NUM_NL80211_BANDS],
9102                          int rateval)
9103 {
9104         struct wiphy *wiphy = &rdev->wiphy;
9105         bool found = false;
9106         int band, i;
9107
9108         for (band = 0; band < NUM_NL80211_BANDS; band++) {
9109                 struct ieee80211_supported_band *sband;
9110
9111                 sband = wiphy->bands[band];
9112                 if (!sband)
9113                         continue;
9114
9115                 for (i = 0; i < sband->n_bitrates; i++) {
9116                         if (sband->bitrates[i].bitrate == rateval) {
9117                                 mcast_rate[band] = i + 1;
9118                                 found = true;
9119                                 break;
9120                         }
9121                 }
9122         }
9123
9124         return found;
9125 }
9126
9127 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
9128 {
9129         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9130         struct net_device *dev = info->user_ptr[1];
9131         struct cfg80211_ibss_params ibss;
9132         struct wiphy *wiphy;
9133         struct cfg80211_cached_keys *connkeys = NULL;
9134         int err;
9135
9136         memset(&ibss, 0, sizeof(ibss));
9137
9138         if (!info->attrs[NL80211_ATTR_SSID] ||
9139             !nla_len(info->attrs[NL80211_ATTR_SSID]))
9140                 return -EINVAL;
9141
9142         ibss.beacon_interval = 100;
9143
9144         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
9145                 ibss.beacon_interval =
9146                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
9147
9148         err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
9149                                            ibss.beacon_interval);
9150         if (err)
9151                 return err;
9152
9153         if (!rdev->ops->join_ibss)
9154                 return -EOPNOTSUPP;
9155
9156         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
9157                 return -EOPNOTSUPP;
9158
9159         wiphy = &rdev->wiphy;
9160
9161         if (info->attrs[NL80211_ATTR_MAC]) {
9162                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9163
9164                 if (!is_valid_ether_addr(ibss.bssid))
9165                         return -EINVAL;
9166         }
9167         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9168         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9169
9170         if (info->attrs[NL80211_ATTR_IE]) {
9171                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9172                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9173         }
9174
9175         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
9176         if (err)
9177                 return err;
9178
9179         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
9180                                      NL80211_IFTYPE_ADHOC))
9181                 return -EINVAL;
9182
9183         switch (ibss.chandef.width) {
9184         case NL80211_CHAN_WIDTH_5:
9185         case NL80211_CHAN_WIDTH_10:
9186         case NL80211_CHAN_WIDTH_20_NOHT:
9187                 break;
9188         case NL80211_CHAN_WIDTH_20:
9189         case NL80211_CHAN_WIDTH_40:
9190                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
9191                         return -EINVAL;
9192                 break;
9193         case NL80211_CHAN_WIDTH_80:
9194         case NL80211_CHAN_WIDTH_80P80:
9195         case NL80211_CHAN_WIDTH_160:
9196                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
9197                         return -EINVAL;
9198                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
9199                                              NL80211_EXT_FEATURE_VHT_IBSS))
9200                         return -EINVAL;
9201                 break;
9202         default:
9203                 return -EINVAL;
9204         }
9205
9206         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
9207         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
9208
9209         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
9210                 u8 *rates =
9211                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9212                 int n_rates =
9213                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9214                 struct ieee80211_supported_band *sband =
9215                         wiphy->bands[ibss.chandef.chan->band];
9216
9217                 err = ieee80211_get_ratemask(sband, rates, n_rates,
9218                                              &ibss.basic_rates);
9219                 if (err)
9220                         return err;
9221         }
9222
9223         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9224                 memcpy(&ibss.ht_capa_mask,
9225                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
9226                        sizeof(ibss.ht_capa_mask));
9227
9228         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9229                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9230                         return -EINVAL;
9231                 memcpy(&ibss.ht_capa,
9232                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9233                        sizeof(ibss.ht_capa));
9234         }
9235
9236         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
9237             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
9238                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
9239                 return -EINVAL;
9240
9241         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
9242                 bool no_ht = false;
9243
9244                 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
9245                 if (IS_ERR(connkeys))
9246                         return PTR_ERR(connkeys);
9247
9248                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
9249                     no_ht) {
9250                         kzfree(connkeys);
9251                         return -EINVAL;
9252                 }
9253         }
9254
9255         ibss.control_port =
9256                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
9257
9258         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
9259                 int r = validate_pae_over_nl80211(rdev, info);
9260
9261                 if (r < 0) {
9262                         kzfree(connkeys);
9263                         return r;
9264                 }
9265
9266                 ibss.control_port_over_nl80211 = true;
9267         }
9268
9269         ibss.userspace_handles_dfs =
9270                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
9271
9272         wdev_lock(dev->ieee80211_ptr);
9273         err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
9274         if (err)
9275                 kzfree(connkeys);
9276         else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
9277                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
9278         wdev_unlock(dev->ieee80211_ptr);
9279
9280         return err;
9281 }
9282
9283 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
9284 {
9285         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9286         struct net_device *dev = info->user_ptr[1];
9287
9288         if (!rdev->ops->leave_ibss)
9289                 return -EOPNOTSUPP;
9290
9291         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
9292                 return -EOPNOTSUPP;
9293
9294         return cfg80211_leave_ibss(rdev, dev, false);
9295 }
9296
9297 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
9298 {
9299         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9300         struct net_device *dev = info->user_ptr[1];
9301         int mcast_rate[NUM_NL80211_BANDS];
9302         u32 nla_rate;
9303         int err;
9304
9305         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
9306             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
9307             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
9308                 return -EOPNOTSUPP;
9309
9310         if (!rdev->ops->set_mcast_rate)
9311                 return -EOPNOTSUPP;
9312
9313         memset(mcast_rate, 0, sizeof(mcast_rate));
9314
9315         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
9316                 return -EINVAL;
9317
9318         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
9319         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
9320                 return -EINVAL;
9321
9322         err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
9323
9324         return err;
9325 }
9326
9327 static struct sk_buff *
9328 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
9329                             struct wireless_dev *wdev, int approxlen,
9330                             u32 portid, u32 seq, enum nl80211_commands cmd,
9331                             enum nl80211_attrs attr,
9332                             const struct nl80211_vendor_cmd_info *info,
9333                             gfp_t gfp)
9334 {
9335         struct sk_buff *skb;
9336         void *hdr;
9337         struct nlattr *data;
9338
9339         skb = nlmsg_new(approxlen + 100, gfp);
9340         if (!skb)
9341                 return NULL;
9342
9343         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
9344         if (!hdr) {
9345                 kfree_skb(skb);
9346                 return NULL;
9347         }
9348
9349         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
9350                 goto nla_put_failure;
9351
9352         if (info) {
9353                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
9354                                 info->vendor_id))
9355                         goto nla_put_failure;
9356                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
9357                                 info->subcmd))
9358                         goto nla_put_failure;
9359         }
9360
9361         if (wdev) {
9362                 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
9363                                       wdev_id(wdev), NL80211_ATTR_PAD))
9364                         goto nla_put_failure;
9365                 if (wdev->netdev &&
9366                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
9367                                 wdev->netdev->ifindex))
9368                         goto nla_put_failure;
9369         }
9370
9371         data = nla_nest_start(skb, attr);
9372         if (!data)
9373                 goto nla_put_failure;
9374
9375         ((void **)skb->cb)[0] = rdev;
9376         ((void **)skb->cb)[1] = hdr;
9377         ((void **)skb->cb)[2] = data;
9378
9379         return skb;
9380
9381  nla_put_failure:
9382         kfree_skb(skb);
9383         return NULL;
9384 }
9385
9386 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
9387                                            struct wireless_dev *wdev,
9388                                            enum nl80211_commands cmd,
9389                                            enum nl80211_attrs attr,
9390                                            unsigned int portid,
9391                                            int vendor_event_idx,
9392                                            int approxlen, gfp_t gfp)
9393 {
9394         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
9395         const struct nl80211_vendor_cmd_info *info;
9396
9397         switch (cmd) {
9398         case NL80211_CMD_TESTMODE:
9399                 if (WARN_ON(vendor_event_idx != -1))
9400                         return NULL;
9401                 info = NULL;
9402                 break;
9403         case NL80211_CMD_VENDOR:
9404                 if (WARN_ON(vendor_event_idx < 0 ||
9405                             vendor_event_idx >= wiphy->n_vendor_events))
9406                         return NULL;
9407                 info = &wiphy->vendor_events[vendor_event_idx];
9408                 break;
9409         default:
9410                 WARN_ON(1);
9411                 return NULL;
9412         }
9413
9414         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0,
9415                                            cmd, attr, info, gfp);
9416 }
9417 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
9418
9419 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
9420 {
9421         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
9422         void *hdr = ((void **)skb->cb)[1];
9423         struct nlmsghdr *nlhdr = nlmsg_hdr(skb);
9424         struct nlattr *data = ((void **)skb->cb)[2];
9425         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
9426
9427         /* clear CB data for netlink core to own from now on */
9428         memset(skb->cb, 0, sizeof(skb->cb));
9429
9430         nla_nest_end(skb, data);
9431         genlmsg_end(skb, hdr);
9432
9433         if (nlhdr->nlmsg_pid) {
9434                 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb,
9435                                 nlhdr->nlmsg_pid);
9436         } else {
9437                 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
9438                         mcgrp = NL80211_MCGRP_VENDOR;
9439
9440                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
9441                                         skb, 0, mcgrp, gfp);
9442         }
9443 }
9444 EXPORT_SYMBOL(__cfg80211_send_event_skb);
9445
9446 #ifdef CONFIG_NL80211_TESTMODE
9447 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
9448 {
9449         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9450         struct wireless_dev *wdev =
9451                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
9452         int err;
9453
9454         if (!rdev->ops->testmode_cmd)
9455                 return -EOPNOTSUPP;
9456
9457         if (IS_ERR(wdev)) {
9458                 err = PTR_ERR(wdev);
9459                 if (err != -EINVAL)
9460                         return err;
9461                 wdev = NULL;
9462         } else if (wdev->wiphy != &rdev->wiphy) {
9463                 return -EINVAL;
9464         }
9465
9466         if (!info->attrs[NL80211_ATTR_TESTDATA])
9467                 return -EINVAL;
9468
9469         rdev->cur_cmd_info = info;
9470         err = rdev_testmode_cmd(rdev, wdev,
9471                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
9472                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
9473         rdev->cur_cmd_info = NULL;
9474
9475         return err;
9476 }
9477
9478 static int nl80211_testmode_dump(struct sk_buff *skb,
9479                                  struct netlink_callback *cb)
9480 {
9481         struct cfg80211_registered_device *rdev;
9482         int err;
9483         long phy_idx;
9484         void *data = NULL;
9485         int data_len = 0;
9486
9487         rtnl_lock();
9488
9489         if (cb->args[0]) {
9490                 /*
9491                  * 0 is a valid index, but not valid for args[0],
9492                  * so we need to offset by 1.
9493                  */
9494                 phy_idx = cb->args[0] - 1;
9495
9496                 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
9497                 if (!rdev) {
9498                         err = -ENOENT;
9499                         goto out_err;
9500                 }
9501         } else {
9502                 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
9503
9504                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
9505                                   attrbuf, nl80211_fam.maxattr,
9506                                   nl80211_policy, NULL);
9507                 if (err)
9508                         goto out_err;
9509
9510                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
9511                 if (IS_ERR(rdev)) {
9512                         err = PTR_ERR(rdev);
9513                         goto out_err;
9514                 }
9515                 phy_idx = rdev->wiphy_idx;
9516
9517                 if (attrbuf[NL80211_ATTR_TESTDATA])
9518                         cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
9519         }
9520
9521         if (cb->args[1]) {
9522                 data = nla_data((void *)cb->args[1]);
9523                 data_len = nla_len((void *)cb->args[1]);
9524         }
9525
9526         if (!rdev->ops->testmode_dump) {
9527                 err = -EOPNOTSUPP;
9528                 goto out_err;
9529         }
9530
9531         while (1) {
9532                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
9533                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
9534                                            NL80211_CMD_TESTMODE);
9535                 struct nlattr *tmdata;
9536
9537                 if (!hdr)
9538                         break;
9539
9540                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
9541                         genlmsg_cancel(skb, hdr);
9542                         break;
9543                 }
9544
9545                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
9546                 if (!tmdata) {
9547                         genlmsg_cancel(skb, hdr);
9548                         break;
9549                 }
9550                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
9551                 nla_nest_end(skb, tmdata);
9552
9553                 if (err == -ENOBUFS || err == -ENOENT) {
9554                         genlmsg_cancel(skb, hdr);
9555                         break;
9556                 } else if (err) {
9557                         genlmsg_cancel(skb, hdr);
9558                         goto out_err;
9559                 }
9560
9561                 genlmsg_end(skb, hdr);
9562         }
9563
9564         err = skb->len;
9565         /* see above */
9566         cb->args[0] = phy_idx + 1;
9567  out_err:
9568         rtnl_unlock();
9569         return err;
9570 }
9571 #endif
9572
9573 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
9574 {
9575         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9576         struct net_device *dev = info->user_ptr[1];
9577         struct cfg80211_connect_params connect;
9578         struct wiphy *wiphy;
9579         struct cfg80211_cached_keys *connkeys = NULL;
9580         int err;
9581
9582         memset(&connect, 0, sizeof(connect));
9583
9584         if (!info->attrs[NL80211_ATTR_SSID] ||
9585             !nla_len(info->attrs[NL80211_ATTR_SSID]))
9586                 return -EINVAL;
9587
9588         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
9589                 connect.auth_type =
9590                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9591                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
9592                                              NL80211_CMD_CONNECT))
9593                         return -EINVAL;
9594         } else
9595                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
9596
9597         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
9598
9599         if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
9600             !wiphy_ext_feature_isset(&rdev->wiphy,
9601                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
9602                 return -EINVAL;
9603         connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
9604
9605         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
9606                                       NL80211_MAX_NR_CIPHER_SUITES);
9607         if (err)
9608                 return err;
9609
9610         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9611             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9612                 return -EOPNOTSUPP;
9613
9614         wiphy = &rdev->wiphy;
9615
9616         connect.bg_scan_period = -1;
9617         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
9618                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
9619                 connect.bg_scan_period =
9620                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
9621         }
9622
9623         if (info->attrs[NL80211_ATTR_MAC])
9624                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9625         else if (info->attrs[NL80211_ATTR_MAC_HINT])
9626                 connect.bssid_hint =
9627                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
9628         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9629         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9630
9631         if (info->attrs[NL80211_ATTR_IE]) {
9632                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9633                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9634         }
9635
9636         if (info->attrs[NL80211_ATTR_USE_MFP]) {
9637                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
9638                 if (connect.mfp == NL80211_MFP_OPTIONAL &&
9639                     !wiphy_ext_feature_isset(&rdev->wiphy,
9640                                              NL80211_EXT_FEATURE_MFP_OPTIONAL))
9641                         return -EOPNOTSUPP;
9642         } else {
9643                 connect.mfp = NL80211_MFP_NO;
9644         }
9645
9646         if (info->attrs[NL80211_ATTR_PREV_BSSID])
9647                 connect.prev_bssid =
9648                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
9649
9650         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9651                 connect.channel = nl80211_get_valid_chan(
9652                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
9653                 if (!connect.channel)
9654                         return -EINVAL;
9655         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
9656                 connect.channel_hint = nl80211_get_valid_chan(
9657                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
9658                 if (!connect.channel_hint)
9659                         return -EINVAL;
9660         }
9661
9662         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
9663                 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
9664                 if (IS_ERR(connkeys))
9665                         return PTR_ERR(connkeys);
9666         }
9667
9668         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
9669                 connect.flags |= ASSOC_REQ_DISABLE_HT;
9670
9671         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9672                 memcpy(&connect.ht_capa_mask,
9673                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
9674                        sizeof(connect.ht_capa_mask));
9675
9676         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9677                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
9678                         kzfree(connkeys);
9679                         return -EINVAL;
9680                 }
9681                 memcpy(&connect.ht_capa,
9682                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9683                        sizeof(connect.ht_capa));
9684         }
9685
9686         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
9687                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
9688
9689         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
9690                 memcpy(&connect.vht_capa_mask,
9691                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
9692                        sizeof(connect.vht_capa_mask));
9693
9694         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
9695                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
9696                         kzfree(connkeys);
9697                         return -EINVAL;
9698                 }
9699                 memcpy(&connect.vht_capa,
9700                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
9701                        sizeof(connect.vht_capa));
9702         }
9703
9704         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
9705                 if (!((rdev->wiphy.features &
9706                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
9707                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
9708                     !wiphy_ext_feature_isset(&rdev->wiphy,
9709                                              NL80211_EXT_FEATURE_RRM)) {
9710                         kzfree(connkeys);
9711                         return -EINVAL;
9712                 }
9713                 connect.flags |= ASSOC_REQ_USE_RRM;
9714         }
9715
9716         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
9717         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
9718                 kzfree(connkeys);
9719                 return -EOPNOTSUPP;
9720         }
9721
9722         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
9723                 /* bss selection makes no sense if bssid is set */
9724                 if (connect.bssid) {
9725                         kzfree(connkeys);
9726                         return -EINVAL;
9727                 }
9728
9729                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
9730                                        wiphy, &connect.bss_select);
9731                 if (err) {
9732                         kzfree(connkeys);
9733                         return err;
9734                 }
9735         }
9736
9737         if (wiphy_ext_feature_isset(&rdev->wiphy,
9738                                     NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
9739             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
9740             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
9741             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
9742             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9743                 connect.fils_erp_username =
9744                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9745                 connect.fils_erp_username_len =
9746                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9747                 connect.fils_erp_realm =
9748                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9749                 connect.fils_erp_realm_len =
9750                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9751                 connect.fils_erp_next_seq_num =
9752                         nla_get_u16(
9753                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
9754                 connect.fils_erp_rrk =
9755                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9756                 connect.fils_erp_rrk_len =
9757                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9758         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
9759                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
9760                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
9761                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9762                 kzfree(connkeys);
9763                 return -EINVAL;
9764         }
9765
9766         if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
9767                 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9768                         kzfree(connkeys);
9769                         GENL_SET_ERR_MSG(info,
9770                                          "external auth requires connection ownership");
9771                         return -EINVAL;
9772                 }
9773                 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
9774         }
9775
9776         wdev_lock(dev->ieee80211_ptr);
9777
9778         err = cfg80211_connect(rdev, dev, &connect, connkeys,
9779                                connect.prev_bssid);
9780         if (err)
9781                 kzfree(connkeys);
9782
9783         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9784                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
9785                 if (connect.bssid)
9786                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
9787                                connect.bssid, ETH_ALEN);
9788                 else
9789                         memset(dev->ieee80211_ptr->disconnect_bssid,
9790                                0, ETH_ALEN);
9791         }
9792
9793         wdev_unlock(dev->ieee80211_ptr);
9794
9795         return err;
9796 }
9797
9798 static int nl80211_update_connect_params(struct sk_buff *skb,
9799                                          struct genl_info *info)
9800 {
9801         struct cfg80211_connect_params connect = {};
9802         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9803         struct net_device *dev = info->user_ptr[1];
9804         struct wireless_dev *wdev = dev->ieee80211_ptr;
9805         bool fils_sk_offload;
9806         u32 auth_type;
9807         u32 changed = 0;
9808         int ret;
9809
9810         if (!rdev->ops->update_connect_params)
9811                 return -EOPNOTSUPP;
9812
9813         if (info->attrs[NL80211_ATTR_IE]) {
9814                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9815                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9816                 changed |= UPDATE_ASSOC_IES;
9817         }
9818
9819         fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
9820                                                   NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
9821
9822         /*
9823          * when driver supports fils-sk offload all attributes must be
9824          * provided. So the else covers "fils-sk-not-all" and
9825          * "no-fils-sk-any".
9826          */
9827         if (fils_sk_offload &&
9828             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
9829             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
9830             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
9831             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9832                 connect.fils_erp_username =
9833                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9834                 connect.fils_erp_username_len =
9835                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9836                 connect.fils_erp_realm =
9837                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9838                 connect.fils_erp_realm_len =
9839                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9840                 connect.fils_erp_next_seq_num =
9841                         nla_get_u16(
9842                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
9843                 connect.fils_erp_rrk =
9844                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9845                 connect.fils_erp_rrk_len =
9846                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9847                 changed |= UPDATE_FILS_ERP_INFO;
9848         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
9849                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
9850                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
9851                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9852                 return -EINVAL;
9853         }
9854
9855         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
9856                 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9857                 if (!nl80211_valid_auth_type(rdev, auth_type,
9858                                              NL80211_CMD_CONNECT))
9859                         return -EINVAL;
9860
9861                 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
9862                     fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
9863                         return -EINVAL;
9864
9865                 connect.auth_type = auth_type;
9866                 changed |= UPDATE_AUTH_TYPE;
9867         }
9868
9869         wdev_lock(dev->ieee80211_ptr);
9870         if (!wdev->current_bss)
9871                 ret = -ENOLINK;
9872         else
9873                 ret = rdev_update_connect_params(rdev, dev, &connect, changed);
9874         wdev_unlock(dev->ieee80211_ptr);
9875
9876         return ret;
9877 }
9878
9879 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
9880 {
9881         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9882         struct net_device *dev = info->user_ptr[1];
9883         u16 reason;
9884         int ret;
9885
9886         if (dev->ieee80211_ptr->conn_owner_nlportid &&
9887             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9888                 return -EPERM;
9889
9890         if (!info->attrs[NL80211_ATTR_REASON_CODE])
9891                 reason = WLAN_REASON_DEAUTH_LEAVING;
9892         else
9893                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9894
9895         if (reason == 0)
9896                 return -EINVAL;
9897
9898         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9899             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9900                 return -EOPNOTSUPP;
9901
9902         wdev_lock(dev->ieee80211_ptr);
9903         ret = cfg80211_disconnect(rdev, dev, reason, true);
9904         wdev_unlock(dev->ieee80211_ptr);
9905         return ret;
9906 }
9907
9908 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
9909 {
9910         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9911         struct net *net;
9912         int err;
9913
9914         if (info->attrs[NL80211_ATTR_PID]) {
9915                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
9916
9917                 net = get_net_ns_by_pid(pid);
9918         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
9919                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
9920
9921                 net = get_net_ns_by_fd(fd);
9922         } else {
9923                 return -EINVAL;
9924         }
9925
9926         if (IS_ERR(net))
9927                 return PTR_ERR(net);
9928
9929         err = 0;
9930
9931         /* check if anything to do */
9932         if (!net_eq(wiphy_net(&rdev->wiphy), net))
9933                 err = cfg80211_switch_netns(rdev, net);
9934
9935         put_net(net);
9936         return err;
9937 }
9938
9939 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
9940 {
9941         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9942         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
9943                         struct cfg80211_pmksa *pmksa) = NULL;
9944         struct net_device *dev = info->user_ptr[1];
9945         struct cfg80211_pmksa pmksa;
9946
9947         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
9948
9949         if (!info->attrs[NL80211_ATTR_PMKID])
9950                 return -EINVAL;
9951
9952         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
9953
9954         if (info->attrs[NL80211_ATTR_MAC]) {
9955                 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9956         } else if (info->attrs[NL80211_ATTR_SSID] &&
9957                    info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
9958                    (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
9959                     info->attrs[NL80211_ATTR_PMK])) {
9960                 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9961                 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9962                 pmksa.cache_id =
9963                         nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
9964         } else {
9965                 return -EINVAL;
9966         }
9967         if (info->attrs[NL80211_ATTR_PMK]) {
9968                 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
9969                 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
9970         }
9971
9972         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9973             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
9974             !(dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP &&
9975               wiphy_ext_feature_isset(&rdev->wiphy,
9976                                       NL80211_EXT_FEATURE_AP_PMKSA_CACHING)))
9977                 return -EOPNOTSUPP;
9978
9979         switch (info->genlhdr->cmd) {
9980         case NL80211_CMD_SET_PMKSA:
9981                 rdev_ops = rdev->ops->set_pmksa;
9982                 break;
9983         case NL80211_CMD_DEL_PMKSA:
9984                 rdev_ops = rdev->ops->del_pmksa;
9985                 break;
9986         default:
9987                 WARN_ON(1);
9988                 break;
9989         }
9990
9991         if (!rdev_ops)
9992                 return -EOPNOTSUPP;
9993
9994         return rdev_ops(&rdev->wiphy, dev, &pmksa);
9995 }
9996
9997 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
9998 {
9999         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10000         struct net_device *dev = info->user_ptr[1];
10001
10002         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10003             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10004                 return -EOPNOTSUPP;
10005
10006         if (!rdev->ops->flush_pmksa)
10007                 return -EOPNOTSUPP;
10008
10009         return rdev_flush_pmksa(rdev, dev);
10010 }
10011
10012 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
10013 {
10014         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10015         struct net_device *dev = info->user_ptr[1];
10016         u8 action_code, dialog_token;
10017         u32 peer_capability = 0;
10018         u16 status_code;
10019         u8 *peer;
10020         bool initiator;
10021
10022         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
10023             !rdev->ops->tdls_mgmt)
10024                 return -EOPNOTSUPP;
10025
10026         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
10027             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
10028             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
10029             !info->attrs[NL80211_ATTR_IE] ||
10030             !info->attrs[NL80211_ATTR_MAC])
10031                 return -EINVAL;
10032
10033         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10034         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
10035         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
10036         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
10037         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
10038         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
10039                 peer_capability =
10040                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
10041
10042         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
10043                               dialog_token, status_code, peer_capability,
10044                               initiator,
10045                               nla_data(info->attrs[NL80211_ATTR_IE]),
10046                               nla_len(info->attrs[NL80211_ATTR_IE]));
10047 }
10048
10049 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
10050 {
10051         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10052         struct net_device *dev = info->user_ptr[1];
10053         enum nl80211_tdls_operation operation;
10054         u8 *peer;
10055
10056         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
10057             !rdev->ops->tdls_oper)
10058                 return -EOPNOTSUPP;
10059
10060         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
10061             !info->attrs[NL80211_ATTR_MAC])
10062                 return -EINVAL;
10063
10064         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
10065         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10066
10067         return rdev_tdls_oper(rdev, dev, peer, operation);
10068 }
10069
10070 static int nl80211_remain_on_channel(struct sk_buff *skb,
10071                                      struct genl_info *info)
10072 {
10073         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10074         struct wireless_dev *wdev = info->user_ptr[1];
10075         struct cfg80211_chan_def chandef;
10076         const struct cfg80211_chan_def *compat_chandef;
10077         struct sk_buff *msg;
10078         void *hdr;
10079         u64 cookie;
10080         u32 duration;
10081         int err;
10082
10083         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
10084             !info->attrs[NL80211_ATTR_DURATION])
10085                 return -EINVAL;
10086
10087         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
10088
10089         if (!rdev->ops->remain_on_channel ||
10090             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
10091                 return -EOPNOTSUPP;
10092
10093         /*
10094          * We should be on that channel for at least a minimum amount of
10095          * time (10ms) but no longer than the driver supports.
10096          */
10097         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
10098             duration > rdev->wiphy.max_remain_on_channel_duration)
10099                 return -EINVAL;
10100
10101         err = nl80211_parse_chandef(rdev, info, &chandef);
10102         if (err)
10103                 return err;
10104
10105         wdev_lock(wdev);
10106         if (!cfg80211_off_channel_oper_allowed(wdev) &&
10107             !cfg80211_chandef_identical(&wdev->chandef, &chandef)) {
10108                 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef,
10109                                                              &chandef);
10110                 if (compat_chandef != &chandef) {
10111                         wdev_unlock(wdev);
10112                         return -EBUSY;
10113                 }
10114         }
10115         wdev_unlock(wdev);
10116
10117         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10118         if (!msg)
10119                 return -ENOMEM;
10120
10121         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10122                              NL80211_CMD_REMAIN_ON_CHANNEL);
10123         if (!hdr) {
10124                 err = -ENOBUFS;
10125                 goto free_msg;
10126         }
10127
10128         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
10129                                      duration, &cookie);
10130
10131         if (err)
10132                 goto free_msg;
10133
10134         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
10135                               NL80211_ATTR_PAD))
10136                 goto nla_put_failure;
10137
10138         genlmsg_end(msg, hdr);
10139
10140         return genlmsg_reply(msg, info);
10141
10142  nla_put_failure:
10143         err = -ENOBUFS;
10144  free_msg:
10145         nlmsg_free(msg);
10146         return err;
10147 }
10148
10149 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
10150                                             struct genl_info *info)
10151 {
10152         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10153         struct wireless_dev *wdev = info->user_ptr[1];
10154         u64 cookie;
10155
10156         if (!info->attrs[NL80211_ATTR_COOKIE])
10157                 return -EINVAL;
10158
10159         if (!rdev->ops->cancel_remain_on_channel)
10160                 return -EOPNOTSUPP;
10161
10162         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
10163
10164         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
10165 }
10166
10167 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
10168                                        struct genl_info *info)
10169 {
10170         struct cfg80211_bitrate_mask mask;
10171         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10172         struct net_device *dev = info->user_ptr[1];
10173         int err;
10174
10175         if (!rdev->ops->set_bitrate_mask)
10176                 return -EOPNOTSUPP;
10177
10178         err = nl80211_parse_tx_bitrate_mask(info, &mask);
10179         if (err)
10180                 return err;
10181
10182         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
10183 }
10184
10185 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
10186 {
10187         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10188         struct wireless_dev *wdev = info->user_ptr[1];
10189         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
10190
10191         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
10192                 return -EINVAL;
10193
10194         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
10195                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
10196
10197         switch (wdev->iftype) {
10198         case NL80211_IFTYPE_STATION:
10199         case NL80211_IFTYPE_ADHOC:
10200         case NL80211_IFTYPE_P2P_CLIENT:
10201         case NL80211_IFTYPE_AP:
10202         case NL80211_IFTYPE_AP_VLAN:
10203         case NL80211_IFTYPE_MESH_POINT:
10204         case NL80211_IFTYPE_P2P_GO:
10205         case NL80211_IFTYPE_P2P_DEVICE:
10206                 break;
10207         case NL80211_IFTYPE_NAN:
10208         default:
10209                 return -EOPNOTSUPP;
10210         }
10211
10212         /* not much point in registering if we can't reply */
10213         if (!rdev->ops->mgmt_tx)
10214                 return -EOPNOTSUPP;
10215
10216         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
10217                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
10218                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
10219 }
10220
10221 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
10222 {
10223         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10224         struct wireless_dev *wdev = info->user_ptr[1];
10225         struct cfg80211_chan_def chandef;
10226         int err;
10227         void *hdr = NULL;
10228         u64 cookie;
10229         struct sk_buff *msg = NULL;
10230         struct cfg80211_mgmt_tx_params params = {
10231                 .dont_wait_for_ack =
10232                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
10233         };
10234
10235         if (!info->attrs[NL80211_ATTR_FRAME])
10236                 return -EINVAL;
10237
10238         if (!rdev->ops->mgmt_tx)
10239                 return -EOPNOTSUPP;
10240
10241         switch (wdev->iftype) {
10242         case NL80211_IFTYPE_P2P_DEVICE:
10243                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
10244                         return -EINVAL;
10245         case NL80211_IFTYPE_STATION:
10246         case NL80211_IFTYPE_ADHOC:
10247         case NL80211_IFTYPE_P2P_CLIENT:
10248         case NL80211_IFTYPE_AP:
10249         case NL80211_IFTYPE_AP_VLAN:
10250         case NL80211_IFTYPE_MESH_POINT:
10251         case NL80211_IFTYPE_P2P_GO:
10252                 break;
10253         case NL80211_IFTYPE_NAN:
10254         default:
10255                 return -EOPNOTSUPP;
10256         }
10257
10258         if (info->attrs[NL80211_ATTR_DURATION]) {
10259                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
10260                         return -EINVAL;
10261                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
10262
10263                 /*
10264                  * We should wait on the channel for at least a minimum amount
10265                  * of time (10ms) but no longer than the driver supports.
10266                  */
10267                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
10268                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
10269                         return -EINVAL;
10270         }
10271
10272         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
10273
10274         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
10275                 return -EINVAL;
10276
10277         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
10278
10279         /* get the channel if any has been specified, otherwise pass NULL to
10280          * the driver. The latter will use the current one
10281          */
10282         chandef.chan = NULL;
10283         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
10284                 err = nl80211_parse_chandef(rdev, info, &chandef);
10285                 if (err)
10286                         return err;
10287         }
10288
10289         if (!chandef.chan && params.offchan)
10290                 return -EINVAL;
10291
10292         wdev_lock(wdev);
10293         if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) {
10294                 wdev_unlock(wdev);
10295                 return -EBUSY;
10296         }
10297         wdev_unlock(wdev);
10298
10299         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
10300         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
10301
10302         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
10303                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
10304                 int i;
10305
10306                 if (len % sizeof(u16))
10307                         return -EINVAL;
10308
10309                 params.n_csa_offsets = len / sizeof(u16);
10310                 params.csa_offsets =
10311                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
10312
10313                 /* check that all the offsets fit the frame */
10314                 for (i = 0; i < params.n_csa_offsets; i++) {
10315                         if (params.csa_offsets[i] >= params.len)
10316                                 return -EINVAL;
10317                 }
10318         }
10319
10320         if (!params.dont_wait_for_ack) {
10321                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10322                 if (!msg)
10323                         return -ENOMEM;
10324
10325                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10326                                      NL80211_CMD_FRAME);
10327                 if (!hdr) {
10328                         err = -ENOBUFS;
10329                         goto free_msg;
10330                 }
10331         }
10332
10333         params.chan = chandef.chan;
10334         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
10335         if (err)
10336                 goto free_msg;
10337
10338         if (msg) {
10339                 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
10340                                       NL80211_ATTR_PAD))
10341                         goto nla_put_failure;
10342
10343                 genlmsg_end(msg, hdr);
10344                 return genlmsg_reply(msg, info);
10345         }
10346
10347         return 0;
10348
10349  nla_put_failure:
10350         err = -ENOBUFS;
10351  free_msg:
10352         nlmsg_free(msg);
10353         return err;
10354 }
10355
10356 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
10357 {
10358         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10359         struct wireless_dev *wdev = info->user_ptr[1];
10360         u64 cookie;
10361
10362         if (!info->attrs[NL80211_ATTR_COOKIE])
10363                 return -EINVAL;
10364
10365         if (!rdev->ops->mgmt_tx_cancel_wait)
10366                 return -EOPNOTSUPP;
10367
10368         switch (wdev->iftype) {
10369         case NL80211_IFTYPE_STATION:
10370         case NL80211_IFTYPE_ADHOC:
10371         case NL80211_IFTYPE_P2P_CLIENT:
10372         case NL80211_IFTYPE_AP:
10373         case NL80211_IFTYPE_AP_VLAN:
10374         case NL80211_IFTYPE_P2P_GO:
10375         case NL80211_IFTYPE_P2P_DEVICE:
10376                 break;
10377         case NL80211_IFTYPE_NAN:
10378         default:
10379                 return -EOPNOTSUPP;
10380         }
10381
10382         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
10383
10384         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
10385 }
10386
10387 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
10388 {
10389         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10390         struct wireless_dev *wdev;
10391         struct net_device *dev = info->user_ptr[1];
10392         u8 ps_state;
10393         bool state;
10394         int err;
10395
10396         if (!info->attrs[NL80211_ATTR_PS_STATE])
10397                 return -EINVAL;
10398
10399         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
10400
10401         wdev = dev->ieee80211_ptr;
10402
10403         if (!rdev->ops->set_power_mgmt)
10404                 return -EOPNOTSUPP;
10405
10406         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
10407
10408         if (state == wdev->ps)
10409                 return 0;
10410
10411         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
10412         if (!err)
10413                 wdev->ps = state;
10414         return err;
10415 }
10416
10417 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
10418 {
10419         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10420         enum nl80211_ps_state ps_state;
10421         struct wireless_dev *wdev;
10422         struct net_device *dev = info->user_ptr[1];
10423         struct sk_buff *msg;
10424         void *hdr;
10425         int err;
10426
10427         wdev = dev->ieee80211_ptr;
10428
10429         if (!rdev->ops->set_power_mgmt)
10430                 return -EOPNOTSUPP;
10431
10432         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10433         if (!msg)
10434                 return -ENOMEM;
10435
10436         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10437                              NL80211_CMD_GET_POWER_SAVE);
10438         if (!hdr) {
10439                 err = -ENOBUFS;
10440                 goto free_msg;
10441         }
10442
10443         if (wdev->ps)
10444                 ps_state = NL80211_PS_ENABLED;
10445         else
10446                 ps_state = NL80211_PS_DISABLED;
10447
10448         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
10449                 goto nla_put_failure;
10450
10451         genlmsg_end(msg, hdr);
10452         return genlmsg_reply(msg, info);
10453
10454  nla_put_failure:
10455         err = -ENOBUFS;
10456  free_msg:
10457         nlmsg_free(msg);
10458         return err;
10459 }
10460
10461 static const struct nla_policy
10462 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
10463         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
10464         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
10465         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
10466         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
10467         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
10468         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
10469         [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
10470 };
10471
10472 static int nl80211_set_cqm_txe(struct genl_info *info,
10473                                u32 rate, u32 pkts, u32 intvl)
10474 {
10475         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10476         struct net_device *dev = info->user_ptr[1];
10477         struct wireless_dev *wdev = dev->ieee80211_ptr;
10478
10479         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
10480                 return -EINVAL;
10481
10482         if (!rdev->ops->set_cqm_txe_config)
10483                 return -EOPNOTSUPP;
10484
10485         if (wdev->iftype != NL80211_IFTYPE_STATION &&
10486             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
10487                 return -EOPNOTSUPP;
10488
10489         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
10490 }
10491
10492 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
10493                                     struct net_device *dev)
10494 {
10495         struct wireless_dev *wdev = dev->ieee80211_ptr;
10496         s32 last, low, high;
10497         u32 hyst;
10498         int i, n, low_index;
10499         int err;
10500
10501         /* RSSI reporting disabled? */
10502         if (!wdev->cqm_config)
10503                 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
10504
10505         /*
10506          * Obtain current RSSI value if possible, if not and no RSSI threshold
10507          * event has been received yet, we should receive an event after a
10508          * connection is established and enough beacons received to calculate
10509          * the average.
10510          */
10511         if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss &&
10512             rdev->ops->get_station) {
10513                 struct station_info sinfo = {};
10514                 u8 *mac_addr;
10515
10516                 mac_addr = wdev->current_bss->pub.bssid;
10517
10518                 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
10519                 if (err)
10520                         return err;
10521
10522                 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
10523                         wdev->cqm_config->last_rssi_event_value =
10524                                 (s8) sinfo.rx_beacon_signal_avg;
10525         }
10526
10527         last = wdev->cqm_config->last_rssi_event_value;
10528         hyst = wdev->cqm_config->rssi_hyst;
10529         n = wdev->cqm_config->n_rssi_thresholds;
10530
10531         for (i = 0; i < n; i++)
10532                 if (last < wdev->cqm_config->rssi_thresholds[i])
10533                         break;
10534
10535         low_index = i - 1;
10536         if (low_index >= 0) {
10537                 low_index = array_index_nospec(low_index, n);
10538                 low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;
10539         } else {
10540                 low = S32_MIN;
10541         }
10542         if (i < n) {
10543                 i = array_index_nospec(i, n);
10544                 high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;
10545         } else {
10546                 high = S32_MAX;
10547         }
10548
10549         return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
10550 }
10551
10552 static int nl80211_set_cqm_rssi(struct genl_info *info,
10553                                 const s32 *thresholds, int n_thresholds,
10554                                 u32 hysteresis)
10555 {
10556         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10557         struct net_device *dev = info->user_ptr[1];
10558         struct wireless_dev *wdev = dev->ieee80211_ptr;
10559         int i, err;
10560         s32 prev = S32_MIN;
10561
10562         /* Check all values negative and sorted */
10563         for (i = 0; i < n_thresholds; i++) {
10564                 if (thresholds[i] > 0 || thresholds[i] <= prev)
10565                         return -EINVAL;
10566
10567                 prev = thresholds[i];
10568         }
10569
10570         if (wdev->iftype != NL80211_IFTYPE_STATION &&
10571             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
10572                 return -EOPNOTSUPP;
10573
10574         wdev_lock(wdev);
10575         cfg80211_cqm_config_free(wdev);
10576         wdev_unlock(wdev);
10577
10578         if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
10579                 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
10580                         return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
10581
10582                 return rdev_set_cqm_rssi_config(rdev, dev,
10583                                                 thresholds[0], hysteresis);
10584         }
10585
10586         if (!wiphy_ext_feature_isset(&rdev->wiphy,
10587                                      NL80211_EXT_FEATURE_CQM_RSSI_LIST))
10588                 return -EOPNOTSUPP;
10589
10590         if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
10591                 n_thresholds = 0;
10592
10593         wdev_lock(wdev);
10594         if (n_thresholds) {
10595                 struct cfg80211_cqm_config *cqm_config;
10596
10597                 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) +
10598                                      n_thresholds * sizeof(s32), GFP_KERNEL);
10599                 if (!cqm_config) {
10600                         err = -ENOMEM;
10601                         goto unlock;
10602                 }
10603
10604                 cqm_config->rssi_hyst = hysteresis;
10605                 cqm_config->n_rssi_thresholds = n_thresholds;
10606                 memcpy(cqm_config->rssi_thresholds, thresholds,
10607                        n_thresholds * sizeof(s32));
10608
10609                 wdev->cqm_config = cqm_config;
10610         }
10611
10612         err = cfg80211_cqm_rssi_update(rdev, dev);
10613
10614 unlock:
10615         wdev_unlock(wdev);
10616
10617         return err;
10618 }
10619
10620 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
10621 {
10622         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
10623         struct nlattr *cqm;
10624         int err;
10625
10626         cqm = info->attrs[NL80211_ATTR_CQM];
10627         if (!cqm)
10628                 return -EINVAL;
10629
10630         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
10631                                nl80211_attr_cqm_policy, info->extack);
10632         if (err)
10633                 return err;
10634
10635         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
10636             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
10637                 const s32 *thresholds =
10638                         nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
10639                 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
10640                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
10641
10642                 if (len % 4)
10643                         return -EINVAL;
10644
10645                 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
10646                                             hysteresis);
10647         }
10648
10649         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
10650             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
10651             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
10652                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
10653                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
10654                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
10655
10656                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
10657         }
10658
10659         return -EINVAL;
10660 }
10661
10662 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
10663 {
10664         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10665         struct net_device *dev = info->user_ptr[1];
10666         struct ocb_setup setup = {};
10667         int err;
10668
10669         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
10670         if (err)
10671                 return err;
10672
10673         return cfg80211_join_ocb(rdev, dev, &setup);
10674 }
10675
10676 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
10677 {
10678         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10679         struct net_device *dev = info->user_ptr[1];
10680
10681         return cfg80211_leave_ocb(rdev, dev);
10682 }
10683
10684 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
10685 {
10686         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10687         struct net_device *dev = info->user_ptr[1];
10688         struct mesh_config cfg;
10689         struct mesh_setup setup;
10690         int err;
10691
10692         /* start with default */
10693         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
10694         memcpy(&setup, &default_mesh_setup, sizeof(setup));
10695
10696         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
10697                 /* and parse parameters if given */
10698                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
10699                 if (err)
10700                         return err;
10701         }
10702
10703         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
10704             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
10705                 return -EINVAL;
10706
10707         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
10708         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
10709
10710         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
10711             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
10712                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
10713                         return -EINVAL;
10714
10715         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
10716                 setup.beacon_interval =
10717                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
10718
10719                 err = cfg80211_validate_beacon_int(rdev,
10720                                                    NL80211_IFTYPE_MESH_POINT,
10721                                                    setup.beacon_interval);
10722                 if (err)
10723                         return err;
10724         }
10725
10726         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
10727                 setup.dtim_period =
10728                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
10729                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
10730                         return -EINVAL;
10731         }
10732
10733         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
10734                 /* parse additional setup parameters if given */
10735                 err = nl80211_parse_mesh_setup(info, &setup);
10736                 if (err)
10737                         return err;
10738         }
10739
10740         if (setup.user_mpm)
10741                 cfg.auto_open_plinks = false;
10742
10743         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
10744                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
10745                 if (err)
10746                         return err;
10747         } else {
10748                 /* __cfg80211_join_mesh() will sort it out */
10749                 setup.chandef.chan = NULL;
10750         }
10751
10752         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
10753                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10754                 int n_rates =
10755                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10756                 struct ieee80211_supported_band *sband;
10757
10758                 if (!setup.chandef.chan)
10759                         return -EINVAL;
10760
10761                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
10762
10763                 err = ieee80211_get_ratemask(sband, rates, n_rates,
10764                                              &setup.basic_rates);
10765                 if (err)
10766                         return err;
10767         }
10768
10769         if (info->attrs[NL80211_ATTR_TX_RATES]) {
10770                 err = nl80211_parse_tx_bitrate_mask(info, &setup.beacon_rate);
10771                 if (err)
10772                         return err;
10773
10774                 if (!setup.chandef.chan)
10775                         return -EINVAL;
10776
10777                 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
10778                                               &setup.beacon_rate);
10779                 if (err)
10780                         return err;
10781         }
10782
10783         setup.userspace_handles_dfs =
10784                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
10785
10786         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
10787                 int r = validate_pae_over_nl80211(rdev, info);
10788
10789                 if (r < 0)
10790                         return r;
10791
10792                 setup.control_port_over_nl80211 = true;
10793         }
10794
10795         wdev_lock(dev->ieee80211_ptr);
10796         err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
10797         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
10798                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
10799         wdev_unlock(dev->ieee80211_ptr);
10800
10801         return err;
10802 }
10803
10804 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
10805 {
10806         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10807         struct net_device *dev = info->user_ptr[1];
10808
10809         return cfg80211_leave_mesh(rdev, dev);
10810 }
10811
10812 #ifdef CONFIG_PM
10813 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
10814                                         struct cfg80211_registered_device *rdev)
10815 {
10816         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
10817         struct nlattr *nl_pats, *nl_pat;
10818         int i, pat_len;
10819
10820         if (!wowlan->n_patterns)
10821                 return 0;
10822
10823         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
10824         if (!nl_pats)
10825                 return -ENOBUFS;
10826
10827         for (i = 0; i < wowlan->n_patterns; i++) {
10828                 nl_pat = nla_nest_start(msg, i + 1);
10829                 if (!nl_pat)
10830                         return -ENOBUFS;
10831                 pat_len = wowlan->patterns[i].pattern_len;
10832                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
10833                             wowlan->patterns[i].mask) ||
10834                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
10835                             wowlan->patterns[i].pattern) ||
10836                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
10837                                 wowlan->patterns[i].pkt_offset))
10838                         return -ENOBUFS;
10839                 nla_nest_end(msg, nl_pat);
10840         }
10841         nla_nest_end(msg, nl_pats);
10842
10843         return 0;
10844 }
10845
10846 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
10847                                    struct cfg80211_wowlan_tcp *tcp)
10848 {
10849         struct nlattr *nl_tcp;
10850
10851         if (!tcp)
10852                 return 0;
10853
10854         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
10855         if (!nl_tcp)
10856                 return -ENOBUFS;
10857
10858         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
10859             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
10860             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
10861             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
10862             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
10863             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
10864                     tcp->payload_len, tcp->payload) ||
10865             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
10866                         tcp->data_interval) ||
10867             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
10868                     tcp->wake_len, tcp->wake_data) ||
10869             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
10870                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
10871                 return -ENOBUFS;
10872
10873         if (tcp->payload_seq.len &&
10874             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
10875                     sizeof(tcp->payload_seq), &tcp->payload_seq))
10876                 return -ENOBUFS;
10877
10878         if (tcp->payload_tok.len &&
10879             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
10880                     sizeof(tcp->payload_tok) + tcp->tokens_size,
10881                     &tcp->payload_tok))
10882                 return -ENOBUFS;
10883
10884         nla_nest_end(msg, nl_tcp);
10885
10886         return 0;
10887 }
10888
10889 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
10890                                   struct cfg80211_sched_scan_request *req)
10891 {
10892         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
10893         int i;
10894
10895         if (!req)
10896                 return 0;
10897
10898         nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
10899         if (!nd)
10900                 return -ENOBUFS;
10901
10902         if (req->n_scan_plans == 1 &&
10903             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
10904                         req->scan_plans[0].interval * 1000))
10905                 return -ENOBUFS;
10906
10907         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
10908                 return -ENOBUFS;
10909
10910         if (req->relative_rssi_set) {
10911                 struct nl80211_bss_select_rssi_adjust rssi_adjust;
10912
10913                 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
10914                                req->relative_rssi))
10915                         return -ENOBUFS;
10916
10917                 rssi_adjust.band = req->rssi_adjust.band;
10918                 rssi_adjust.delta = req->rssi_adjust.delta;
10919                 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
10920                             sizeof(rssi_adjust), &rssi_adjust))
10921                         return -ENOBUFS;
10922         }
10923
10924         freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
10925         if (!freqs)
10926                 return -ENOBUFS;
10927
10928         for (i = 0; i < req->n_channels; i++) {
10929                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
10930                         return -ENOBUFS;
10931         }
10932
10933         nla_nest_end(msg, freqs);
10934
10935         if (req->n_match_sets) {
10936                 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
10937                 if (!matches)
10938                         return -ENOBUFS;
10939
10940                 for (i = 0; i < req->n_match_sets; i++) {
10941                         match = nla_nest_start(msg, i);
10942                         if (!match)
10943                                 return -ENOBUFS;
10944
10945                         if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
10946                                     req->match_sets[i].ssid.ssid_len,
10947                                     req->match_sets[i].ssid.ssid))
10948                                 return -ENOBUFS;
10949                         nla_nest_end(msg, match);
10950                 }
10951                 nla_nest_end(msg, matches);
10952         }
10953
10954         scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
10955         if (!scan_plans)
10956                 return -ENOBUFS;
10957
10958         for (i = 0; i < req->n_scan_plans; i++) {
10959                 scan_plan = nla_nest_start(msg, i + 1);
10960                 if (!scan_plan)
10961                         return -ENOBUFS;
10962
10963                 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
10964                                 req->scan_plans[i].interval) ||
10965                     (req->scan_plans[i].iterations &&
10966                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
10967                                  req->scan_plans[i].iterations)))
10968                         return -ENOBUFS;
10969                 nla_nest_end(msg, scan_plan);
10970         }
10971         nla_nest_end(msg, scan_plans);
10972
10973         nla_nest_end(msg, nd);
10974
10975         return 0;
10976 }
10977
10978 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
10979 {
10980         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10981         struct sk_buff *msg;
10982         void *hdr;
10983         u32 size = NLMSG_DEFAULT_SIZE;
10984
10985         if (!rdev->wiphy.wowlan)
10986                 return -EOPNOTSUPP;
10987
10988         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
10989                 /* adjust size to have room for all the data */
10990                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
10991                         rdev->wiphy.wowlan_config->tcp->payload_len +
10992                         rdev->wiphy.wowlan_config->tcp->wake_len +
10993                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
10994         }
10995
10996         msg = nlmsg_new(size, GFP_KERNEL);
10997         if (!msg)
10998                 return -ENOMEM;
10999
11000         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11001                              NL80211_CMD_GET_WOWLAN);
11002         if (!hdr)
11003                 goto nla_put_failure;
11004
11005         if (rdev->wiphy.wowlan_config) {
11006                 struct nlattr *nl_wowlan;
11007
11008                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
11009                 if (!nl_wowlan)
11010                         goto nla_put_failure;
11011
11012                 if ((rdev->wiphy.wowlan_config->any &&
11013                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
11014                     (rdev->wiphy.wowlan_config->disconnect &&
11015                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
11016                     (rdev->wiphy.wowlan_config->magic_pkt &&
11017                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
11018                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
11019                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
11020                     (rdev->wiphy.wowlan_config->eap_identity_req &&
11021                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
11022                     (rdev->wiphy.wowlan_config->four_way_handshake &&
11023                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
11024                     (rdev->wiphy.wowlan_config->rfkill_release &&
11025                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
11026                         goto nla_put_failure;
11027
11028                 if (nl80211_send_wowlan_patterns(msg, rdev))
11029                         goto nla_put_failure;
11030
11031                 if (nl80211_send_wowlan_tcp(msg,
11032                                             rdev->wiphy.wowlan_config->tcp))
11033                         goto nla_put_failure;
11034
11035                 if (nl80211_send_wowlan_nd(
11036                             msg,
11037                             rdev->wiphy.wowlan_config->nd_config))
11038                         goto nla_put_failure;
11039
11040                 nla_nest_end(msg, nl_wowlan);
11041         }
11042
11043         genlmsg_end(msg, hdr);
11044         return genlmsg_reply(msg, info);
11045
11046 nla_put_failure:
11047         nlmsg_free(msg);
11048         return -ENOBUFS;
11049 }
11050
11051 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
11052                                     struct nlattr *attr,
11053                                     struct cfg80211_wowlan *trig)
11054 {
11055         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
11056         struct cfg80211_wowlan_tcp *cfg;
11057         struct nl80211_wowlan_tcp_data_token *tok = NULL;
11058         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
11059         u32 size;
11060         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
11061         int err, port;
11062
11063         if (!rdev->wiphy.wowlan->tcp)
11064                 return -EINVAL;
11065
11066         err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TCP, attr,
11067                                nl80211_wowlan_tcp_policy, NULL);
11068         if (err)
11069                 return err;
11070
11071         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
11072             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
11073             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
11074             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
11075             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
11076             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
11077             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
11078             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
11079                 return -EINVAL;
11080
11081         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
11082         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
11083                 return -EINVAL;
11084
11085         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
11086                         rdev->wiphy.wowlan->tcp->data_interval_max ||
11087             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
11088                 return -EINVAL;
11089
11090         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
11091         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
11092                 return -EINVAL;
11093
11094         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
11095         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
11096                 return -EINVAL;
11097
11098         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
11099                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
11100
11101                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
11102                 tokens_size = tokln - sizeof(*tok);
11103
11104                 if (!tok->len || tokens_size % tok->len)
11105                         return -EINVAL;
11106                 if (!rdev->wiphy.wowlan->tcp->tok)
11107                         return -EINVAL;
11108                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
11109                         return -EINVAL;
11110                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
11111                         return -EINVAL;
11112                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
11113                         return -EINVAL;
11114                 if (tok->offset + tok->len > data_size)
11115                         return -EINVAL;
11116         }
11117
11118         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
11119                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
11120                 if (!rdev->wiphy.wowlan->tcp->seq)
11121                         return -EINVAL;
11122                 if (seq->len == 0 || seq->len > 4)
11123                         return -EINVAL;
11124                 if (seq->len + seq->offset > data_size)
11125                         return -EINVAL;
11126         }
11127
11128         size = sizeof(*cfg);
11129         size += data_size;
11130         size += wake_size + wake_mask_size;
11131         size += tokens_size;
11132
11133         cfg = kzalloc(size, GFP_KERNEL);
11134         if (!cfg)
11135                 return -ENOMEM;
11136         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
11137         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
11138         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
11139                ETH_ALEN);
11140         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
11141                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
11142         else
11143                 port = 0;
11144 #ifdef CONFIG_INET
11145         /* allocate a socket and port for it and use it */
11146         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
11147                             IPPROTO_TCP, &cfg->sock, 1);
11148         if (err) {
11149                 kfree(cfg);
11150                 return err;
11151         }
11152         if (inet_csk_get_port(cfg->sock->sk, port)) {
11153                 sock_release(cfg->sock);
11154                 kfree(cfg);
11155                 return -EADDRINUSE;
11156         }
11157         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
11158 #else
11159         if (!port) {
11160                 kfree(cfg);
11161                 return -EINVAL;
11162         }
11163         cfg->src_port = port;
11164 #endif
11165
11166         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
11167         cfg->payload_len = data_size;
11168         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
11169         memcpy((void *)cfg->payload,
11170                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
11171                data_size);
11172         if (seq)
11173                 cfg->payload_seq = *seq;
11174         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
11175         cfg->wake_len = wake_size;
11176         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
11177         memcpy((void *)cfg->wake_data,
11178                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
11179                wake_size);
11180         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
11181                          data_size + wake_size;
11182         memcpy((void *)cfg->wake_mask,
11183                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
11184                wake_mask_size);
11185         if (tok) {
11186                 cfg->tokens_size = tokens_size;
11187                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
11188         }
11189
11190         trig->tcp = cfg;
11191
11192         return 0;
11193 }
11194
11195 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
11196                                    const struct wiphy_wowlan_support *wowlan,
11197                                    struct nlattr *attr,
11198                                    struct cfg80211_wowlan *trig)
11199 {
11200         struct nlattr **tb;
11201         int err;
11202
11203         tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
11204         if (!tb)
11205                 return -ENOMEM;
11206
11207         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
11208                 err = -EOPNOTSUPP;
11209                 goto out;
11210         }
11211
11212         err = nla_parse_nested(tb, NL80211_ATTR_MAX, attr, nl80211_policy,
11213                                NULL);
11214         if (err)
11215                 goto out;
11216
11217         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
11218                                                    wowlan->max_nd_match_sets);
11219         err = PTR_ERR_OR_ZERO(trig->nd_config);
11220         if (err)
11221                 trig->nd_config = NULL;
11222
11223 out:
11224         kfree(tb);
11225         return err;
11226 }
11227
11228 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
11229 {
11230         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11231         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
11232         struct cfg80211_wowlan new_triggers = {};
11233         struct cfg80211_wowlan *ntrig;
11234         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
11235         int err, i;
11236         bool prev_enabled = rdev->wiphy.wowlan_config;
11237         bool regular = false;
11238
11239         if (!wowlan)
11240                 return -EOPNOTSUPP;
11241
11242         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
11243                 cfg80211_rdev_free_wowlan(rdev);
11244                 rdev->wiphy.wowlan_config = NULL;
11245                 goto set_wakeup;
11246         }
11247
11248         err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TRIG,
11249                                info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
11250                                nl80211_wowlan_policy, info->extack);
11251         if (err)
11252                 return err;
11253
11254         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
11255                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
11256                         return -EINVAL;
11257                 new_triggers.any = true;
11258         }
11259
11260         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
11261                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
11262                         return -EINVAL;
11263                 new_triggers.disconnect = true;
11264                 regular = true;
11265         }
11266
11267         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
11268                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
11269                         return -EINVAL;
11270                 new_triggers.magic_pkt = true;
11271                 regular = true;
11272         }
11273
11274         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
11275                 return -EINVAL;
11276
11277         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
11278                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
11279                         return -EINVAL;
11280                 new_triggers.gtk_rekey_failure = true;
11281                 regular = true;
11282         }
11283
11284         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
11285                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
11286                         return -EINVAL;
11287                 new_triggers.eap_identity_req = true;
11288                 regular = true;
11289         }
11290
11291         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
11292                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
11293                         return -EINVAL;
11294                 new_triggers.four_way_handshake = true;
11295                 regular = true;
11296         }
11297
11298         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
11299                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
11300                         return -EINVAL;
11301                 new_triggers.rfkill_release = true;
11302                 regular = true;
11303         }
11304
11305         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
11306                 struct nlattr *pat;
11307                 int n_patterns = 0;
11308                 int rem, pat_len, mask_len, pkt_offset;
11309                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
11310
11311                 regular = true;
11312
11313                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
11314                                     rem)
11315                         n_patterns++;
11316                 if (n_patterns > wowlan->n_patterns)
11317                         return -EINVAL;
11318
11319                 new_triggers.patterns = kcalloc(n_patterns,
11320                                                 sizeof(new_triggers.patterns[0]),
11321                                                 GFP_KERNEL);
11322                 if (!new_triggers.patterns)
11323                         return -ENOMEM;
11324
11325                 new_triggers.n_patterns = n_patterns;
11326                 i = 0;
11327
11328                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
11329                                     rem) {
11330                         u8 *mask_pat;
11331
11332                         err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
11333                                                nl80211_packet_pattern_policy,
11334                                                info->extack);
11335                         if (err)
11336                                 goto error;
11337
11338                         err = -EINVAL;
11339                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
11340                             !pat_tb[NL80211_PKTPAT_PATTERN])
11341                                 goto error;
11342                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
11343                         mask_len = DIV_ROUND_UP(pat_len, 8);
11344                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
11345                                 goto error;
11346                         if (pat_len > wowlan->pattern_max_len ||
11347                             pat_len < wowlan->pattern_min_len)
11348                                 goto error;
11349
11350                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
11351                                 pkt_offset = 0;
11352                         else
11353                                 pkt_offset = nla_get_u32(
11354                                         pat_tb[NL80211_PKTPAT_OFFSET]);
11355                         if (pkt_offset > wowlan->max_pkt_offset)
11356                                 goto error;
11357                         new_triggers.patterns[i].pkt_offset = pkt_offset;
11358
11359                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
11360                         if (!mask_pat) {
11361                                 err = -ENOMEM;
11362                                 goto error;
11363                         }
11364                         new_triggers.patterns[i].mask = mask_pat;
11365                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
11366                                mask_len);
11367                         mask_pat += mask_len;
11368                         new_triggers.patterns[i].pattern = mask_pat;
11369                         new_triggers.patterns[i].pattern_len = pat_len;
11370                         memcpy(mask_pat,
11371                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
11372                                pat_len);
11373                         i++;
11374                 }
11375         }
11376
11377         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
11378                 regular = true;
11379                 err = nl80211_parse_wowlan_tcp(
11380                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
11381                         &new_triggers);
11382                 if (err)
11383                         goto error;
11384         }
11385
11386         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
11387                 regular = true;
11388                 err = nl80211_parse_wowlan_nd(
11389                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
11390                         &new_triggers);
11391                 if (err)
11392                         goto error;
11393         }
11394
11395         /* The 'any' trigger means the device continues operating more or less
11396          * as in its normal operation mode and wakes up the host on most of the
11397          * normal interrupts (like packet RX, ...)
11398          * It therefore makes little sense to combine with the more constrained
11399          * wakeup trigger modes.
11400          */
11401         if (new_triggers.any && regular) {
11402                 err = -EINVAL;
11403                 goto error;
11404         }
11405
11406         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
11407         if (!ntrig) {
11408                 err = -ENOMEM;
11409                 goto error;
11410         }
11411         cfg80211_rdev_free_wowlan(rdev);
11412         rdev->wiphy.wowlan_config = ntrig;
11413
11414  set_wakeup:
11415         if (rdev->ops->set_wakeup &&
11416             prev_enabled != !!rdev->wiphy.wowlan_config)
11417                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
11418
11419         return 0;
11420  error:
11421         for (i = 0; i < new_triggers.n_patterns; i++)
11422                 kfree(new_triggers.patterns[i].mask);
11423         kfree(new_triggers.patterns);
11424         if (new_triggers.tcp && new_triggers.tcp->sock)
11425                 sock_release(new_triggers.tcp->sock);
11426         kfree(new_triggers.tcp);
11427         kfree(new_triggers.nd_config);
11428         return err;
11429 }
11430 #endif
11431
11432 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
11433                                        struct cfg80211_registered_device *rdev)
11434 {
11435         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
11436         int i, j, pat_len;
11437         struct cfg80211_coalesce_rules *rule;
11438
11439         if (!rdev->coalesce->n_rules)
11440                 return 0;
11441
11442         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
11443         if (!nl_rules)
11444                 return -ENOBUFS;
11445
11446         for (i = 0; i < rdev->coalesce->n_rules; i++) {
11447                 nl_rule = nla_nest_start(msg, i + 1);
11448                 if (!nl_rule)
11449                         return -ENOBUFS;
11450
11451                 rule = &rdev->coalesce->rules[i];
11452                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
11453                                 rule->delay))
11454                         return -ENOBUFS;
11455
11456                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
11457                                 rule->condition))
11458                         return -ENOBUFS;
11459
11460                 nl_pats = nla_nest_start(msg,
11461                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
11462                 if (!nl_pats)
11463                         return -ENOBUFS;
11464
11465                 for (j = 0; j < rule->n_patterns; j++) {
11466                         nl_pat = nla_nest_start(msg, j + 1);
11467                         if (!nl_pat)
11468                                 return -ENOBUFS;
11469                         pat_len = rule->patterns[j].pattern_len;
11470                         if (nla_put(msg, NL80211_PKTPAT_MASK,
11471                                     DIV_ROUND_UP(pat_len, 8),
11472                                     rule->patterns[j].mask) ||
11473                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
11474                                     rule->patterns[j].pattern) ||
11475                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
11476                                         rule->patterns[j].pkt_offset))
11477                                 return -ENOBUFS;
11478                         nla_nest_end(msg, nl_pat);
11479                 }
11480                 nla_nest_end(msg, nl_pats);
11481                 nla_nest_end(msg, nl_rule);
11482         }
11483         nla_nest_end(msg, nl_rules);
11484
11485         return 0;
11486 }
11487
11488 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
11489 {
11490         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11491         struct sk_buff *msg;
11492         void *hdr;
11493
11494         if (!rdev->wiphy.coalesce)
11495                 return -EOPNOTSUPP;
11496
11497         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11498         if (!msg)
11499                 return -ENOMEM;
11500
11501         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11502                              NL80211_CMD_GET_COALESCE);
11503         if (!hdr)
11504                 goto nla_put_failure;
11505
11506         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
11507                 goto nla_put_failure;
11508
11509         genlmsg_end(msg, hdr);
11510         return genlmsg_reply(msg, info);
11511
11512 nla_put_failure:
11513         nlmsg_free(msg);
11514         return -ENOBUFS;
11515 }
11516
11517 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
11518 {
11519         struct cfg80211_coalesce *coalesce = rdev->coalesce;
11520         int i, j;
11521         struct cfg80211_coalesce_rules *rule;
11522
11523         if (!coalesce)
11524                 return;
11525
11526         for (i = 0; i < coalesce->n_rules; i++) {
11527                 rule = &coalesce->rules[i];
11528                 for (j = 0; j < rule->n_patterns; j++)
11529                         kfree(rule->patterns[j].mask);
11530                 kfree(rule->patterns);
11531         }
11532         kfree(coalesce->rules);
11533         kfree(coalesce);
11534         rdev->coalesce = NULL;
11535 }
11536
11537 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
11538                                        struct nlattr *rule,
11539                                        struct cfg80211_coalesce_rules *new_rule)
11540 {
11541         int err, i;
11542         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
11543         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
11544         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
11545         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
11546
11547         err = nla_parse_nested(tb, NL80211_ATTR_COALESCE_RULE_MAX, rule,
11548                                nl80211_coalesce_policy, NULL);
11549         if (err)
11550                 return err;
11551
11552         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
11553                 new_rule->delay =
11554                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
11555         if (new_rule->delay > coalesce->max_delay)
11556                 return -EINVAL;
11557
11558         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
11559                 new_rule->condition =
11560                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
11561
11562         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
11563                 return -EINVAL;
11564
11565         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
11566                             rem)
11567                 n_patterns++;
11568         if (n_patterns > coalesce->n_patterns)
11569                 return -EINVAL;
11570
11571         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
11572                                      GFP_KERNEL);
11573         if (!new_rule->patterns)
11574                 return -ENOMEM;
11575
11576         new_rule->n_patterns = n_patterns;
11577         i = 0;
11578
11579         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
11580                             rem) {
11581                 u8 *mask_pat;
11582
11583                 err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
11584                                        nl80211_packet_pattern_policy, NULL);
11585                 if (err)
11586                         return err;
11587
11588                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
11589                     !pat_tb[NL80211_PKTPAT_PATTERN])
11590                         return -EINVAL;
11591                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
11592                 mask_len = DIV_ROUND_UP(pat_len, 8);
11593                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
11594                         return -EINVAL;
11595                 if (pat_len > coalesce->pattern_max_len ||
11596                     pat_len < coalesce->pattern_min_len)
11597                         return -EINVAL;
11598
11599                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
11600                         pkt_offset = 0;
11601                 else
11602                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
11603                 if (pkt_offset > coalesce->max_pkt_offset)
11604                         return -EINVAL;
11605                 new_rule->patterns[i].pkt_offset = pkt_offset;
11606
11607                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
11608                 if (!mask_pat)
11609                         return -ENOMEM;
11610
11611                 new_rule->patterns[i].mask = mask_pat;
11612                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
11613                        mask_len);
11614
11615                 mask_pat += mask_len;
11616                 new_rule->patterns[i].pattern = mask_pat;
11617                 new_rule->patterns[i].pattern_len = pat_len;
11618                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
11619                        pat_len);
11620                 i++;
11621         }
11622
11623         return 0;
11624 }
11625
11626 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
11627 {
11628         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11629         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
11630         struct cfg80211_coalesce new_coalesce = {};
11631         struct cfg80211_coalesce *n_coalesce;
11632         int err, rem_rule, n_rules = 0, i, j;
11633         struct nlattr *rule;
11634         struct cfg80211_coalesce_rules *tmp_rule;
11635
11636         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
11637                 return -EOPNOTSUPP;
11638
11639         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
11640                 cfg80211_rdev_free_coalesce(rdev);
11641                 rdev_set_coalesce(rdev, NULL);
11642                 return 0;
11643         }
11644
11645         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
11646                             rem_rule)
11647                 n_rules++;
11648         if (n_rules > coalesce->n_rules)
11649                 return -EINVAL;
11650
11651         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
11652                                      GFP_KERNEL);
11653         if (!new_coalesce.rules)
11654                 return -ENOMEM;
11655
11656         new_coalesce.n_rules = n_rules;
11657         i = 0;
11658
11659         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
11660                             rem_rule) {
11661                 err = nl80211_parse_coalesce_rule(rdev, rule,
11662                                                   &new_coalesce.rules[i]);
11663                 if (err)
11664                         goto error;
11665
11666                 i++;
11667         }
11668
11669         err = rdev_set_coalesce(rdev, &new_coalesce);
11670         if (err)
11671                 goto error;
11672
11673         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
11674         if (!n_coalesce) {
11675                 err = -ENOMEM;
11676                 goto error;
11677         }
11678         cfg80211_rdev_free_coalesce(rdev);
11679         rdev->coalesce = n_coalesce;
11680
11681         return 0;
11682 error:
11683         for (i = 0; i < new_coalesce.n_rules; i++) {
11684                 tmp_rule = &new_coalesce.rules[i];
11685                 for (j = 0; j < tmp_rule->n_patterns; j++)
11686                         kfree(tmp_rule->patterns[j].mask);
11687                 kfree(tmp_rule->patterns);
11688         }
11689         kfree(new_coalesce.rules);
11690
11691         return err;
11692 }
11693
11694 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
11695 {
11696         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11697         struct net_device *dev = info->user_ptr[1];
11698         struct wireless_dev *wdev = dev->ieee80211_ptr;
11699         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
11700         struct cfg80211_gtk_rekey_data rekey_data;
11701         int err;
11702
11703         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
11704                 return -EINVAL;
11705
11706         err = nla_parse_nested(tb, MAX_NL80211_REKEY_DATA,
11707                                info->attrs[NL80211_ATTR_REKEY_DATA],
11708                                nl80211_rekey_policy, info->extack);
11709         if (err)
11710                 return err;
11711
11712         if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
11713             !tb[NL80211_REKEY_DATA_KCK])
11714                 return -EINVAL;
11715         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
11716                 return -ERANGE;
11717         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
11718                 return -ERANGE;
11719         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
11720                 return -ERANGE;
11721
11722         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
11723         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
11724         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
11725
11726         wdev_lock(wdev);
11727         if (!wdev->current_bss) {
11728                 err = -ENOTCONN;
11729                 goto out;
11730         }
11731
11732         if (!rdev->ops->set_rekey_data) {
11733                 err = -EOPNOTSUPP;
11734                 goto out;
11735         }
11736
11737         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
11738  out:
11739         wdev_unlock(wdev);
11740         return err;
11741 }
11742
11743 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
11744                                              struct genl_info *info)
11745 {
11746         struct net_device *dev = info->user_ptr[1];
11747         struct wireless_dev *wdev = dev->ieee80211_ptr;
11748
11749         if (wdev->iftype != NL80211_IFTYPE_AP &&
11750             wdev->iftype != NL80211_IFTYPE_P2P_GO)
11751                 return -EINVAL;
11752
11753         if (wdev->ap_unexpected_nlportid)
11754                 return -EBUSY;
11755
11756         wdev->ap_unexpected_nlportid = info->snd_portid;
11757         return 0;
11758 }
11759
11760 static int nl80211_probe_client(struct sk_buff *skb,
11761                                 struct genl_info *info)
11762 {
11763         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11764         struct net_device *dev = info->user_ptr[1];
11765         struct wireless_dev *wdev = dev->ieee80211_ptr;
11766         struct sk_buff *msg;
11767         void *hdr;
11768         const u8 *addr;
11769         u64 cookie;
11770         int err;
11771
11772         if (wdev->iftype != NL80211_IFTYPE_AP &&
11773             wdev->iftype != NL80211_IFTYPE_P2P_GO)
11774                 return -EOPNOTSUPP;
11775
11776         if (!info->attrs[NL80211_ATTR_MAC])
11777                 return -EINVAL;
11778
11779         if (!rdev->ops->probe_client)
11780                 return -EOPNOTSUPP;
11781
11782         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11783         if (!msg)
11784                 return -ENOMEM;
11785
11786         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11787                              NL80211_CMD_PROBE_CLIENT);
11788         if (!hdr) {
11789                 err = -ENOBUFS;
11790                 goto free_msg;
11791         }
11792
11793         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
11794
11795         err = rdev_probe_client(rdev, dev, addr, &cookie);
11796         if (err)
11797                 goto free_msg;
11798
11799         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11800                               NL80211_ATTR_PAD))
11801                 goto nla_put_failure;
11802
11803         genlmsg_end(msg, hdr);
11804
11805         return genlmsg_reply(msg, info);
11806
11807  nla_put_failure:
11808         err = -ENOBUFS;
11809  free_msg:
11810         nlmsg_free(msg);
11811         return err;
11812 }
11813
11814 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
11815 {
11816         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11817         struct cfg80211_beacon_registration *reg, *nreg;
11818         int rv;
11819
11820         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
11821                 return -EOPNOTSUPP;
11822
11823         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
11824         if (!nreg)
11825                 return -ENOMEM;
11826
11827         /* First, check if already registered. */
11828         spin_lock_bh(&rdev->beacon_registrations_lock);
11829         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
11830                 if (reg->nlportid == info->snd_portid) {
11831                         rv = -EALREADY;
11832                         goto out_err;
11833                 }
11834         }
11835         /* Add it to the list */
11836         nreg->nlportid = info->snd_portid;
11837         list_add(&nreg->list, &rdev->beacon_registrations);
11838
11839         spin_unlock_bh(&rdev->beacon_registrations_lock);
11840
11841         return 0;
11842 out_err:
11843         spin_unlock_bh(&rdev->beacon_registrations_lock);
11844         kfree(nreg);
11845         return rv;
11846 }
11847
11848 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
11849 {
11850         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11851         struct wireless_dev *wdev = info->user_ptr[1];
11852         int err;
11853
11854         if (!rdev->ops->start_p2p_device)
11855                 return -EOPNOTSUPP;
11856
11857         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11858                 return -EOPNOTSUPP;
11859
11860         if (wdev_running(wdev))
11861                 return 0;
11862
11863         if (rfkill_blocked(rdev->rfkill))
11864                 return -ERFKILL;
11865
11866         err = rdev_start_p2p_device(rdev, wdev);
11867         if (err)
11868                 return err;
11869
11870         wdev->is_running = true;
11871         rdev->opencount++;
11872
11873         return 0;
11874 }
11875
11876 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
11877 {
11878         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11879         struct wireless_dev *wdev = info->user_ptr[1];
11880
11881         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11882                 return -EOPNOTSUPP;
11883
11884         if (!rdev->ops->stop_p2p_device)
11885                 return -EOPNOTSUPP;
11886
11887         cfg80211_stop_p2p_device(rdev, wdev);
11888
11889         return 0;
11890 }
11891
11892 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
11893 {
11894         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11895         struct wireless_dev *wdev = info->user_ptr[1];
11896         struct cfg80211_nan_conf conf = {};
11897         int err;
11898
11899         if (wdev->iftype != NL80211_IFTYPE_NAN)
11900                 return -EOPNOTSUPP;
11901
11902         if (wdev_running(wdev))
11903                 return -EEXIST;
11904
11905         if (rfkill_blocked(rdev->rfkill))
11906                 return -ERFKILL;
11907
11908         if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
11909                 return -EINVAL;
11910
11911         conf.master_pref =
11912                 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
11913
11914         if (info->attrs[NL80211_ATTR_BANDS]) {
11915                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
11916
11917                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
11918                         return -EOPNOTSUPP;
11919
11920                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
11921                         return -EINVAL;
11922
11923                 conf.bands = bands;
11924         }
11925
11926         err = rdev_start_nan(rdev, wdev, &conf);
11927         if (err)
11928                 return err;
11929
11930         wdev->is_running = true;
11931         rdev->opencount++;
11932
11933         return 0;
11934 }
11935
11936 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
11937 {
11938         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11939         struct wireless_dev *wdev = info->user_ptr[1];
11940
11941         if (wdev->iftype != NL80211_IFTYPE_NAN)
11942                 return -EOPNOTSUPP;
11943
11944         cfg80211_stop_nan(rdev, wdev);
11945
11946         return 0;
11947 }
11948
11949 static int validate_nan_filter(struct nlattr *filter_attr)
11950 {
11951         struct nlattr *attr;
11952         int len = 0, n_entries = 0, rem;
11953
11954         nla_for_each_nested(attr, filter_attr, rem) {
11955                 len += nla_len(attr);
11956                 n_entries++;
11957         }
11958
11959         if (len >= U8_MAX)
11960                 return -EINVAL;
11961
11962         return n_entries;
11963 }
11964
11965 static int handle_nan_filter(struct nlattr *attr_filter,
11966                              struct cfg80211_nan_func *func,
11967                              bool tx)
11968 {
11969         struct nlattr *attr;
11970         int n_entries, rem, i;
11971         struct cfg80211_nan_func_filter *filter;
11972
11973         n_entries = validate_nan_filter(attr_filter);
11974         if (n_entries < 0)
11975                 return n_entries;
11976
11977         BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
11978
11979         filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
11980         if (!filter)
11981                 return -ENOMEM;
11982
11983         i = 0;
11984         nla_for_each_nested(attr, attr_filter, rem) {
11985                 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
11986                 filter[i].len = nla_len(attr);
11987                 i++;
11988         }
11989         if (tx) {
11990                 func->num_tx_filters = n_entries;
11991                 func->tx_filters = filter;
11992         } else {
11993                 func->num_rx_filters = n_entries;
11994                 func->rx_filters = filter;
11995         }
11996
11997         return 0;
11998 }
11999
12000 static int nl80211_nan_add_func(struct sk_buff *skb,
12001                                 struct genl_info *info)
12002 {
12003         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12004         struct wireless_dev *wdev = info->user_ptr[1];
12005         struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
12006         struct cfg80211_nan_func *func;
12007         struct sk_buff *msg = NULL;
12008         void *hdr = NULL;
12009         int err = 0;
12010
12011         if (wdev->iftype != NL80211_IFTYPE_NAN)
12012                 return -EOPNOTSUPP;
12013
12014         if (!wdev_running(wdev))
12015                 return -ENOTCONN;
12016
12017         if (!info->attrs[NL80211_ATTR_NAN_FUNC])
12018                 return -EINVAL;
12019
12020         err = nla_parse_nested(tb, NL80211_NAN_FUNC_ATTR_MAX,
12021                                info->attrs[NL80211_ATTR_NAN_FUNC],
12022                                nl80211_nan_func_policy, info->extack);
12023         if (err)
12024                 return err;
12025
12026         func = kzalloc(sizeof(*func), GFP_KERNEL);
12027         if (!func)
12028                 return -ENOMEM;
12029
12030         func->cookie = cfg80211_assign_cookie(rdev);
12031
12032         if (!tb[NL80211_NAN_FUNC_TYPE] ||
12033             nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]) > NL80211_NAN_FUNC_MAX_TYPE) {
12034                 err = -EINVAL;
12035                 goto out;
12036         }
12037
12038
12039         func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
12040
12041         if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
12042                 err = -EINVAL;
12043                 goto out;
12044         }
12045
12046         memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
12047                sizeof(func->service_id));
12048
12049         func->close_range =
12050                 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
12051
12052         if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
12053                 func->serv_spec_info_len =
12054                         nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
12055                 func->serv_spec_info =
12056                         kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
12057                                 func->serv_spec_info_len,
12058                                 GFP_KERNEL);
12059                 if (!func->serv_spec_info) {
12060                         err = -ENOMEM;
12061                         goto out;
12062                 }
12063         }
12064
12065         if (tb[NL80211_NAN_FUNC_TTL])
12066                 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
12067
12068         switch (func->type) {
12069         case NL80211_NAN_FUNC_PUBLISH:
12070                 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
12071                         err = -EINVAL;
12072                         goto out;
12073                 }
12074
12075                 func->publish_type =
12076                         nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
12077                 func->publish_bcast =
12078                         nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
12079
12080                 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
12081                         func->publish_bcast) {
12082                         err = -EINVAL;
12083                         goto out;
12084                 }
12085                 break;
12086         case NL80211_NAN_FUNC_SUBSCRIBE:
12087                 func->subscribe_active =
12088                         nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
12089                 break;
12090         case NL80211_NAN_FUNC_FOLLOW_UP:
12091                 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
12092                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
12093                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
12094                         err = -EINVAL;
12095                         goto out;
12096                 }
12097
12098                 func->followup_id =
12099                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
12100                 func->followup_reqid =
12101                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
12102                 memcpy(func->followup_dest.addr,
12103                        nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
12104                        sizeof(func->followup_dest.addr));
12105                 if (func->ttl) {
12106                         err = -EINVAL;
12107                         goto out;
12108                 }
12109                 break;
12110         default:
12111                 err = -EINVAL;
12112                 goto out;
12113         }
12114
12115         if (tb[NL80211_NAN_FUNC_SRF]) {
12116                 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
12117
12118                 err = nla_parse_nested(srf_tb, NL80211_NAN_SRF_ATTR_MAX,
12119                                        tb[NL80211_NAN_FUNC_SRF],
12120                                        nl80211_nan_srf_policy, info->extack);
12121                 if (err)
12122                         goto out;
12123
12124                 func->srf_include =
12125                         nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
12126
12127                 if (srf_tb[NL80211_NAN_SRF_BF]) {
12128                         if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
12129                             !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
12130                                 err = -EINVAL;
12131                                 goto out;
12132                         }
12133
12134                         func->srf_bf_len =
12135                                 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
12136                         func->srf_bf =
12137                                 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
12138                                         func->srf_bf_len, GFP_KERNEL);
12139                         if (!func->srf_bf) {
12140                                 err = -ENOMEM;
12141                                 goto out;
12142                         }
12143
12144                         func->srf_bf_idx =
12145                                 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
12146                 } else {
12147                         struct nlattr *attr, *mac_attr =
12148                                 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
12149                         int n_entries, rem, i = 0;
12150
12151                         if (!mac_attr) {
12152                                 err = -EINVAL;
12153                                 goto out;
12154                         }
12155
12156                         n_entries = validate_acl_mac_addrs(mac_attr);
12157                         if (n_entries <= 0) {
12158                                 err = -EINVAL;
12159                                 goto out;
12160                         }
12161
12162                         func->srf_num_macs = n_entries;
12163                         func->srf_macs =
12164                                 kcalloc(n_entries, sizeof(*func->srf_macs),
12165                                         GFP_KERNEL);
12166                         if (!func->srf_macs) {
12167                                 err = -ENOMEM;
12168                                 goto out;
12169                         }
12170
12171                         nla_for_each_nested(attr, mac_attr, rem)
12172                                 memcpy(func->srf_macs[i++].addr, nla_data(attr),
12173                                        sizeof(*func->srf_macs));
12174                 }
12175         }
12176
12177         if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
12178                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
12179                                         func, true);
12180                 if (err)
12181                         goto out;
12182         }
12183
12184         if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
12185                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
12186                                         func, false);
12187                 if (err)
12188                         goto out;
12189         }
12190
12191         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12192         if (!msg) {
12193                 err = -ENOMEM;
12194                 goto out;
12195         }
12196
12197         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12198                              NL80211_CMD_ADD_NAN_FUNCTION);
12199         /* This can't really happen - we just allocated 4KB */
12200         if (WARN_ON(!hdr)) {
12201                 err = -ENOMEM;
12202                 goto out;
12203         }
12204
12205         err = rdev_add_nan_func(rdev, wdev, func);
12206 out:
12207         if (err < 0) {
12208                 cfg80211_free_nan_func(func);
12209                 nlmsg_free(msg);
12210                 return err;
12211         }
12212
12213         /* propagate the instance id and cookie to userspace  */
12214         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
12215                               NL80211_ATTR_PAD))
12216                 goto nla_put_failure;
12217
12218         func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
12219         if (!func_attr)
12220                 goto nla_put_failure;
12221
12222         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
12223                        func->instance_id))
12224                 goto nla_put_failure;
12225
12226         nla_nest_end(msg, func_attr);
12227
12228         genlmsg_end(msg, hdr);
12229         return genlmsg_reply(msg, info);
12230
12231 nla_put_failure:
12232         nlmsg_free(msg);
12233         return -ENOBUFS;
12234 }
12235
12236 static int nl80211_nan_del_func(struct sk_buff *skb,
12237                                struct genl_info *info)
12238 {
12239         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12240         struct wireless_dev *wdev = info->user_ptr[1];
12241         u64 cookie;
12242
12243         if (wdev->iftype != NL80211_IFTYPE_NAN)
12244                 return -EOPNOTSUPP;
12245
12246         if (!wdev_running(wdev))
12247                 return -ENOTCONN;
12248
12249         if (!info->attrs[NL80211_ATTR_COOKIE])
12250                 return -EINVAL;
12251
12252         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12253
12254         rdev_del_nan_func(rdev, wdev, cookie);
12255
12256         return 0;
12257 }
12258
12259 static int nl80211_nan_change_config(struct sk_buff *skb,
12260                                      struct genl_info *info)
12261 {
12262         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12263         struct wireless_dev *wdev = info->user_ptr[1];
12264         struct cfg80211_nan_conf conf = {};
12265         u32 changed = 0;
12266
12267         if (wdev->iftype != NL80211_IFTYPE_NAN)
12268                 return -EOPNOTSUPP;
12269
12270         if (!wdev_running(wdev))
12271                 return -ENOTCONN;
12272
12273         if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
12274                 conf.master_pref =
12275                         nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
12276                 if (conf.master_pref <= 1 || conf.master_pref == 255)
12277                         return -EINVAL;
12278
12279                 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
12280         }
12281
12282         if (info->attrs[NL80211_ATTR_BANDS]) {
12283                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
12284
12285                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
12286                         return -EOPNOTSUPP;
12287
12288                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
12289                         return -EINVAL;
12290
12291                 conf.bands = bands;
12292                 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
12293         }
12294
12295         if (!changed)
12296                 return -EINVAL;
12297
12298         return rdev_nan_change_conf(rdev, wdev, &conf, changed);
12299 }
12300
12301 void cfg80211_nan_match(struct wireless_dev *wdev,
12302                         struct cfg80211_nan_match_params *match, gfp_t gfp)
12303 {
12304         struct wiphy *wiphy = wdev->wiphy;
12305         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12306         struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
12307         struct sk_buff *msg;
12308         void *hdr;
12309
12310         if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
12311                 return;
12312
12313         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12314         if (!msg)
12315                 return;
12316
12317         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
12318         if (!hdr) {
12319                 nlmsg_free(msg);
12320                 return;
12321         }
12322
12323         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12324             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12325                                          wdev->netdev->ifindex)) ||
12326             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12327                               NL80211_ATTR_PAD))
12328                 goto nla_put_failure;
12329
12330         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
12331                               NL80211_ATTR_PAD) ||
12332             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
12333                 goto nla_put_failure;
12334
12335         match_attr = nla_nest_start(msg, NL80211_ATTR_NAN_MATCH);
12336         if (!match_attr)
12337                 goto nla_put_failure;
12338
12339         local_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_LOCAL);
12340         if (!local_func_attr)
12341                 goto nla_put_failure;
12342
12343         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
12344                 goto nla_put_failure;
12345
12346         nla_nest_end(msg, local_func_attr);
12347
12348         peer_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_PEER);
12349         if (!peer_func_attr)
12350                 goto nla_put_failure;
12351
12352         if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
12353             nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
12354                 goto nla_put_failure;
12355
12356         if (match->info && match->info_len &&
12357             nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
12358                     match->info))
12359                 goto nla_put_failure;
12360
12361         nla_nest_end(msg, peer_func_attr);
12362         nla_nest_end(msg, match_attr);
12363         genlmsg_end(msg, hdr);
12364
12365         if (!wdev->owner_nlportid)
12366                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12367                                         msg, 0, NL80211_MCGRP_NAN, gfp);
12368         else
12369                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
12370                                 wdev->owner_nlportid);
12371
12372         return;
12373
12374 nla_put_failure:
12375         nlmsg_free(msg);
12376 }
12377 EXPORT_SYMBOL(cfg80211_nan_match);
12378
12379 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
12380                                   u8 inst_id,
12381                                   enum nl80211_nan_func_term_reason reason,
12382                                   u64 cookie, gfp_t gfp)
12383 {
12384         struct wiphy *wiphy = wdev->wiphy;
12385         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12386         struct sk_buff *msg;
12387         struct nlattr *func_attr;
12388         void *hdr;
12389
12390         if (WARN_ON(!inst_id))
12391                 return;
12392
12393         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12394         if (!msg)
12395                 return;
12396
12397         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
12398         if (!hdr) {
12399                 nlmsg_free(msg);
12400                 return;
12401         }
12402
12403         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12404             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12405                                          wdev->netdev->ifindex)) ||
12406             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12407                               NL80211_ATTR_PAD))
12408                 goto nla_put_failure;
12409
12410         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12411                               NL80211_ATTR_PAD))
12412                 goto nla_put_failure;
12413
12414         func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
12415         if (!func_attr)
12416                 goto nla_put_failure;
12417
12418         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
12419             nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
12420                 goto nla_put_failure;
12421
12422         nla_nest_end(msg, func_attr);
12423         genlmsg_end(msg, hdr);
12424
12425         if (!wdev->owner_nlportid)
12426                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12427                                         msg, 0, NL80211_MCGRP_NAN, gfp);
12428         else
12429                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
12430                                 wdev->owner_nlportid);
12431
12432         return;
12433
12434 nla_put_failure:
12435         nlmsg_free(msg);
12436 }
12437 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
12438
12439 static int nl80211_get_protocol_features(struct sk_buff *skb,
12440                                          struct genl_info *info)
12441 {
12442         void *hdr;
12443         struct sk_buff *msg;
12444
12445         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12446         if (!msg)
12447                 return -ENOMEM;
12448
12449         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12450                              NL80211_CMD_GET_PROTOCOL_FEATURES);
12451         if (!hdr)
12452                 goto nla_put_failure;
12453
12454         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
12455                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
12456                 goto nla_put_failure;
12457
12458         genlmsg_end(msg, hdr);
12459         return genlmsg_reply(msg, info);
12460
12461  nla_put_failure:
12462         kfree_skb(msg);
12463         return -ENOBUFS;
12464 }
12465
12466 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
12467 {
12468         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12469         struct cfg80211_update_ft_ies_params ft_params;
12470         struct net_device *dev = info->user_ptr[1];
12471
12472         if (!rdev->ops->update_ft_ies)
12473                 return -EOPNOTSUPP;
12474
12475         if (!info->attrs[NL80211_ATTR_MDID] ||
12476             !info->attrs[NL80211_ATTR_IE])
12477                 return -EINVAL;
12478
12479         memset(&ft_params, 0, sizeof(ft_params));
12480         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
12481         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12482         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12483
12484         return rdev_update_ft_ies(rdev, dev, &ft_params);
12485 }
12486
12487 static int nl80211_crit_protocol_start(struct sk_buff *skb,
12488                                        struct genl_info *info)
12489 {
12490         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12491         struct wireless_dev *wdev = info->user_ptr[1];
12492         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
12493         u16 duration;
12494         int ret;
12495
12496         if (!rdev->ops->crit_proto_start)
12497                 return -EOPNOTSUPP;
12498
12499         if (WARN_ON(!rdev->ops->crit_proto_stop))
12500                 return -EINVAL;
12501
12502         if (rdev->crit_proto_nlportid)
12503                 return -EBUSY;
12504
12505         /* determine protocol if provided */
12506         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
12507                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
12508
12509         if (proto >= NUM_NL80211_CRIT_PROTO)
12510                 return -EINVAL;
12511
12512         /* timeout must be provided */
12513         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
12514                 return -EINVAL;
12515
12516         duration =
12517                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
12518
12519         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
12520                 return -ERANGE;
12521
12522         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
12523         if (!ret)
12524                 rdev->crit_proto_nlportid = info->snd_portid;
12525
12526         return ret;
12527 }
12528
12529 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
12530                                       struct genl_info *info)
12531 {
12532         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12533         struct wireless_dev *wdev = info->user_ptr[1];
12534
12535         if (!rdev->ops->crit_proto_stop)
12536                 return -EOPNOTSUPP;
12537
12538         if (rdev->crit_proto_nlportid) {
12539                 rdev->crit_proto_nlportid = 0;
12540                 rdev_crit_proto_stop(rdev, wdev);
12541         }
12542         return 0;
12543 }
12544
12545 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
12546 {
12547         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12548         struct wireless_dev *wdev =
12549                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
12550         int i, err;
12551         u32 vid, subcmd;
12552
12553         if (!rdev->wiphy.vendor_commands)
12554                 return -EOPNOTSUPP;
12555
12556         if (IS_ERR(wdev)) {
12557                 err = PTR_ERR(wdev);
12558                 if (err != -EINVAL)
12559                         return err;
12560                 wdev = NULL;
12561         } else if (wdev->wiphy != &rdev->wiphy) {
12562                 return -EINVAL;
12563         }
12564
12565         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
12566             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
12567                 return -EINVAL;
12568
12569         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
12570         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
12571         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
12572                 const struct wiphy_vendor_command *vcmd;
12573                 void *data = NULL;
12574                 int len = 0;
12575
12576                 vcmd = &rdev->wiphy.vendor_commands[i];
12577
12578                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
12579                         continue;
12580
12581                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
12582                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
12583                         if (!wdev)
12584                                 return -EINVAL;
12585                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
12586                             !wdev->netdev)
12587                                 return -EINVAL;
12588
12589                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
12590                                 if (!wdev_running(wdev))
12591                                         return -ENETDOWN;
12592                         }
12593
12594                         if (!vcmd->doit)
12595                                 return -EOPNOTSUPP;
12596                 } else {
12597                         wdev = NULL;
12598                 }
12599
12600                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
12601                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
12602                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
12603                 }
12604
12605                 rdev->cur_cmd_info = info;
12606                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
12607                                                           data, len);
12608                 rdev->cur_cmd_info = NULL;
12609                 return err;
12610         }
12611
12612         return -EOPNOTSUPP;
12613 }
12614
12615 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
12616                                        struct netlink_callback *cb,
12617                                        struct cfg80211_registered_device **rdev,
12618                                        struct wireless_dev **wdev)
12619 {
12620         struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
12621         u32 vid, subcmd;
12622         unsigned int i;
12623         int vcmd_idx = -1;
12624         int err;
12625         void *data = NULL;
12626         unsigned int data_len = 0;
12627
12628         if (cb->args[0]) {
12629                 /* subtract the 1 again here */
12630                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
12631                 struct wireless_dev *tmp;
12632
12633                 if (!wiphy)
12634                         return -ENODEV;
12635                 *rdev = wiphy_to_rdev(wiphy);
12636                 *wdev = NULL;
12637
12638                 if (cb->args[1]) {
12639                         list_for_each_entry(tmp, &wiphy->wdev_list, list) {
12640                                 if (tmp->identifier == cb->args[1] - 1) {
12641                                         *wdev = tmp;
12642                                         break;
12643                                 }
12644                         }
12645                 }
12646
12647                 /* keep rtnl locked in successful case */
12648                 return 0;
12649         }
12650
12651         err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, attrbuf,
12652                           nl80211_fam.maxattr, nl80211_policy, NULL);
12653         if (err)
12654                 return err;
12655
12656         if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
12657             !attrbuf[NL80211_ATTR_VENDOR_SUBCMD])
12658                 return -EINVAL;
12659
12660         *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf);
12661         if (IS_ERR(*wdev))
12662                 *wdev = NULL;
12663
12664         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
12665         if (IS_ERR(*rdev))
12666                 return PTR_ERR(*rdev);
12667
12668         vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
12669         subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
12670
12671         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
12672                 const struct wiphy_vendor_command *vcmd;
12673
12674                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
12675
12676                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
12677                         continue;
12678
12679                 if (!vcmd->dumpit)
12680                         return -EOPNOTSUPP;
12681
12682                 vcmd_idx = i;
12683                 break;
12684         }
12685
12686         if (vcmd_idx < 0)
12687                 return -EOPNOTSUPP;
12688
12689         if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
12690                 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
12691                 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
12692         }
12693
12694         /* 0 is the first index - add 1 to parse only once */
12695         cb->args[0] = (*rdev)->wiphy_idx + 1;
12696         /* add 1 to know if it was NULL */
12697         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
12698         cb->args[2] = vcmd_idx;
12699         cb->args[3] = (unsigned long)data;
12700         cb->args[4] = data_len;
12701
12702         /* keep rtnl locked in successful case */
12703         return 0;
12704 }
12705
12706 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
12707                                    struct netlink_callback *cb)
12708 {
12709         struct cfg80211_registered_device *rdev;
12710         struct wireless_dev *wdev;
12711         unsigned int vcmd_idx;
12712         const struct wiphy_vendor_command *vcmd;
12713         void *data;
12714         int data_len;
12715         int err;
12716         struct nlattr *vendor_data;
12717
12718         rtnl_lock();
12719         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
12720         if (err)
12721                 goto out;
12722
12723         vcmd_idx = cb->args[2];
12724         data = (void *)cb->args[3];
12725         data_len = cb->args[4];
12726         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
12727
12728         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
12729                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
12730                 if (!wdev) {
12731                         err = -EINVAL;
12732                         goto out;
12733                 }
12734                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
12735                     !wdev->netdev) {
12736                         err = -EINVAL;
12737                         goto out;
12738                 }
12739
12740                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
12741                         if (!wdev_running(wdev)) {
12742                                 err = -ENETDOWN;
12743                                 goto out;
12744                         }
12745                 }
12746         }
12747
12748         while (1) {
12749                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
12750                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
12751                                            NL80211_CMD_VENDOR);
12752                 if (!hdr)
12753                         break;
12754
12755                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12756                     (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
12757                                                wdev_id(wdev),
12758                                                NL80211_ATTR_PAD))) {
12759                         genlmsg_cancel(skb, hdr);
12760                         break;
12761                 }
12762
12763                 vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA);
12764                 if (!vendor_data) {
12765                         genlmsg_cancel(skb, hdr);
12766                         break;
12767                 }
12768
12769                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
12770                                    (unsigned long *)&cb->args[5]);
12771                 nla_nest_end(skb, vendor_data);
12772
12773                 if (err == -ENOBUFS || err == -ENOENT) {
12774                         genlmsg_cancel(skb, hdr);
12775                         break;
12776                 } else if (err) {
12777                         genlmsg_cancel(skb, hdr);
12778                         goto out;
12779                 }
12780
12781                 genlmsg_end(skb, hdr);
12782         }
12783
12784         err = skb->len;
12785  out:
12786         rtnl_unlock();
12787         return err;
12788 }
12789
12790 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
12791                                            enum nl80211_commands cmd,
12792                                            enum nl80211_attrs attr,
12793                                            int approxlen)
12794 {
12795         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12796
12797         if (WARN_ON(!rdev->cur_cmd_info))
12798                 return NULL;
12799
12800         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
12801                                            rdev->cur_cmd_info->snd_portid,
12802                                            rdev->cur_cmd_info->snd_seq,
12803                                            cmd, attr, NULL, GFP_KERNEL);
12804 }
12805 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
12806
12807 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
12808 {
12809         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
12810         void *hdr = ((void **)skb->cb)[1];
12811         struct nlattr *data = ((void **)skb->cb)[2];
12812
12813         /* clear CB data for netlink core to own from now on */
12814         memset(skb->cb, 0, sizeof(skb->cb));
12815
12816         if (WARN_ON(!rdev->cur_cmd_info)) {
12817                 kfree_skb(skb);
12818                 return -EINVAL;
12819         }
12820
12821         nla_nest_end(skb, data);
12822         genlmsg_end(skb, hdr);
12823         return genlmsg_reply(skb, rdev->cur_cmd_info);
12824 }
12825 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
12826
12827 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy)
12828 {
12829         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12830
12831         if (WARN_ON(!rdev->cur_cmd_info))
12832                 return 0;
12833
12834         return rdev->cur_cmd_info->snd_portid;
12835 }
12836 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender);
12837
12838 static int nl80211_set_qos_map(struct sk_buff *skb,
12839                                struct genl_info *info)
12840 {
12841         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12842         struct cfg80211_qos_map *qos_map = NULL;
12843         struct net_device *dev = info->user_ptr[1];
12844         u8 *pos, len, num_des, des_len, des;
12845         int ret;
12846
12847         if (!rdev->ops->set_qos_map)
12848                 return -EOPNOTSUPP;
12849
12850         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
12851                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
12852                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
12853
12854                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
12855                     len > IEEE80211_QOS_MAP_LEN_MAX)
12856                         return -EINVAL;
12857
12858                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
12859                 if (!qos_map)
12860                         return -ENOMEM;
12861
12862                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
12863                 if (num_des) {
12864                         des_len = num_des *
12865                                 sizeof(struct cfg80211_dscp_exception);
12866                         memcpy(qos_map->dscp_exception, pos, des_len);
12867                         qos_map->num_des = num_des;
12868                         for (des = 0; des < num_des; des++) {
12869                                 if (qos_map->dscp_exception[des].up > 7) {
12870                                         kfree(qos_map);
12871                                         return -EINVAL;
12872                                 }
12873                         }
12874                         pos += des_len;
12875                 }
12876                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
12877         }
12878
12879         wdev_lock(dev->ieee80211_ptr);
12880         ret = nl80211_key_allowed(dev->ieee80211_ptr);
12881         if (!ret)
12882                 ret = rdev_set_qos_map(rdev, dev, qos_map);
12883         wdev_unlock(dev->ieee80211_ptr);
12884
12885         kfree(qos_map);
12886         return ret;
12887 }
12888
12889 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
12890 {
12891         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12892         struct net_device *dev = info->user_ptr[1];
12893         struct wireless_dev *wdev = dev->ieee80211_ptr;
12894         const u8 *peer;
12895         u8 tsid, up;
12896         u16 admitted_time = 0;
12897         int err;
12898
12899         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
12900                 return -EOPNOTSUPP;
12901
12902         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
12903             !info->attrs[NL80211_ATTR_USER_PRIO])
12904                 return -EINVAL;
12905
12906         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
12907         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
12908
12909         /* WMM uses TIDs 0-7 even for TSPEC */
12910         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
12911                 /* TODO: handle 802.11 TSPEC/admission control
12912                  * need more attributes for that (e.g. BA session requirement);
12913                  * change the WMM adminssion test above to allow both then
12914                  */
12915                 return -EINVAL;
12916         }
12917
12918         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12919
12920         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
12921                 admitted_time =
12922                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
12923                 if (!admitted_time)
12924                         return -EINVAL;
12925         }
12926
12927         wdev_lock(wdev);
12928         switch (wdev->iftype) {
12929         case NL80211_IFTYPE_STATION:
12930         case NL80211_IFTYPE_P2P_CLIENT:
12931                 if (wdev->current_bss)
12932                         break;
12933                 err = -ENOTCONN;
12934                 goto out;
12935         default:
12936                 err = -EOPNOTSUPP;
12937                 goto out;
12938         }
12939
12940         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
12941
12942  out:
12943         wdev_unlock(wdev);
12944         return err;
12945 }
12946
12947 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
12948 {
12949         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12950         struct net_device *dev = info->user_ptr[1];
12951         struct wireless_dev *wdev = dev->ieee80211_ptr;
12952         const u8 *peer;
12953         u8 tsid;
12954         int err;
12955
12956         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
12957                 return -EINVAL;
12958
12959         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
12960         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12961
12962         wdev_lock(wdev);
12963         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
12964         wdev_unlock(wdev);
12965
12966         return err;
12967 }
12968
12969 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
12970                                        struct genl_info *info)
12971 {
12972         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12973         struct net_device *dev = info->user_ptr[1];
12974         struct wireless_dev *wdev = dev->ieee80211_ptr;
12975         struct cfg80211_chan_def chandef = {};
12976         const u8 *addr;
12977         u8 oper_class;
12978         int err;
12979
12980         if (!rdev->ops->tdls_channel_switch ||
12981             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
12982                 return -EOPNOTSUPP;
12983
12984         switch (dev->ieee80211_ptr->iftype) {
12985         case NL80211_IFTYPE_STATION:
12986         case NL80211_IFTYPE_P2P_CLIENT:
12987                 break;
12988         default:
12989                 return -EOPNOTSUPP;
12990         }
12991
12992         if (!info->attrs[NL80211_ATTR_MAC] ||
12993             !info->attrs[NL80211_ATTR_OPER_CLASS])
12994                 return -EINVAL;
12995
12996         err = nl80211_parse_chandef(rdev, info, &chandef);
12997         if (err)
12998                 return err;
12999
13000         /*
13001          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
13002          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
13003          * specification is not defined for them.
13004          */
13005         if (chandef.chan->band == NL80211_BAND_2GHZ &&
13006             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
13007             chandef.width != NL80211_CHAN_WIDTH_20)
13008                 return -EINVAL;
13009
13010         /* we will be active on the TDLS link */
13011         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
13012                                            wdev->iftype))
13013                 return -EINVAL;
13014
13015         /* don't allow switching to DFS channels */
13016         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
13017                 return -EINVAL;
13018
13019         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
13020         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
13021
13022         wdev_lock(wdev);
13023         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
13024         wdev_unlock(wdev);
13025
13026         return err;
13027 }
13028
13029 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
13030                                               struct genl_info *info)
13031 {
13032         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13033         struct net_device *dev = info->user_ptr[1];
13034         struct wireless_dev *wdev = dev->ieee80211_ptr;
13035         const u8 *addr;
13036
13037         if (!rdev->ops->tdls_channel_switch ||
13038             !rdev->ops->tdls_cancel_channel_switch ||
13039             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
13040                 return -EOPNOTSUPP;
13041
13042         switch (dev->ieee80211_ptr->iftype) {
13043         case NL80211_IFTYPE_STATION:
13044         case NL80211_IFTYPE_P2P_CLIENT:
13045                 break;
13046         default:
13047                 return -EOPNOTSUPP;
13048         }
13049
13050         if (!info->attrs[NL80211_ATTR_MAC])
13051                 return -EINVAL;
13052
13053         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
13054
13055         wdev_lock(wdev);
13056         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
13057         wdev_unlock(wdev);
13058
13059         return 0;
13060 }
13061
13062 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
13063                                             struct genl_info *info)
13064 {
13065         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13066         struct net_device *dev = info->user_ptr[1];
13067         struct wireless_dev *wdev = dev->ieee80211_ptr;
13068         const struct nlattr *nla;
13069         bool enabled;
13070
13071         if (!rdev->ops->set_multicast_to_unicast)
13072                 return -EOPNOTSUPP;
13073
13074         if (wdev->iftype != NL80211_IFTYPE_AP &&
13075             wdev->iftype != NL80211_IFTYPE_P2P_GO)
13076                 return -EOPNOTSUPP;
13077
13078         nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
13079         enabled = nla_get_flag(nla);
13080
13081         return rdev_set_multicast_to_unicast(rdev, dev, enabled);
13082 }
13083
13084 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
13085 {
13086         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13087         struct net_device *dev = info->user_ptr[1];
13088         struct wireless_dev *wdev = dev->ieee80211_ptr;
13089         struct cfg80211_pmk_conf pmk_conf = {};
13090         int ret;
13091
13092         if (wdev->iftype != NL80211_IFTYPE_STATION &&
13093             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
13094                 return -EOPNOTSUPP;
13095
13096         if (!wiphy_ext_feature_isset(&rdev->wiphy,
13097                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
13098                 return -EOPNOTSUPP;
13099
13100         if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
13101                 return -EINVAL;
13102
13103         wdev_lock(wdev);
13104         if (!wdev->current_bss) {
13105                 ret = -ENOTCONN;
13106                 goto out;
13107         }
13108
13109         pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
13110         if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) {
13111                 ret = -EINVAL;
13112                 goto out;
13113         }
13114
13115         pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
13116         pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
13117         if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
13118             pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
13119                 ret = -EINVAL;
13120                 goto out;
13121         }
13122
13123         if (info->attrs[NL80211_ATTR_PMKR0_NAME]) {
13124                 int r0_name_len = nla_len(info->attrs[NL80211_ATTR_PMKR0_NAME]);
13125
13126                 if (r0_name_len != WLAN_PMK_NAME_LEN) {
13127                         ret = -EINVAL;
13128                         goto out;
13129                 }
13130
13131                 pmk_conf.pmk_r0_name =
13132                         nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
13133         }
13134
13135         ret = rdev_set_pmk(rdev, dev, &pmk_conf);
13136 out:
13137         wdev_unlock(wdev);
13138         return ret;
13139 }
13140
13141 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
13142 {
13143         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13144         struct net_device *dev = info->user_ptr[1];
13145         struct wireless_dev *wdev = dev->ieee80211_ptr;
13146         const u8 *aa;
13147         int ret;
13148
13149         if (wdev->iftype != NL80211_IFTYPE_STATION &&
13150             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
13151                 return -EOPNOTSUPP;
13152
13153         if (!wiphy_ext_feature_isset(&rdev->wiphy,
13154                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
13155                 return -EOPNOTSUPP;
13156
13157         if (!info->attrs[NL80211_ATTR_MAC])
13158                 return -EINVAL;
13159
13160         wdev_lock(wdev);
13161         aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
13162         ret = rdev_del_pmk(rdev, dev, aa);
13163         wdev_unlock(wdev);
13164
13165         return ret;
13166 }
13167
13168 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
13169 {
13170         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13171         struct net_device *dev = info->user_ptr[1];
13172         struct cfg80211_external_auth_params params;
13173
13174         if (!rdev->ops->external_auth)
13175                 return -EOPNOTSUPP;
13176
13177         if (!info->attrs[NL80211_ATTR_SSID] &&
13178             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
13179             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
13180                 return -EINVAL;
13181
13182         if (!info->attrs[NL80211_ATTR_BSSID])
13183                 return -EINVAL;
13184
13185         if (!info->attrs[NL80211_ATTR_STATUS_CODE])
13186                 return -EINVAL;
13187
13188         memset(&params, 0, sizeof(params));
13189
13190         if (info->attrs[NL80211_ATTR_SSID]) {
13191                 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
13192                 if (params.ssid.ssid_len == 0 ||
13193                     params.ssid.ssid_len > IEEE80211_MAX_SSID_LEN)
13194                         return -EINVAL;
13195                 memcpy(params.ssid.ssid,
13196                        nla_data(info->attrs[NL80211_ATTR_SSID]),
13197                        params.ssid.ssid_len);
13198         }
13199
13200         memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
13201                ETH_ALEN);
13202
13203         params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
13204
13205         if (info->attrs[NL80211_ATTR_PMKID])
13206                 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
13207
13208         return rdev_external_auth(rdev, dev, &params);
13209 }
13210
13211 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
13212 {
13213         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13214         struct net_device *dev = info->user_ptr[1];
13215         struct wireless_dev *wdev = dev->ieee80211_ptr;
13216         const u8 *buf;
13217         size_t len;
13218         u8 *dest;
13219         u16 proto;
13220         bool noencrypt;
13221         int err;
13222
13223         if (!wiphy_ext_feature_isset(&rdev->wiphy,
13224                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
13225                 return -EOPNOTSUPP;
13226
13227         if (!rdev->ops->tx_control_port)
13228                 return -EOPNOTSUPP;
13229
13230         if (!info->attrs[NL80211_ATTR_FRAME] ||
13231             !info->attrs[NL80211_ATTR_MAC] ||
13232             !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
13233                 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
13234                 return -EINVAL;
13235         }
13236
13237         wdev_lock(wdev);
13238
13239         switch (wdev->iftype) {
13240         case NL80211_IFTYPE_AP:
13241         case NL80211_IFTYPE_P2P_GO:
13242         case NL80211_IFTYPE_MESH_POINT:
13243                 break;
13244         case NL80211_IFTYPE_ADHOC:
13245         case NL80211_IFTYPE_STATION:
13246         case NL80211_IFTYPE_P2P_CLIENT:
13247                 if (wdev->current_bss)
13248                         break;
13249                 err = -ENOTCONN;
13250                 goto out;
13251         default:
13252                 err = -EOPNOTSUPP;
13253                 goto out;
13254         }
13255
13256         wdev_unlock(wdev);
13257
13258         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
13259         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
13260         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
13261         proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
13262         noencrypt =
13263                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
13264
13265         return rdev_tx_control_port(rdev, dev, buf, len,
13266                                     dest, cpu_to_be16(proto), noencrypt);
13267
13268  out:
13269         wdev_unlock(wdev);
13270         return err;
13271 }
13272
13273 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
13274                                            struct genl_info *info)
13275 {
13276         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13277         struct net_device *dev = info->user_ptr[1];
13278         struct wireless_dev *wdev = dev->ieee80211_ptr;
13279         struct cfg80211_ftm_responder_stats ftm_stats = {};
13280         struct sk_buff *msg;
13281         void *hdr;
13282         struct nlattr *ftm_stats_attr;
13283         int err;
13284
13285         if (wdev->iftype != NL80211_IFTYPE_AP || !wdev->beacon_interval)
13286                 return -EOPNOTSUPP;
13287
13288         err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
13289         if (err)
13290                 return err;
13291
13292         if (!ftm_stats.filled)
13293                 return -ENODATA;
13294
13295         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13296         if (!msg)
13297                 return -ENOMEM;
13298
13299         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13300                              NL80211_CMD_GET_FTM_RESPONDER_STATS);
13301         if (!hdr)
13302                 return -ENOBUFS;
13303
13304         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
13305                 goto nla_put_failure;
13306
13307         ftm_stats_attr = nla_nest_start(msg, NL80211_ATTR_FTM_RESPONDER_STATS);
13308         if (!ftm_stats_attr)
13309                 goto nla_put_failure;
13310
13311 #define SET_FTM(field, name, type)                                       \
13312         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
13313             nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name,            \
13314                              ftm_stats.field))                           \
13315                 goto nla_put_failure; } while (0)
13316 #define SET_FTM_U64(field, name)                                         \
13317         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
13318             nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name,           \
13319                               ftm_stats.field, NL80211_FTM_STATS_PAD))   \
13320                 goto nla_put_failure; } while (0)
13321
13322         SET_FTM(success_num, SUCCESS_NUM, u32);
13323         SET_FTM(partial_num, PARTIAL_NUM, u32);
13324         SET_FTM(failed_num, FAILED_NUM, u32);
13325         SET_FTM(asap_num, ASAP_NUM, u32);
13326         SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
13327         SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
13328         SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
13329         SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
13330         SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
13331 #undef SET_FTM
13332
13333         nla_nest_end(msg, ftm_stats_attr);
13334
13335         genlmsg_end(msg, hdr);
13336         return genlmsg_reply(msg, info);
13337
13338 nla_put_failure:
13339         nlmsg_free(msg);
13340         return -ENOBUFS;
13341 }
13342
13343 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info)
13344 {
13345         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13346         struct cfg80211_update_owe_info owe_info;
13347         struct net_device *dev = info->user_ptr[1];
13348
13349         if (!rdev->ops->update_owe_info)
13350                 return -EOPNOTSUPP;
13351
13352         if (!info->attrs[NL80211_ATTR_STATUS_CODE] ||
13353             !info->attrs[NL80211_ATTR_MAC])
13354                 return -EINVAL;
13355
13356         memset(&owe_info, 0, sizeof(owe_info));
13357         owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
13358         nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN);
13359
13360         if (info->attrs[NL80211_ATTR_IE]) {
13361                 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
13362                 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
13363         }
13364
13365         return rdev_update_owe_info(rdev, dev, &owe_info);
13366 }
13367
13368 #define NL80211_FLAG_NEED_WIPHY         0x01
13369 #define NL80211_FLAG_NEED_NETDEV        0x02
13370 #define NL80211_FLAG_NEED_RTNL          0x04
13371 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
13372 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
13373                                          NL80211_FLAG_CHECK_NETDEV_UP)
13374 #define NL80211_FLAG_NEED_WDEV          0x10
13375 /* If a netdev is associated, it must be UP, P2P must be started */
13376 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
13377                                          NL80211_FLAG_CHECK_NETDEV_UP)
13378 #define NL80211_FLAG_CLEAR_SKB          0x20
13379
13380 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
13381                             struct genl_info *info)
13382 {
13383         struct cfg80211_registered_device *rdev;
13384         struct wireless_dev *wdev;
13385         struct net_device *dev;
13386         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
13387
13388         if (rtnl)
13389                 rtnl_lock();
13390
13391         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
13392                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
13393                 if (IS_ERR(rdev)) {
13394                         if (rtnl)
13395                                 rtnl_unlock();
13396                         return PTR_ERR(rdev);
13397                 }
13398                 info->user_ptr[0] = rdev;
13399         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
13400                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
13401                 ASSERT_RTNL();
13402
13403                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
13404                                                   info->attrs);
13405                 if (IS_ERR(wdev)) {
13406                         if (rtnl)
13407                                 rtnl_unlock();
13408                         return PTR_ERR(wdev);
13409                 }
13410
13411                 dev = wdev->netdev;
13412                 rdev = wiphy_to_rdev(wdev->wiphy);
13413
13414                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
13415                         if (!dev) {
13416                                 if (rtnl)
13417                                         rtnl_unlock();
13418                                 return -EINVAL;
13419                         }
13420
13421                         info->user_ptr[1] = dev;
13422                 } else {
13423                         info->user_ptr[1] = wdev;
13424                 }
13425
13426                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
13427                     !wdev_running(wdev)) {
13428                         if (rtnl)
13429                                 rtnl_unlock();
13430                         return -ENETDOWN;
13431                 }
13432
13433                 if (dev)
13434                         dev_hold(dev);
13435
13436                 info->user_ptr[0] = rdev;
13437         }
13438
13439         return 0;
13440 }
13441
13442 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
13443                               struct genl_info *info)
13444 {
13445         if (info->user_ptr[1]) {
13446                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
13447                         struct wireless_dev *wdev = info->user_ptr[1];
13448
13449                         if (wdev->netdev)
13450                                 dev_put(wdev->netdev);
13451                 } else {
13452                         dev_put(info->user_ptr[1]);
13453                 }
13454         }
13455
13456         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
13457                 rtnl_unlock();
13458
13459         /* If needed, clear the netlink message payload from the SKB
13460          * as it might contain key data that shouldn't stick around on
13461          * the heap after the SKB is freed. The netlink message header
13462          * is still needed for further processing, so leave it intact.
13463          */
13464         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
13465                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
13466
13467                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
13468         }
13469 }
13470
13471 static const struct genl_ops nl80211_ops[] = {
13472         {
13473                 .cmd = NL80211_CMD_GET_WIPHY,
13474                 .doit = nl80211_get_wiphy,
13475                 .dumpit = nl80211_dump_wiphy,
13476                 .done = nl80211_dump_wiphy_done,
13477                 /* can be retrieved by unprivileged users */
13478                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13479                                   NL80211_FLAG_NEED_RTNL,
13480         },
13481         {
13482                 .cmd = NL80211_CMD_SET_WIPHY,
13483                 .doit = nl80211_set_wiphy,
13484                 .flags = GENL_UNS_ADMIN_PERM,
13485                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13486         },
13487         {
13488                 .cmd = NL80211_CMD_GET_INTERFACE,
13489                 .doit = nl80211_get_interface,
13490                 .dumpit = nl80211_dump_interface,
13491                 /* can be retrieved by unprivileged users */
13492                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13493                                   NL80211_FLAG_NEED_RTNL,
13494         },
13495         {
13496                 .cmd = NL80211_CMD_SET_INTERFACE,
13497                 .doit = nl80211_set_interface,
13498                 .flags = GENL_UNS_ADMIN_PERM,
13499                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13500                                   NL80211_FLAG_NEED_RTNL,
13501         },
13502         {
13503                 .cmd = NL80211_CMD_NEW_INTERFACE,
13504                 .doit = nl80211_new_interface,
13505                 .flags = GENL_UNS_ADMIN_PERM,
13506                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13507                                   NL80211_FLAG_NEED_RTNL,
13508         },
13509         {
13510                 .cmd = NL80211_CMD_DEL_INTERFACE,
13511                 .doit = nl80211_del_interface,
13512                 .flags = GENL_UNS_ADMIN_PERM,
13513                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13514                                   NL80211_FLAG_NEED_RTNL,
13515         },
13516         {
13517                 .cmd = NL80211_CMD_GET_KEY,
13518                 .doit = nl80211_get_key,
13519                 .flags = GENL_UNS_ADMIN_PERM,
13520                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13521                                   NL80211_FLAG_NEED_RTNL,
13522         },
13523         {
13524                 .cmd = NL80211_CMD_SET_KEY,
13525                 .doit = nl80211_set_key,
13526                 .flags = GENL_UNS_ADMIN_PERM,
13527                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13528                                   NL80211_FLAG_NEED_RTNL |
13529                                   NL80211_FLAG_CLEAR_SKB,
13530         },
13531         {
13532                 .cmd = NL80211_CMD_NEW_KEY,
13533                 .doit = nl80211_new_key,
13534                 .flags = GENL_UNS_ADMIN_PERM,
13535                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13536                                   NL80211_FLAG_NEED_RTNL |
13537                                   NL80211_FLAG_CLEAR_SKB,
13538         },
13539         {
13540                 .cmd = NL80211_CMD_DEL_KEY,
13541                 .doit = nl80211_del_key,
13542                 .flags = GENL_UNS_ADMIN_PERM,
13543                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13544                                   NL80211_FLAG_NEED_RTNL,
13545         },
13546         {
13547                 .cmd = NL80211_CMD_SET_BEACON,
13548                 .flags = GENL_UNS_ADMIN_PERM,
13549                 .doit = nl80211_set_beacon,
13550                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13551                                   NL80211_FLAG_NEED_RTNL,
13552         },
13553         {
13554                 .cmd = NL80211_CMD_START_AP,
13555                 .flags = GENL_UNS_ADMIN_PERM,
13556                 .doit = nl80211_start_ap,
13557                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13558                                   NL80211_FLAG_NEED_RTNL,
13559         },
13560         {
13561                 .cmd = NL80211_CMD_STOP_AP,
13562                 .flags = GENL_UNS_ADMIN_PERM,
13563                 .doit = nl80211_stop_ap,
13564                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13565                                   NL80211_FLAG_NEED_RTNL,
13566         },
13567         {
13568                 .cmd = NL80211_CMD_GET_STATION,
13569                 .doit = nl80211_get_station,
13570                 .dumpit = nl80211_dump_station,
13571                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13572                                   NL80211_FLAG_NEED_RTNL,
13573         },
13574         {
13575                 .cmd = NL80211_CMD_SET_STATION,
13576                 .doit = nl80211_set_station,
13577                 .flags = GENL_UNS_ADMIN_PERM,
13578                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13579                                   NL80211_FLAG_NEED_RTNL,
13580         },
13581         {
13582                 .cmd = NL80211_CMD_NEW_STATION,
13583                 .doit = nl80211_new_station,
13584                 .flags = GENL_UNS_ADMIN_PERM,
13585                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13586                                   NL80211_FLAG_NEED_RTNL,
13587         },
13588         {
13589                 .cmd = NL80211_CMD_DEL_STATION,
13590                 .doit = nl80211_del_station,
13591                 .flags = GENL_UNS_ADMIN_PERM,
13592                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13593                                   NL80211_FLAG_NEED_RTNL,
13594         },
13595         {
13596                 .cmd = NL80211_CMD_GET_MPATH,
13597                 .doit = nl80211_get_mpath,
13598                 .dumpit = nl80211_dump_mpath,
13599                 .flags = GENL_UNS_ADMIN_PERM,
13600                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13601                                   NL80211_FLAG_NEED_RTNL,
13602         },
13603         {
13604                 .cmd = NL80211_CMD_GET_MPP,
13605                 .doit = nl80211_get_mpp,
13606                 .dumpit = nl80211_dump_mpp,
13607                 .flags = GENL_UNS_ADMIN_PERM,
13608                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13609                                   NL80211_FLAG_NEED_RTNL,
13610         },
13611         {
13612                 .cmd = NL80211_CMD_SET_MPATH,
13613                 .doit = nl80211_set_mpath,
13614                 .flags = GENL_UNS_ADMIN_PERM,
13615                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13616                                   NL80211_FLAG_NEED_RTNL,
13617         },
13618         {
13619                 .cmd = NL80211_CMD_NEW_MPATH,
13620                 .doit = nl80211_new_mpath,
13621                 .flags = GENL_UNS_ADMIN_PERM,
13622                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13623                                   NL80211_FLAG_NEED_RTNL,
13624         },
13625         {
13626                 .cmd = NL80211_CMD_DEL_MPATH,
13627                 .doit = nl80211_del_mpath,
13628                 .flags = GENL_UNS_ADMIN_PERM,
13629                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13630                                   NL80211_FLAG_NEED_RTNL,
13631         },
13632         {
13633                 .cmd = NL80211_CMD_SET_BSS,
13634                 .doit = nl80211_set_bss,
13635                 .flags = GENL_UNS_ADMIN_PERM,
13636                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13637                                   NL80211_FLAG_NEED_RTNL,
13638         },
13639         {
13640                 .cmd = NL80211_CMD_GET_REG,
13641                 .doit = nl80211_get_reg_do,
13642                 .dumpit = nl80211_get_reg_dump,
13643                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13644                 /* can be retrieved by unprivileged users */
13645         },
13646 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
13647         {
13648                 .cmd = NL80211_CMD_SET_REG,
13649                 .doit = nl80211_set_reg,
13650                 .flags = GENL_ADMIN_PERM,
13651                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13652         },
13653 #endif
13654         {
13655                 .cmd = NL80211_CMD_REQ_SET_REG,
13656                 .doit = nl80211_req_set_reg,
13657                 .flags = GENL_ADMIN_PERM,
13658         },
13659         {
13660                 .cmd = NL80211_CMD_RELOAD_REGDB,
13661                 .doit = nl80211_reload_regdb,
13662                 .flags = GENL_ADMIN_PERM,
13663         },
13664         {
13665                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
13666                 .doit = nl80211_get_mesh_config,
13667                 /* can be retrieved by unprivileged users */
13668                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13669                                   NL80211_FLAG_NEED_RTNL,
13670         },
13671         {
13672                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
13673                 .doit = nl80211_update_mesh_config,
13674                 .flags = GENL_UNS_ADMIN_PERM,
13675                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13676                                   NL80211_FLAG_NEED_RTNL,
13677         },
13678         {
13679                 .cmd = NL80211_CMD_TRIGGER_SCAN,
13680                 .doit = nl80211_trigger_scan,
13681                 .flags = GENL_UNS_ADMIN_PERM,
13682                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13683                                   NL80211_FLAG_NEED_RTNL,
13684         },
13685         {
13686                 .cmd = NL80211_CMD_ABORT_SCAN,
13687                 .doit = nl80211_abort_scan,
13688                 .flags = GENL_UNS_ADMIN_PERM,
13689                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13690                                   NL80211_FLAG_NEED_RTNL,
13691         },
13692         {
13693                 .cmd = NL80211_CMD_GET_SCAN,
13694                 .dumpit = nl80211_dump_scan,
13695         },
13696         {
13697                 .cmd = NL80211_CMD_START_SCHED_SCAN,
13698                 .doit = nl80211_start_sched_scan,
13699                 .flags = GENL_UNS_ADMIN_PERM,
13700                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13701                                   NL80211_FLAG_NEED_RTNL,
13702         },
13703         {
13704                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
13705                 .doit = nl80211_stop_sched_scan,
13706                 .flags = GENL_UNS_ADMIN_PERM,
13707                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13708                                   NL80211_FLAG_NEED_RTNL,
13709         },
13710         {
13711                 .cmd = NL80211_CMD_AUTHENTICATE,
13712                 .doit = nl80211_authenticate,
13713                 .flags = GENL_UNS_ADMIN_PERM,
13714                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13715                                   NL80211_FLAG_NEED_RTNL |
13716                                   NL80211_FLAG_CLEAR_SKB,
13717         },
13718         {
13719                 .cmd = NL80211_CMD_ASSOCIATE,
13720                 .doit = nl80211_associate,
13721                 .flags = GENL_UNS_ADMIN_PERM,
13722                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13723                                   NL80211_FLAG_NEED_RTNL,
13724         },
13725         {
13726                 .cmd = NL80211_CMD_DEAUTHENTICATE,
13727                 .doit = nl80211_deauthenticate,
13728                 .flags = GENL_UNS_ADMIN_PERM,
13729                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13730                                   NL80211_FLAG_NEED_RTNL,
13731         },
13732         {
13733                 .cmd = NL80211_CMD_DISASSOCIATE,
13734                 .doit = nl80211_disassociate,
13735                 .flags = GENL_UNS_ADMIN_PERM,
13736                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13737                                   NL80211_FLAG_NEED_RTNL,
13738         },
13739         {
13740                 .cmd = NL80211_CMD_JOIN_IBSS,
13741                 .doit = nl80211_join_ibss,
13742                 .flags = GENL_UNS_ADMIN_PERM,
13743                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13744                                   NL80211_FLAG_NEED_RTNL,
13745         },
13746         {
13747                 .cmd = NL80211_CMD_LEAVE_IBSS,
13748                 .doit = nl80211_leave_ibss,
13749                 .flags = GENL_UNS_ADMIN_PERM,
13750                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13751                                   NL80211_FLAG_NEED_RTNL,
13752         },
13753 #ifdef CONFIG_NL80211_TESTMODE
13754         {
13755                 .cmd = NL80211_CMD_TESTMODE,
13756                 .doit = nl80211_testmode_do,
13757                 .dumpit = nl80211_testmode_dump,
13758                 .flags = GENL_UNS_ADMIN_PERM,
13759                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13760                                   NL80211_FLAG_NEED_RTNL,
13761         },
13762 #endif
13763         {
13764                 .cmd = NL80211_CMD_CONNECT,
13765                 .doit = nl80211_connect,
13766                 .flags = GENL_UNS_ADMIN_PERM,
13767                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13768                                   NL80211_FLAG_NEED_RTNL,
13769         },
13770         {
13771                 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
13772                 .doit = nl80211_update_connect_params,
13773                 .flags = GENL_ADMIN_PERM,
13774                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13775                                   NL80211_FLAG_NEED_RTNL,
13776         },
13777         {
13778                 .cmd = NL80211_CMD_DISCONNECT,
13779                 .doit = nl80211_disconnect,
13780                 .flags = GENL_UNS_ADMIN_PERM,
13781                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13782                                   NL80211_FLAG_NEED_RTNL,
13783         },
13784         {
13785                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
13786                 .doit = nl80211_wiphy_netns,
13787                 .flags = GENL_UNS_ADMIN_PERM,
13788                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13789                                   NL80211_FLAG_NEED_RTNL,
13790         },
13791         {
13792                 .cmd = NL80211_CMD_GET_SURVEY,
13793                 .dumpit = nl80211_dump_survey,
13794         },
13795         {
13796                 .cmd = NL80211_CMD_SET_PMKSA,
13797                 .doit = nl80211_setdel_pmksa,
13798                 .flags = GENL_UNS_ADMIN_PERM,
13799                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13800                                   NL80211_FLAG_NEED_RTNL,
13801         },
13802         {
13803                 .cmd = NL80211_CMD_DEL_PMKSA,
13804                 .doit = nl80211_setdel_pmksa,
13805                 .flags = GENL_UNS_ADMIN_PERM,
13806                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13807                                   NL80211_FLAG_NEED_RTNL,
13808         },
13809         {
13810                 .cmd = NL80211_CMD_FLUSH_PMKSA,
13811                 .doit = nl80211_flush_pmksa,
13812                 .flags = GENL_UNS_ADMIN_PERM,
13813                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13814                                   NL80211_FLAG_NEED_RTNL,
13815         },
13816         {
13817                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
13818                 .doit = nl80211_remain_on_channel,
13819                 .flags = GENL_UNS_ADMIN_PERM,
13820                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13821                                   NL80211_FLAG_NEED_RTNL,
13822         },
13823         {
13824                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
13825                 .doit = nl80211_cancel_remain_on_channel,
13826                 .flags = GENL_UNS_ADMIN_PERM,
13827                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13828                                   NL80211_FLAG_NEED_RTNL,
13829         },
13830         {
13831                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
13832                 .doit = nl80211_set_tx_bitrate_mask,
13833                 .flags = GENL_UNS_ADMIN_PERM,
13834                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13835                                   NL80211_FLAG_NEED_RTNL,
13836         },
13837         {
13838                 .cmd = NL80211_CMD_REGISTER_FRAME,
13839                 .doit = nl80211_register_mgmt,
13840                 .flags = GENL_UNS_ADMIN_PERM,
13841                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13842                                   NL80211_FLAG_NEED_RTNL,
13843         },
13844         {
13845                 .cmd = NL80211_CMD_FRAME,
13846                 .doit = nl80211_tx_mgmt,
13847                 .flags = GENL_UNS_ADMIN_PERM,
13848                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13849                                   NL80211_FLAG_NEED_RTNL,
13850         },
13851         {
13852                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
13853                 .doit = nl80211_tx_mgmt_cancel_wait,
13854                 .flags = GENL_UNS_ADMIN_PERM,
13855                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13856                                   NL80211_FLAG_NEED_RTNL,
13857         },
13858         {
13859                 .cmd = NL80211_CMD_SET_POWER_SAVE,
13860                 .doit = nl80211_set_power_save,
13861                 .flags = GENL_UNS_ADMIN_PERM,
13862                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13863                                   NL80211_FLAG_NEED_RTNL,
13864         },
13865         {
13866                 .cmd = NL80211_CMD_GET_POWER_SAVE,
13867                 .doit = nl80211_get_power_save,
13868                 /* can be retrieved by unprivileged users */
13869                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13870                                   NL80211_FLAG_NEED_RTNL,
13871         },
13872         {
13873                 .cmd = NL80211_CMD_SET_CQM,
13874                 .doit = nl80211_set_cqm,
13875                 .flags = GENL_UNS_ADMIN_PERM,
13876                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13877                                   NL80211_FLAG_NEED_RTNL,
13878         },
13879         {
13880                 .cmd = NL80211_CMD_SET_CHANNEL,
13881                 .doit = nl80211_set_channel,
13882                 .flags = GENL_UNS_ADMIN_PERM,
13883                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13884                                   NL80211_FLAG_NEED_RTNL,
13885         },
13886         {
13887                 .cmd = NL80211_CMD_SET_WDS_PEER,
13888                 .doit = nl80211_set_wds_peer,
13889                 .flags = GENL_UNS_ADMIN_PERM,
13890                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13891                                   NL80211_FLAG_NEED_RTNL,
13892         },
13893         {
13894                 .cmd = NL80211_CMD_JOIN_MESH,
13895                 .doit = nl80211_join_mesh,
13896                 .flags = GENL_UNS_ADMIN_PERM,
13897                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13898                                   NL80211_FLAG_NEED_RTNL,
13899         },
13900         {
13901                 .cmd = NL80211_CMD_LEAVE_MESH,
13902                 .doit = nl80211_leave_mesh,
13903                 .flags = GENL_UNS_ADMIN_PERM,
13904                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13905                                   NL80211_FLAG_NEED_RTNL,
13906         },
13907         {
13908                 .cmd = NL80211_CMD_JOIN_OCB,
13909                 .doit = nl80211_join_ocb,
13910                 .flags = GENL_UNS_ADMIN_PERM,
13911                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13912                                   NL80211_FLAG_NEED_RTNL,
13913         },
13914         {
13915                 .cmd = NL80211_CMD_LEAVE_OCB,
13916                 .doit = nl80211_leave_ocb,
13917                 .flags = GENL_UNS_ADMIN_PERM,
13918                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13919                                   NL80211_FLAG_NEED_RTNL,
13920         },
13921 #ifdef CONFIG_PM
13922         {
13923                 .cmd = NL80211_CMD_GET_WOWLAN,
13924                 .doit = nl80211_get_wowlan,
13925                 /* can be retrieved by unprivileged users */
13926                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13927                                   NL80211_FLAG_NEED_RTNL,
13928         },
13929         {
13930                 .cmd = NL80211_CMD_SET_WOWLAN,
13931                 .doit = nl80211_set_wowlan,
13932                 .flags = GENL_UNS_ADMIN_PERM,
13933                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13934                                   NL80211_FLAG_NEED_RTNL,
13935         },
13936 #endif
13937         {
13938                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
13939                 .doit = nl80211_set_rekey_data,
13940                 .flags = GENL_UNS_ADMIN_PERM,
13941                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13942                                   NL80211_FLAG_NEED_RTNL |
13943                                   NL80211_FLAG_CLEAR_SKB,
13944         },
13945         {
13946                 .cmd = NL80211_CMD_TDLS_MGMT,
13947                 .doit = nl80211_tdls_mgmt,
13948                 .flags = GENL_UNS_ADMIN_PERM,
13949                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13950                                   NL80211_FLAG_NEED_RTNL,
13951         },
13952         {
13953                 .cmd = NL80211_CMD_TDLS_OPER,
13954                 .doit = nl80211_tdls_oper,
13955                 .flags = GENL_UNS_ADMIN_PERM,
13956                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13957                                   NL80211_FLAG_NEED_RTNL,
13958         },
13959         {
13960                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
13961                 .doit = nl80211_register_unexpected_frame,
13962                 .flags = GENL_UNS_ADMIN_PERM,
13963                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13964                                   NL80211_FLAG_NEED_RTNL,
13965         },
13966         {
13967                 .cmd = NL80211_CMD_PROBE_CLIENT,
13968                 .doit = nl80211_probe_client,
13969                 .flags = GENL_UNS_ADMIN_PERM,
13970                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13971                                   NL80211_FLAG_NEED_RTNL,
13972         },
13973         {
13974                 .cmd = NL80211_CMD_REGISTER_BEACONS,
13975                 .doit = nl80211_register_beacons,
13976                 .flags = GENL_UNS_ADMIN_PERM,
13977                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13978                                   NL80211_FLAG_NEED_RTNL,
13979         },
13980         {
13981                 .cmd = NL80211_CMD_SET_NOACK_MAP,
13982                 .doit = nl80211_set_noack_map,
13983                 .flags = GENL_UNS_ADMIN_PERM,
13984                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13985                                   NL80211_FLAG_NEED_RTNL,
13986         },
13987         {
13988                 .cmd = NL80211_CMD_START_P2P_DEVICE,
13989                 .doit = nl80211_start_p2p_device,
13990                 .flags = GENL_UNS_ADMIN_PERM,
13991                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13992                                   NL80211_FLAG_NEED_RTNL,
13993         },
13994         {
13995                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
13996                 .doit = nl80211_stop_p2p_device,
13997                 .flags = GENL_UNS_ADMIN_PERM,
13998                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13999                                   NL80211_FLAG_NEED_RTNL,
14000         },
14001         {
14002                 .cmd = NL80211_CMD_START_NAN,
14003                 .doit = nl80211_start_nan,
14004                 .flags = GENL_ADMIN_PERM,
14005                 .internal_flags = NL80211_FLAG_NEED_WDEV |
14006                                   NL80211_FLAG_NEED_RTNL,
14007         },
14008         {
14009                 .cmd = NL80211_CMD_STOP_NAN,
14010                 .doit = nl80211_stop_nan,
14011                 .flags = GENL_ADMIN_PERM,
14012                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14013                                   NL80211_FLAG_NEED_RTNL,
14014         },
14015         {
14016                 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
14017                 .doit = nl80211_nan_add_func,
14018                 .flags = GENL_ADMIN_PERM,
14019                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14020                                   NL80211_FLAG_NEED_RTNL,
14021         },
14022         {
14023                 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
14024                 .doit = nl80211_nan_del_func,
14025                 .flags = GENL_ADMIN_PERM,
14026                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14027                                   NL80211_FLAG_NEED_RTNL,
14028         },
14029         {
14030                 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
14031                 .doit = nl80211_nan_change_config,
14032                 .flags = GENL_ADMIN_PERM,
14033                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14034                                   NL80211_FLAG_NEED_RTNL,
14035         },
14036         {
14037                 .cmd = NL80211_CMD_SET_MCAST_RATE,
14038                 .doit = nl80211_set_mcast_rate,
14039                 .flags = GENL_UNS_ADMIN_PERM,
14040                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14041                                   NL80211_FLAG_NEED_RTNL,
14042         },
14043         {
14044                 .cmd = NL80211_CMD_SET_MAC_ACL,
14045                 .doit = nl80211_set_mac_acl,
14046                 .flags = GENL_UNS_ADMIN_PERM,
14047                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14048                                   NL80211_FLAG_NEED_RTNL,
14049         },
14050         {
14051                 .cmd = NL80211_CMD_RADAR_DETECT,
14052                 .doit = nl80211_start_radar_detection,
14053                 .flags = GENL_UNS_ADMIN_PERM,
14054                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14055                                   NL80211_FLAG_NEED_RTNL,
14056         },
14057         {
14058                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
14059                 .doit = nl80211_get_protocol_features,
14060         },
14061         {
14062                 .cmd = NL80211_CMD_UPDATE_FT_IES,
14063                 .doit = nl80211_update_ft_ies,
14064                 .flags = GENL_UNS_ADMIN_PERM,
14065                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14066                                   NL80211_FLAG_NEED_RTNL,
14067         },
14068         {
14069                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
14070                 .doit = nl80211_crit_protocol_start,
14071                 .flags = GENL_UNS_ADMIN_PERM,
14072                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14073                                   NL80211_FLAG_NEED_RTNL,
14074         },
14075         {
14076                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
14077                 .doit = nl80211_crit_protocol_stop,
14078                 .flags = GENL_UNS_ADMIN_PERM,
14079                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14080                                   NL80211_FLAG_NEED_RTNL,
14081         },
14082         {
14083                 .cmd = NL80211_CMD_GET_COALESCE,
14084                 .doit = nl80211_get_coalesce,
14085                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14086                                   NL80211_FLAG_NEED_RTNL,
14087         },
14088         {
14089                 .cmd = NL80211_CMD_SET_COALESCE,
14090                 .doit = nl80211_set_coalesce,
14091                 .flags = GENL_UNS_ADMIN_PERM,
14092                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14093                                   NL80211_FLAG_NEED_RTNL,
14094         },
14095         {
14096                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
14097                 .doit = nl80211_channel_switch,
14098                 .flags = GENL_UNS_ADMIN_PERM,
14099                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14100                                   NL80211_FLAG_NEED_RTNL,
14101         },
14102         {
14103                 .cmd = NL80211_CMD_VENDOR,
14104                 .doit = nl80211_vendor_cmd,
14105                 .dumpit = nl80211_vendor_cmd_dump,
14106                 .flags = GENL_UNS_ADMIN_PERM,
14107                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14108                                   NL80211_FLAG_NEED_RTNL,
14109         },
14110         {
14111                 .cmd = NL80211_CMD_SET_QOS_MAP,
14112                 .doit = nl80211_set_qos_map,
14113                 .flags = GENL_UNS_ADMIN_PERM,
14114                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14115                                   NL80211_FLAG_NEED_RTNL,
14116         },
14117         {
14118                 .cmd = NL80211_CMD_ADD_TX_TS,
14119                 .doit = nl80211_add_tx_ts,
14120                 .flags = GENL_UNS_ADMIN_PERM,
14121                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14122                                   NL80211_FLAG_NEED_RTNL,
14123         },
14124         {
14125                 .cmd = NL80211_CMD_DEL_TX_TS,
14126                 .doit = nl80211_del_tx_ts,
14127                 .flags = GENL_UNS_ADMIN_PERM,
14128                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14129                                   NL80211_FLAG_NEED_RTNL,
14130         },
14131         {
14132                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
14133                 .doit = nl80211_tdls_channel_switch,
14134                 .flags = GENL_UNS_ADMIN_PERM,
14135                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14136                                   NL80211_FLAG_NEED_RTNL,
14137         },
14138         {
14139                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
14140                 .doit = nl80211_tdls_cancel_channel_switch,
14141                 .flags = GENL_UNS_ADMIN_PERM,
14142                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14143                                   NL80211_FLAG_NEED_RTNL,
14144         },
14145         {
14146                 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
14147                 .doit = nl80211_set_multicast_to_unicast,
14148                 .flags = GENL_UNS_ADMIN_PERM,
14149                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14150                                   NL80211_FLAG_NEED_RTNL,
14151         },
14152         {
14153                 .cmd = NL80211_CMD_SET_PMK,
14154                 .doit = nl80211_set_pmk,
14155                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14156                                   NL80211_FLAG_NEED_RTNL,
14157         },
14158         {
14159                 .cmd = NL80211_CMD_DEL_PMK,
14160                 .doit = nl80211_del_pmk,
14161                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14162                                   NL80211_FLAG_NEED_RTNL,
14163         },
14164         {
14165                 .cmd = NL80211_CMD_EXTERNAL_AUTH,
14166                 .doit = nl80211_external_auth,
14167                 .flags = GENL_ADMIN_PERM,
14168                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14169                                   NL80211_FLAG_NEED_RTNL,
14170         },
14171         {
14172                 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
14173                 .doit = nl80211_tx_control_port,
14174                 .flags = GENL_UNS_ADMIN_PERM,
14175                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14176                                   NL80211_FLAG_NEED_RTNL,
14177         },
14178         {
14179                 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
14180                 .doit = nl80211_get_ftm_responder_stats,
14181                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14182                                   NL80211_FLAG_NEED_RTNL,
14183         },
14184         {
14185                 .cmd = NL80211_CMD_PEER_MEASUREMENT_START,
14186                 .doit = nl80211_pmsr_start,
14187                 .flags = GENL_UNS_ADMIN_PERM,
14188                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14189                                   NL80211_FLAG_NEED_RTNL,
14190         },
14191         {
14192                 .cmd = NL80211_CMD_NOTIFY_RADAR,
14193                 .doit = nl80211_notify_radar_detection,
14194                 .flags = GENL_UNS_ADMIN_PERM,
14195                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14196                                   NL80211_FLAG_NEED_RTNL,
14197         },
14198         {
14199                 .cmd = NL80211_CMD_UPDATE_OWE_INFO,
14200                 .doit = nl80211_update_owe_info,
14201                 .flags = GENL_ADMIN_PERM,
14202                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14203                                   NL80211_FLAG_NEED_RTNL,
14204         },
14205 };
14206
14207 static struct genl_family nl80211_fam __ro_after_init = {
14208         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
14209         .hdrsize = 0,                   /* no private header */
14210         .version = 1,                   /* no particular meaning now */
14211         .maxattr = NL80211_ATTR_MAX,
14212         .policy = nl80211_policy,
14213         .netnsok = true,
14214         .pre_doit = nl80211_pre_doit,
14215         .post_doit = nl80211_post_doit,
14216         .module = THIS_MODULE,
14217         .ops = nl80211_ops,
14218         .n_ops = ARRAY_SIZE(nl80211_ops),
14219         .mcgrps = nl80211_mcgrps,
14220         .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
14221 };
14222
14223 /* notification functions */
14224
14225 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
14226                           enum nl80211_commands cmd)
14227 {
14228         struct sk_buff *msg;
14229         struct nl80211_dump_wiphy_state state = {};
14230
14231         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
14232                 cmd != NL80211_CMD_DEL_WIPHY);
14233
14234         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14235         if (!msg)
14236                 return;
14237
14238         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
14239                 nlmsg_free(msg);
14240                 return;
14241         }
14242
14243         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14244                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
14245 }
14246
14247 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
14248                                 struct wireless_dev *wdev,
14249                                 enum nl80211_commands cmd)
14250 {
14251         struct sk_buff *msg;
14252
14253         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14254         if (!msg)
14255                 return;
14256
14257         if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) {
14258                 nlmsg_free(msg);
14259                 return;
14260         }
14261
14262         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14263                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
14264 }
14265
14266 static int nl80211_add_scan_req(struct sk_buff *msg,
14267                                 struct cfg80211_registered_device *rdev)
14268 {
14269         struct cfg80211_scan_request *req = rdev->scan_req;
14270         struct nlattr *nest;
14271         int i;
14272
14273         if (WARN_ON(!req))
14274                 return 0;
14275
14276         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
14277         if (!nest)
14278                 goto nla_put_failure;
14279         for (i = 0; i < req->n_ssids; i++) {
14280                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
14281                         goto nla_put_failure;
14282         }
14283         nla_nest_end(msg, nest);
14284
14285         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
14286         if (!nest)
14287                 goto nla_put_failure;
14288         for (i = 0; i < req->n_channels; i++) {
14289                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
14290                         goto nla_put_failure;
14291         }
14292         nla_nest_end(msg, nest);
14293
14294         if (req->ie &&
14295             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
14296                 goto nla_put_failure;
14297
14298         if (req->flags &&
14299             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
14300                 goto nla_put_failure;
14301
14302         if (req->info.scan_start_tsf &&
14303             (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
14304                                req->info.scan_start_tsf, NL80211_BSS_PAD) ||
14305              nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
14306                      req->info.tsf_bssid)))
14307                 goto nla_put_failure;
14308
14309         return 0;
14310  nla_put_failure:
14311         return -ENOBUFS;
14312 }
14313
14314 static int nl80211_prep_scan_msg(struct sk_buff *msg,
14315                                  struct cfg80211_registered_device *rdev,
14316                                  struct wireless_dev *wdev,
14317                                  u32 portid, u32 seq, int flags,
14318                                  u32 cmd)
14319 {
14320         void *hdr;
14321
14322         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
14323         if (!hdr)
14324                 return -1;
14325
14326         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14327             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14328                                          wdev->netdev->ifindex)) ||
14329             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14330                               NL80211_ATTR_PAD))
14331                 goto nla_put_failure;
14332
14333         /* ignore errors and send incomplete event anyway */
14334         nl80211_add_scan_req(msg, rdev);
14335
14336         genlmsg_end(msg, hdr);
14337         return 0;
14338
14339  nla_put_failure:
14340         genlmsg_cancel(msg, hdr);
14341         return -EMSGSIZE;
14342 }
14343
14344 static int
14345 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
14346                             struct cfg80211_sched_scan_request *req, u32 cmd)
14347 {
14348         void *hdr;
14349
14350         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14351         if (!hdr)
14352                 return -1;
14353
14354         if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
14355                         wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
14356             nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
14357             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
14358                               NL80211_ATTR_PAD))
14359                 goto nla_put_failure;
14360
14361         genlmsg_end(msg, hdr);
14362         return 0;
14363
14364  nla_put_failure:
14365         genlmsg_cancel(msg, hdr);
14366         return -EMSGSIZE;
14367 }
14368
14369 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
14370                              struct wireless_dev *wdev)
14371 {
14372         struct sk_buff *msg;
14373
14374         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14375         if (!msg)
14376                 return;
14377
14378         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
14379                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
14380                 nlmsg_free(msg);
14381                 return;
14382         }
14383
14384         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14385                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14386 }
14387
14388 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
14389                                        struct wireless_dev *wdev, bool aborted)
14390 {
14391         struct sk_buff *msg;
14392
14393         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14394         if (!msg)
14395                 return NULL;
14396
14397         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
14398                                   aborted ? NL80211_CMD_SCAN_ABORTED :
14399                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
14400                 nlmsg_free(msg);
14401                 return NULL;
14402         }
14403
14404         return msg;
14405 }
14406
14407 /* send message created by nl80211_build_scan_msg() */
14408 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
14409                            struct sk_buff *msg)
14410 {
14411         if (!msg)
14412                 return;
14413
14414         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14415                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14416 }
14417
14418 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
14419 {
14420         struct sk_buff *msg;
14421
14422         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14423         if (!msg)
14424                 return;
14425
14426         if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
14427                 nlmsg_free(msg);
14428                 return;
14429         }
14430
14431         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
14432                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14433 }
14434
14435 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
14436                                           struct regulatory_request *request)
14437 {
14438         /* Userspace can always count this one always being set */
14439         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
14440                 goto nla_put_failure;
14441
14442         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
14443                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14444                                NL80211_REGDOM_TYPE_WORLD))
14445                         goto nla_put_failure;
14446         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
14447                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14448                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
14449                         goto nla_put_failure;
14450         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
14451                    request->intersect) {
14452                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14453                                NL80211_REGDOM_TYPE_INTERSECTION))
14454                         goto nla_put_failure;
14455         } else {
14456                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14457                                NL80211_REGDOM_TYPE_COUNTRY) ||
14458                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
14459                                    request->alpha2))
14460                         goto nla_put_failure;
14461         }
14462
14463         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
14464                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
14465
14466                 if (wiphy &&
14467                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
14468                         goto nla_put_failure;
14469
14470                 if (wiphy &&
14471                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
14472                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
14473                         goto nla_put_failure;
14474         }
14475
14476         return true;
14477
14478 nla_put_failure:
14479         return false;
14480 }
14481
14482 /*
14483  * This can happen on global regulatory changes or device specific settings
14484  * based on custom regulatory domains.
14485  */
14486 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
14487                                      struct regulatory_request *request)
14488 {
14489         struct sk_buff *msg;
14490         void *hdr;
14491
14492         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14493         if (!msg)
14494                 return;
14495
14496         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
14497         if (!hdr) {
14498                 nlmsg_free(msg);
14499                 return;
14500         }
14501
14502         if (nl80211_reg_change_event_fill(msg, request) == false)
14503                 goto nla_put_failure;
14504
14505         genlmsg_end(msg, hdr);
14506
14507         rcu_read_lock();
14508         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
14509                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
14510         rcu_read_unlock();
14511
14512         return;
14513
14514 nla_put_failure:
14515         nlmsg_free(msg);
14516 }
14517
14518 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
14519                                     struct net_device *netdev,
14520                                     const u8 *buf, size_t len,
14521                                     enum nl80211_commands cmd, gfp_t gfp,
14522                                     int uapsd_queues, const u8 *req_ies,
14523                                     size_t req_ies_len)
14524 {
14525         struct sk_buff *msg;
14526         void *hdr;
14527
14528         msg = nlmsg_new(100 + len + req_ies_len, gfp);
14529         if (!msg)
14530                 return;
14531
14532         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14533         if (!hdr) {
14534                 nlmsg_free(msg);
14535                 return;
14536         }
14537
14538         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14539             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14540             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
14541             (req_ies &&
14542              nla_put(msg, NL80211_ATTR_REQ_IE, req_ies_len, req_ies)))
14543                 goto nla_put_failure;
14544
14545         if (uapsd_queues >= 0) {
14546                 struct nlattr *nla_wmm =
14547                         nla_nest_start(msg, NL80211_ATTR_STA_WME);
14548                 if (!nla_wmm)
14549                         goto nla_put_failure;
14550
14551                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
14552                                uapsd_queues))
14553                         goto nla_put_failure;
14554
14555                 nla_nest_end(msg, nla_wmm);
14556         }
14557
14558         genlmsg_end(msg, hdr);
14559
14560         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14561                                 NL80211_MCGRP_MLME, gfp);
14562         return;
14563
14564  nla_put_failure:
14565         nlmsg_free(msg);
14566 }
14567
14568 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
14569                           struct net_device *netdev, const u8 *buf,
14570                           size_t len, gfp_t gfp)
14571 {
14572         nl80211_send_mlme_event(rdev, netdev, buf, len,
14573                                 NL80211_CMD_AUTHENTICATE, gfp, -1, NULL, 0);
14574 }
14575
14576 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
14577                            struct net_device *netdev, const u8 *buf,
14578                            size_t len, gfp_t gfp, int uapsd_queues,
14579                            const u8 *req_ies, size_t req_ies_len)
14580 {
14581         nl80211_send_mlme_event(rdev, netdev, buf, len,
14582                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues,
14583                                 req_ies, req_ies_len);
14584 }
14585
14586 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
14587                          struct net_device *netdev, const u8 *buf,
14588                          size_t len, gfp_t gfp)
14589 {
14590         nl80211_send_mlme_event(rdev, netdev, buf, len,
14591                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1, NULL, 0);
14592 }
14593
14594 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
14595                            struct net_device *netdev, const u8 *buf,
14596                            size_t len, gfp_t gfp)
14597 {
14598         nl80211_send_mlme_event(rdev, netdev, buf, len,
14599                                 NL80211_CMD_DISASSOCIATE, gfp, -1, NULL, 0);
14600 }
14601
14602 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
14603                                   size_t len)
14604 {
14605         struct wireless_dev *wdev = dev->ieee80211_ptr;
14606         struct wiphy *wiphy = wdev->wiphy;
14607         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14608         const struct ieee80211_mgmt *mgmt = (void *)buf;
14609         u32 cmd;
14610
14611         if (WARN_ON(len < 2))
14612                 return;
14613
14614         if (ieee80211_is_deauth(mgmt->frame_control))
14615                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
14616         else
14617                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
14618
14619         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
14620         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1,
14621                                 NULL, 0);
14622 }
14623 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
14624
14625 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
14626                                       struct net_device *netdev, int cmd,
14627                                       const u8 *addr, gfp_t gfp)
14628 {
14629         struct sk_buff *msg;
14630         void *hdr;
14631
14632         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14633         if (!msg)
14634                 return;
14635
14636         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14637         if (!hdr) {
14638                 nlmsg_free(msg);
14639                 return;
14640         }
14641
14642         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14643             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14644             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
14645             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
14646                 goto nla_put_failure;
14647
14648         genlmsg_end(msg, hdr);
14649
14650         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14651                                 NL80211_MCGRP_MLME, gfp);
14652         return;
14653
14654  nla_put_failure:
14655         nlmsg_free(msg);
14656 }
14657
14658 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
14659                                struct net_device *netdev, const u8 *addr,
14660                                gfp_t gfp)
14661 {
14662         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
14663                                   addr, gfp);
14664 }
14665
14666 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
14667                                 struct net_device *netdev, const u8 *addr,
14668                                 gfp_t gfp)
14669 {
14670         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
14671                                   addr, gfp);
14672 }
14673
14674 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
14675                                  struct net_device *netdev,
14676                                  struct cfg80211_connect_resp_params *cr,
14677                                  gfp_t gfp)
14678 {
14679         struct sk_buff *msg;
14680         void *hdr;
14681
14682         msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
14683                         cr->fils.kek_len + cr->fils.pmk_len +
14684                         (cr->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
14685         if (!msg)
14686                 return;
14687
14688         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
14689         if (!hdr) {
14690                 nlmsg_free(msg);
14691                 return;
14692         }
14693
14694         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14695             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14696             (cr->bssid &&
14697              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) ||
14698             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
14699                         cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
14700                         cr->status) ||
14701             (cr->status < 0 &&
14702              (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
14703               nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
14704                           cr->timeout_reason))) ||
14705             (cr->req_ie &&
14706              nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
14707             (cr->resp_ie &&
14708              nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
14709                      cr->resp_ie)) ||
14710             (cr->fils.update_erp_next_seq_num &&
14711              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
14712                          cr->fils.erp_next_seq_num)) ||
14713             (cr->status == WLAN_STATUS_SUCCESS &&
14714              ((cr->fils.kek &&
14715                nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
14716                        cr->fils.kek)) ||
14717               (cr->fils.pmk &&
14718                nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
14719               (cr->fils.pmkid &&
14720                nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
14721                 goto nla_put_failure;
14722
14723         genlmsg_end(msg, hdr);
14724
14725         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14726                                 NL80211_MCGRP_MLME, gfp);
14727         return;
14728
14729  nla_put_failure:
14730         nlmsg_free(msg);
14731 }
14732
14733 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
14734                          struct net_device *netdev,
14735                          struct cfg80211_roam_info *info, gfp_t gfp)
14736 {
14737         struct sk_buff *msg;
14738         void *hdr;
14739         const u8 *bssid = info->bss ? info->bss->bssid : info->bssid;
14740
14741         msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
14742                         info->fils.kek_len + info->fils.pmk_len +
14743                         (info->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
14744         if (!msg)
14745                 return;
14746
14747         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
14748         if (!hdr) {
14749                 nlmsg_free(msg);
14750                 return;
14751         }
14752
14753         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14754             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14755             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
14756             (info->req_ie &&
14757              nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
14758                      info->req_ie)) ||
14759             (info->resp_ie &&
14760              nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
14761                      info->resp_ie)) ||
14762             (info->fils.update_erp_next_seq_num &&
14763              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
14764                          info->fils.erp_next_seq_num)) ||
14765             (info->fils.kek &&
14766              nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
14767                      info->fils.kek)) ||
14768             (info->fils.pmk &&
14769              nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
14770             (info->fils.pmkid &&
14771              nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
14772                 goto nla_put_failure;
14773
14774         genlmsg_end(msg, hdr);
14775
14776         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14777                                 NL80211_MCGRP_MLME, gfp);
14778         return;
14779
14780  nla_put_failure:
14781         nlmsg_free(msg);
14782 }
14783
14784 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
14785                                   struct net_device *netdev, const u8 *bssid)
14786 {
14787         struct sk_buff *msg;
14788         void *hdr;
14789
14790         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14791         if (!msg)
14792                 return;
14793
14794         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
14795         if (!hdr) {
14796                 nlmsg_free(msg);
14797                 return;
14798         }
14799
14800         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
14801                 goto nla_put_failure;
14802
14803         genlmsg_end(msg, hdr);
14804
14805         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14806                                 NL80211_MCGRP_MLME, GFP_KERNEL);
14807         return;
14808
14809  nla_put_failure:
14810         nlmsg_free(msg);
14811 }
14812
14813 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
14814                                struct net_device *netdev, u16 reason,
14815                                const u8 *ie, size_t ie_len, bool from_ap)
14816 {
14817         struct sk_buff *msg;
14818         void *hdr;
14819
14820         msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
14821         if (!msg)
14822                 return;
14823
14824         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
14825         if (!hdr) {
14826                 nlmsg_free(msg);
14827                 return;
14828         }
14829
14830         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14831             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14832             (reason &&
14833              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
14834             (from_ap &&
14835              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
14836             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
14837                 goto nla_put_failure;
14838
14839         genlmsg_end(msg, hdr);
14840
14841         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14842                                 NL80211_MCGRP_MLME, GFP_KERNEL);
14843         return;
14844
14845  nla_put_failure:
14846         nlmsg_free(msg);
14847 }
14848
14849 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
14850                              struct net_device *netdev, const u8 *bssid,
14851                              gfp_t gfp)
14852 {
14853         struct sk_buff *msg;
14854         void *hdr;
14855
14856         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14857         if (!msg)
14858                 return;
14859
14860         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
14861         if (!hdr) {
14862                 nlmsg_free(msg);
14863                 return;
14864         }
14865
14866         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14867             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14868             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
14869                 goto nla_put_failure;
14870
14871         genlmsg_end(msg, hdr);
14872
14873         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14874                                 NL80211_MCGRP_MLME, gfp);
14875         return;
14876
14877  nla_put_failure:
14878         nlmsg_free(msg);
14879 }
14880
14881 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
14882                                         const u8 *ie, u8 ie_len,
14883                                         int sig_dbm, gfp_t gfp)
14884 {
14885         struct wireless_dev *wdev = dev->ieee80211_ptr;
14886         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14887         struct sk_buff *msg;
14888         void *hdr;
14889
14890         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
14891                 return;
14892
14893         trace_cfg80211_notify_new_peer_candidate(dev, addr);
14894
14895         msg = nlmsg_new(100 + ie_len, gfp);
14896         if (!msg)
14897                 return;
14898
14899         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
14900         if (!hdr) {
14901                 nlmsg_free(msg);
14902                 return;
14903         }
14904
14905         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14906             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14907             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
14908             (ie_len && ie &&
14909              nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
14910             (sig_dbm &&
14911              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
14912                 goto nla_put_failure;
14913
14914         genlmsg_end(msg, hdr);
14915
14916         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14917                                 NL80211_MCGRP_MLME, gfp);
14918         return;
14919
14920  nla_put_failure:
14921         nlmsg_free(msg);
14922 }
14923 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
14924
14925 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
14926                                  struct net_device *netdev, const u8 *addr,
14927                                  enum nl80211_key_type key_type, int key_id,
14928                                  const u8 *tsc, gfp_t gfp)
14929 {
14930         struct sk_buff *msg;
14931         void *hdr;
14932
14933         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14934         if (!msg)
14935                 return;
14936
14937         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
14938         if (!hdr) {
14939                 nlmsg_free(msg);
14940                 return;
14941         }
14942
14943         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14944             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14945             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
14946             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
14947             (key_id != -1 &&
14948              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
14949             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
14950                 goto nla_put_failure;
14951
14952         genlmsg_end(msg, hdr);
14953
14954         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14955                                 NL80211_MCGRP_MLME, gfp);
14956         return;
14957
14958  nla_put_failure:
14959         nlmsg_free(msg);
14960 }
14961
14962 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
14963                                     struct ieee80211_channel *channel_before,
14964                                     struct ieee80211_channel *channel_after)
14965 {
14966         struct sk_buff *msg;
14967         void *hdr;
14968         struct nlattr *nl_freq;
14969
14970         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
14971         if (!msg)
14972                 return;
14973
14974         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
14975         if (!hdr) {
14976                 nlmsg_free(msg);
14977                 return;
14978         }
14979
14980         /*
14981          * Since we are applying the beacon hint to a wiphy we know its
14982          * wiphy_idx is valid
14983          */
14984         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
14985                 goto nla_put_failure;
14986
14987         /* Before */
14988         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
14989         if (!nl_freq)
14990                 goto nla_put_failure;
14991
14992         if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
14993                 goto nla_put_failure;
14994         nla_nest_end(msg, nl_freq);
14995
14996         /* After */
14997         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
14998         if (!nl_freq)
14999                 goto nla_put_failure;
15000
15001         if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
15002                 goto nla_put_failure;
15003         nla_nest_end(msg, nl_freq);
15004
15005         genlmsg_end(msg, hdr);
15006
15007         rcu_read_lock();
15008         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
15009                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
15010         rcu_read_unlock();
15011
15012         return;
15013
15014 nla_put_failure:
15015         nlmsg_free(msg);
15016 }
15017
15018 static void nl80211_send_remain_on_chan_event(
15019         int cmd, struct cfg80211_registered_device *rdev,
15020         struct wireless_dev *wdev, u64 cookie,
15021         struct ieee80211_channel *chan,
15022         unsigned int duration, gfp_t gfp)
15023 {
15024         struct sk_buff *msg;
15025         void *hdr;
15026
15027         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15028         if (!msg)
15029                 return;
15030
15031         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
15032         if (!hdr) {
15033                 nlmsg_free(msg);
15034                 return;
15035         }
15036
15037         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15038             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15039                                          wdev->netdev->ifindex)) ||
15040             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15041                               NL80211_ATTR_PAD) ||
15042             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
15043             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
15044                         NL80211_CHAN_NO_HT) ||
15045             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15046                               NL80211_ATTR_PAD))
15047                 goto nla_put_failure;
15048
15049         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
15050             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
15051                 goto nla_put_failure;
15052
15053         genlmsg_end(msg, hdr);
15054
15055         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15056                                 NL80211_MCGRP_MLME, gfp);
15057         return;
15058
15059  nla_put_failure:
15060         nlmsg_free(msg);
15061 }
15062
15063 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
15064                                struct ieee80211_channel *chan,
15065                                unsigned int duration, gfp_t gfp)
15066 {
15067         struct wiphy *wiphy = wdev->wiphy;
15068         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15069
15070         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
15071         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
15072                                           rdev, wdev, cookie, chan,
15073                                           duration, gfp);
15074 }
15075 EXPORT_SYMBOL(cfg80211_ready_on_channel);
15076
15077 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
15078                                         struct ieee80211_channel *chan,
15079                                         gfp_t gfp)
15080 {
15081         struct wiphy *wiphy = wdev->wiphy;
15082         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15083
15084         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
15085         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
15086                                           rdev, wdev, cookie, chan, 0, gfp);
15087 }
15088 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
15089
15090 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
15091                       struct station_info *sinfo, gfp_t gfp)
15092 {
15093         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
15094         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15095         struct sk_buff *msg;
15096
15097         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
15098
15099         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15100         if (!msg)
15101                 return;
15102
15103         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
15104                                  rdev, dev, mac_addr, sinfo) < 0) {
15105                 nlmsg_free(msg);
15106                 return;
15107         }
15108
15109         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15110                                 NL80211_MCGRP_MLME, gfp);
15111 }
15112 EXPORT_SYMBOL(cfg80211_new_sta);
15113
15114 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
15115                             struct station_info *sinfo, gfp_t gfp)
15116 {
15117         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
15118         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15119         struct sk_buff *msg;
15120         struct station_info empty_sinfo = {};
15121
15122         if (!sinfo)
15123                 sinfo = &empty_sinfo;
15124
15125         trace_cfg80211_del_sta(dev, mac_addr);
15126
15127         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15128         if (!msg) {
15129                 cfg80211_sinfo_release_content(sinfo);
15130                 return;
15131         }
15132
15133         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
15134                                  rdev, dev, mac_addr, sinfo) < 0) {
15135                 nlmsg_free(msg);
15136                 return;
15137         }
15138
15139         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15140                                 NL80211_MCGRP_MLME, gfp);
15141 }
15142 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
15143
15144 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
15145                           enum nl80211_connect_failed_reason reason,
15146                           gfp_t gfp)
15147 {
15148         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
15149         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15150         struct sk_buff *msg;
15151         void *hdr;
15152
15153         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
15154         if (!msg)
15155                 return;
15156
15157         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
15158         if (!hdr) {
15159                 nlmsg_free(msg);
15160                 return;
15161         }
15162
15163         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15164             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
15165             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
15166                 goto nla_put_failure;
15167
15168         genlmsg_end(msg, hdr);
15169
15170         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15171                                 NL80211_MCGRP_MLME, gfp);
15172         return;
15173
15174  nla_put_failure:
15175         nlmsg_free(msg);
15176 }
15177 EXPORT_SYMBOL(cfg80211_conn_failed);
15178
15179 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
15180                                        const u8 *addr, gfp_t gfp)
15181 {
15182         struct wireless_dev *wdev = dev->ieee80211_ptr;
15183         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15184         struct sk_buff *msg;
15185         void *hdr;
15186         u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
15187
15188         if (!nlportid)
15189                 return false;
15190
15191         msg = nlmsg_new(100, gfp);
15192         if (!msg)
15193                 return true;
15194
15195         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
15196         if (!hdr) {
15197                 nlmsg_free(msg);
15198                 return true;
15199         }
15200
15201         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15202             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15203             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
15204                 goto nla_put_failure;
15205
15206         genlmsg_end(msg, hdr);
15207         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15208         return true;
15209
15210  nla_put_failure:
15211         nlmsg_free(msg);
15212         return true;
15213 }
15214
15215 bool cfg80211_rx_spurious_frame(struct net_device *dev,
15216                                 const u8 *addr, gfp_t gfp)
15217 {
15218         struct wireless_dev *wdev = dev->ieee80211_ptr;
15219         bool ret;
15220
15221         trace_cfg80211_rx_spurious_frame(dev, addr);
15222
15223         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
15224                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
15225                 trace_cfg80211_return_bool(false);
15226                 return false;
15227         }
15228         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
15229                                          addr, gfp);
15230         trace_cfg80211_return_bool(ret);
15231         return ret;
15232 }
15233 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
15234
15235 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
15236                                         const u8 *addr, gfp_t gfp)
15237 {
15238         struct wireless_dev *wdev = dev->ieee80211_ptr;
15239         bool ret;
15240
15241         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
15242
15243         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
15244                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
15245                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
15246                 trace_cfg80211_return_bool(false);
15247                 return false;
15248         }
15249         ret = __nl80211_unexpected_frame(dev,
15250                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
15251                                          addr, gfp);
15252         trace_cfg80211_return_bool(ret);
15253         return ret;
15254 }
15255 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
15256
15257 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
15258                       struct wireless_dev *wdev, u32 nlportid,
15259                       int freq, int sig_dbm,
15260                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
15261 {
15262         struct net_device *netdev = wdev->netdev;
15263         struct sk_buff *msg;
15264         void *hdr;
15265
15266         msg = nlmsg_new(100 + len, gfp);
15267         if (!msg)
15268                 return -ENOMEM;
15269
15270         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
15271         if (!hdr) {
15272                 nlmsg_free(msg);
15273                 return -ENOMEM;
15274         }
15275
15276         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15277             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15278                                         netdev->ifindex)) ||
15279             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15280                               NL80211_ATTR_PAD) ||
15281             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
15282             (sig_dbm &&
15283              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
15284             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
15285             (flags &&
15286              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
15287                 goto nla_put_failure;
15288
15289         genlmsg_end(msg, hdr);
15290
15291         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15292
15293  nla_put_failure:
15294         nlmsg_free(msg);
15295         return -ENOBUFS;
15296 }
15297
15298 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
15299                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
15300 {
15301         struct wiphy *wiphy = wdev->wiphy;
15302         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15303         struct net_device *netdev = wdev->netdev;
15304         struct sk_buff *msg;
15305         void *hdr;
15306
15307         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
15308
15309         msg = nlmsg_new(100 + len, gfp);
15310         if (!msg)
15311                 return;
15312
15313         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
15314         if (!hdr) {
15315                 nlmsg_free(msg);
15316                 return;
15317         }
15318
15319         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15320             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15321                                    netdev->ifindex)) ||
15322             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15323                               NL80211_ATTR_PAD) ||
15324             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
15325             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15326                               NL80211_ATTR_PAD) ||
15327             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
15328                 goto nla_put_failure;
15329
15330         genlmsg_end(msg, hdr);
15331
15332         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15333                                 NL80211_MCGRP_MLME, gfp);
15334         return;
15335
15336  nla_put_failure:
15337         nlmsg_free(msg);
15338 }
15339 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
15340
15341 static int __nl80211_rx_control_port(struct net_device *dev,
15342                                      struct sk_buff *skb,
15343                                      bool unencrypted, gfp_t gfp)
15344 {
15345         struct wireless_dev *wdev = dev->ieee80211_ptr;
15346         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15347         struct ethhdr *ehdr = eth_hdr(skb);
15348         const u8 *addr = ehdr->h_source;
15349         u16 proto = be16_to_cpu(skb->protocol);
15350         struct sk_buff *msg;
15351         void *hdr;
15352         struct nlattr *frame;
15353
15354         u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
15355
15356         if (!nlportid)
15357                 return -ENOENT;
15358
15359         msg = nlmsg_new(100 + skb->len, gfp);
15360         if (!msg)
15361                 return -ENOMEM;
15362
15363         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
15364         if (!hdr) {
15365                 nlmsg_free(msg);
15366                 return -ENOBUFS;
15367         }
15368
15369         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15370             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15371             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15372                               NL80211_ATTR_PAD) ||
15373             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
15374             nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
15375             (unencrypted && nla_put_flag(msg,
15376                                          NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
15377                 goto nla_put_failure;
15378
15379         frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
15380         if (!frame)
15381                 goto nla_put_failure;
15382
15383         skb_copy_bits(skb, 0, nla_data(frame), skb->len);
15384         genlmsg_end(msg, hdr);
15385
15386         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15387
15388  nla_put_failure:
15389         nlmsg_free(msg);
15390         return -ENOBUFS;
15391 }
15392
15393 bool cfg80211_rx_control_port(struct net_device *dev,
15394                               struct sk_buff *skb, bool unencrypted)
15395 {
15396         int ret;
15397
15398         trace_cfg80211_rx_control_port(dev, skb, unencrypted);
15399         ret = __nl80211_rx_control_port(dev, skb, unencrypted, GFP_ATOMIC);
15400         trace_cfg80211_return_bool(ret == 0);
15401         return ret == 0;
15402 }
15403 EXPORT_SYMBOL(cfg80211_rx_control_port);
15404
15405 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
15406                                             const char *mac, gfp_t gfp)
15407 {
15408         struct wireless_dev *wdev = dev->ieee80211_ptr;
15409         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15410         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15411         void **cb;
15412
15413         if (!msg)
15414                 return NULL;
15415
15416         cb = (void **)msg->cb;
15417
15418         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
15419         if (!cb[0]) {
15420                 nlmsg_free(msg);
15421                 return NULL;
15422         }
15423
15424         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15425             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15426                 goto nla_put_failure;
15427
15428         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
15429                 goto nla_put_failure;
15430
15431         cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM);
15432         if (!cb[1])
15433                 goto nla_put_failure;
15434
15435         cb[2] = rdev;
15436
15437         return msg;
15438  nla_put_failure:
15439         nlmsg_free(msg);
15440         return NULL;
15441 }
15442
15443 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
15444 {
15445         void **cb = (void **)msg->cb;
15446         struct cfg80211_registered_device *rdev = cb[2];
15447
15448         nla_nest_end(msg, cb[1]);
15449         genlmsg_end(msg, cb[0]);
15450
15451         memset(msg->cb, 0, sizeof(msg->cb));
15452
15453         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15454                                 NL80211_MCGRP_MLME, gfp);
15455 }
15456
15457 void cfg80211_cqm_rssi_notify(struct net_device *dev,
15458                               enum nl80211_cqm_rssi_threshold_event rssi_event,
15459                               s32 rssi_level, gfp_t gfp)
15460 {
15461         struct sk_buff *msg;
15462         struct wireless_dev *wdev = dev->ieee80211_ptr;
15463         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15464
15465         trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
15466
15467         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
15468                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
15469                 return;
15470
15471         if (wdev->cqm_config) {
15472                 wdev->cqm_config->last_rssi_event_value = rssi_level;
15473
15474                 cfg80211_cqm_rssi_update(rdev, dev);
15475
15476                 if (rssi_level == 0)
15477                         rssi_level = wdev->cqm_config->last_rssi_event_value;
15478         }
15479
15480         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
15481         if (!msg)
15482                 return;
15483
15484         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
15485                         rssi_event))
15486                 goto nla_put_failure;
15487
15488         if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
15489                                       rssi_level))
15490                 goto nla_put_failure;
15491
15492         cfg80211_send_cqm(msg, gfp);
15493
15494         return;
15495
15496  nla_put_failure:
15497         nlmsg_free(msg);
15498 }
15499 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
15500
15501 void cfg80211_cqm_txe_notify(struct net_device *dev,
15502                              const u8 *peer, u32 num_packets,
15503                              u32 rate, u32 intvl, gfp_t gfp)
15504 {
15505         struct sk_buff *msg;
15506
15507         msg = cfg80211_prepare_cqm(dev, peer, gfp);
15508         if (!msg)
15509                 return;
15510
15511         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
15512                 goto nla_put_failure;
15513
15514         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
15515                 goto nla_put_failure;
15516
15517         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
15518                 goto nla_put_failure;
15519
15520         cfg80211_send_cqm(msg, gfp);
15521         return;
15522
15523  nla_put_failure:
15524         nlmsg_free(msg);
15525 }
15526 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
15527
15528 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
15529                                  const u8 *peer, u32 num_packets, gfp_t gfp)
15530 {
15531         struct sk_buff *msg;
15532
15533         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
15534
15535         msg = cfg80211_prepare_cqm(dev, peer, gfp);
15536         if (!msg)
15537                 return;
15538
15539         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
15540                 goto nla_put_failure;
15541
15542         cfg80211_send_cqm(msg, gfp);
15543         return;
15544
15545  nla_put_failure:
15546         nlmsg_free(msg);
15547 }
15548 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
15549
15550 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
15551 {
15552         struct sk_buff *msg;
15553
15554         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
15555         if (!msg)
15556                 return;
15557
15558         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
15559                 goto nla_put_failure;
15560
15561         cfg80211_send_cqm(msg, gfp);
15562         return;
15563
15564  nla_put_failure:
15565         nlmsg_free(msg);
15566 }
15567 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
15568
15569 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
15570                                      struct net_device *netdev, const u8 *bssid,
15571                                      const u8 *replay_ctr, gfp_t gfp)
15572 {
15573         struct sk_buff *msg;
15574         struct nlattr *rekey_attr;
15575         void *hdr;
15576
15577         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15578         if (!msg)
15579                 return;
15580
15581         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
15582         if (!hdr) {
15583                 nlmsg_free(msg);
15584                 return;
15585         }
15586
15587         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15588             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15589             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
15590                 goto nla_put_failure;
15591
15592         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
15593         if (!rekey_attr)
15594                 goto nla_put_failure;
15595
15596         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
15597                     NL80211_REPLAY_CTR_LEN, replay_ctr))
15598                 goto nla_put_failure;
15599
15600         nla_nest_end(msg, rekey_attr);
15601
15602         genlmsg_end(msg, hdr);
15603
15604         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15605                                 NL80211_MCGRP_MLME, gfp);
15606         return;
15607
15608  nla_put_failure:
15609         nlmsg_free(msg);
15610 }
15611
15612 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
15613                                const u8 *replay_ctr, gfp_t gfp)
15614 {
15615         struct wireless_dev *wdev = dev->ieee80211_ptr;
15616         struct wiphy *wiphy = wdev->wiphy;
15617         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15618
15619         trace_cfg80211_gtk_rekey_notify(dev, bssid);
15620         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
15621 }
15622 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
15623
15624 static void
15625 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
15626                                struct net_device *netdev, int index,
15627                                const u8 *bssid, bool preauth, gfp_t gfp)
15628 {
15629         struct sk_buff *msg;
15630         struct nlattr *attr;
15631         void *hdr;
15632
15633         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15634         if (!msg)
15635                 return;
15636
15637         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
15638         if (!hdr) {
15639                 nlmsg_free(msg);
15640                 return;
15641         }
15642
15643         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15644             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
15645                 goto nla_put_failure;
15646
15647         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
15648         if (!attr)
15649                 goto nla_put_failure;
15650
15651         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
15652             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
15653             (preauth &&
15654              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
15655                 goto nla_put_failure;
15656
15657         nla_nest_end(msg, attr);
15658
15659         genlmsg_end(msg, hdr);
15660
15661         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15662                                 NL80211_MCGRP_MLME, gfp);
15663         return;
15664
15665  nla_put_failure:
15666         nlmsg_free(msg);
15667 }
15668
15669 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
15670                                      const u8 *bssid, bool preauth, gfp_t gfp)
15671 {
15672         struct wireless_dev *wdev = dev->ieee80211_ptr;
15673         struct wiphy *wiphy = wdev->wiphy;
15674         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15675
15676         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
15677         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
15678 }
15679 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
15680
15681 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
15682                                      struct net_device *netdev,
15683                                      struct cfg80211_chan_def *chandef,
15684                                      gfp_t gfp,
15685                                      enum nl80211_commands notif,
15686                                      u8 count)
15687 {
15688         struct sk_buff *msg;
15689         void *hdr;
15690
15691         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15692         if (!msg)
15693                 return;
15694
15695         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
15696         if (!hdr) {
15697                 nlmsg_free(msg);
15698                 return;
15699         }
15700
15701         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
15702                 goto nla_put_failure;
15703
15704         if (nl80211_send_chandef(msg, chandef))
15705                 goto nla_put_failure;
15706
15707         if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
15708             (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
15709                         goto nla_put_failure;
15710
15711         genlmsg_end(msg, hdr);
15712
15713         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15714                                 NL80211_MCGRP_MLME, gfp);
15715         return;
15716
15717  nla_put_failure:
15718         nlmsg_free(msg);
15719 }
15720
15721 void cfg80211_ch_switch_notify(struct net_device *dev,
15722                                struct cfg80211_chan_def *chandef)
15723 {
15724         struct wireless_dev *wdev = dev->ieee80211_ptr;
15725         struct wiphy *wiphy = wdev->wiphy;
15726         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15727
15728         ASSERT_WDEV_LOCK(wdev);
15729
15730         trace_cfg80211_ch_switch_notify(dev, chandef);
15731
15732         wdev->chandef = *chandef;
15733         wdev->preset_chandef = *chandef;
15734
15735         if (wdev->iftype == NL80211_IFTYPE_STATION &&
15736             !WARN_ON(!wdev->current_bss))
15737                 wdev->current_bss->pub.channel = chandef->chan;
15738
15739         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
15740                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0);
15741 }
15742 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
15743
15744 void cfg80211_ch_switch_started_notify(struct net_device *dev,
15745                                        struct cfg80211_chan_def *chandef,
15746                                        u8 count)
15747 {
15748         struct wireless_dev *wdev = dev->ieee80211_ptr;
15749         struct wiphy *wiphy = wdev->wiphy;
15750         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15751
15752         trace_cfg80211_ch_switch_started_notify(dev, chandef);
15753
15754         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
15755                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
15756 }
15757 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
15758
15759 void
15760 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
15761                      const struct cfg80211_chan_def *chandef,
15762                      enum nl80211_radar_event event,
15763                      struct net_device *netdev, gfp_t gfp)
15764 {
15765         struct sk_buff *msg;
15766         void *hdr;
15767
15768         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15769         if (!msg)
15770                 return;
15771
15772         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
15773         if (!hdr) {
15774                 nlmsg_free(msg);
15775                 return;
15776         }
15777
15778         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
15779                 goto nla_put_failure;
15780
15781         /* NOP and radar events don't need a netdev parameter */
15782         if (netdev) {
15783                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
15784
15785                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15786                     nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15787                                       NL80211_ATTR_PAD))
15788                         goto nla_put_failure;
15789         }
15790
15791         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
15792                 goto nla_put_failure;
15793
15794         if (nl80211_send_chandef(msg, chandef))
15795                 goto nla_put_failure;
15796
15797         genlmsg_end(msg, hdr);
15798
15799         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15800                                 NL80211_MCGRP_MLME, gfp);
15801         return;
15802
15803  nla_put_failure:
15804         nlmsg_free(msg);
15805 }
15806
15807 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
15808                                        struct sta_opmode_info *sta_opmode,
15809                                        gfp_t gfp)
15810 {
15811         struct sk_buff *msg;
15812         struct wireless_dev *wdev = dev->ieee80211_ptr;
15813         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15814         void *hdr;
15815
15816         if (WARN_ON(!mac))
15817                 return;
15818
15819         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15820         if (!msg)
15821                 return;
15822
15823         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
15824         if (!hdr) {
15825                 nlmsg_free(msg);
15826                 return;
15827         }
15828
15829         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
15830                 goto nla_put_failure;
15831
15832         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15833                 goto nla_put_failure;
15834
15835         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
15836                 goto nla_put_failure;
15837
15838         if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
15839             nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
15840                 goto nla_put_failure;
15841
15842         if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
15843             nla_put_u8(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
15844                 goto nla_put_failure;
15845
15846         if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
15847             nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
15848                 goto nla_put_failure;
15849
15850         genlmsg_end(msg, hdr);
15851
15852         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15853                                 NL80211_MCGRP_MLME, gfp);
15854
15855         return;
15856
15857 nla_put_failure:
15858         nlmsg_free(msg);
15859 }
15860 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
15861
15862 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
15863                            u64 cookie, bool acked, s32 ack_signal,
15864                            bool is_valid_ack_signal, gfp_t gfp)
15865 {
15866         struct wireless_dev *wdev = dev->ieee80211_ptr;
15867         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15868         struct sk_buff *msg;
15869         void *hdr;
15870
15871         trace_cfg80211_probe_status(dev, addr, cookie, acked);
15872
15873         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15874
15875         if (!msg)
15876                 return;
15877
15878         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
15879         if (!hdr) {
15880                 nlmsg_free(msg);
15881                 return;
15882         }
15883
15884         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15885             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15886             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
15887             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15888                               NL80211_ATTR_PAD) ||
15889             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
15890             (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
15891                                                 ack_signal)))
15892                 goto nla_put_failure;
15893
15894         genlmsg_end(msg, hdr);
15895
15896         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15897                                 NL80211_MCGRP_MLME, gfp);
15898         return;
15899
15900  nla_put_failure:
15901         nlmsg_free(msg);
15902 }
15903 EXPORT_SYMBOL(cfg80211_probe_status);
15904
15905 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
15906                                  const u8 *frame, size_t len,
15907                                  int freq, int sig_dbm)
15908 {
15909         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15910         struct sk_buff *msg;
15911         void *hdr;
15912         struct cfg80211_beacon_registration *reg;
15913
15914         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
15915
15916         spin_lock_bh(&rdev->beacon_registrations_lock);
15917         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
15918                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
15919                 if (!msg) {
15920                         spin_unlock_bh(&rdev->beacon_registrations_lock);
15921                         return;
15922                 }
15923
15924                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
15925                 if (!hdr)
15926                         goto nla_put_failure;
15927
15928                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15929                     (freq &&
15930                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
15931                     (sig_dbm &&
15932                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
15933                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
15934                         goto nla_put_failure;
15935
15936                 genlmsg_end(msg, hdr);
15937
15938                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
15939         }
15940         spin_unlock_bh(&rdev->beacon_registrations_lock);
15941         return;
15942
15943  nla_put_failure:
15944         spin_unlock_bh(&rdev->beacon_registrations_lock);
15945         nlmsg_free(msg);
15946 }
15947 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
15948
15949 #ifdef CONFIG_PM
15950 static int cfg80211_net_detect_results(struct sk_buff *msg,
15951                                        struct cfg80211_wowlan_wakeup *wakeup)
15952 {
15953         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
15954         struct nlattr *nl_results, *nl_match, *nl_freqs;
15955         int i, j;
15956
15957         nl_results = nla_nest_start(
15958                 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
15959         if (!nl_results)
15960                 return -EMSGSIZE;
15961
15962         for (i = 0; i < nd->n_matches; i++) {
15963                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
15964
15965                 nl_match = nla_nest_start(msg, i);
15966                 if (!nl_match)
15967                         break;
15968
15969                 /* The SSID attribute is optional in nl80211, but for
15970                  * simplicity reasons it's always present in the
15971                  * cfg80211 structure.  If a driver can't pass the
15972                  * SSID, that needs to be changed.  A zero length SSID
15973                  * is still a valid SSID (wildcard), so it cannot be
15974                  * used for this purpose.
15975                  */
15976                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
15977                             match->ssid.ssid)) {
15978                         nla_nest_cancel(msg, nl_match);
15979                         goto out;
15980                 }
15981
15982                 if (match->n_channels) {
15983                         nl_freqs = nla_nest_start(
15984                                 msg, NL80211_ATTR_SCAN_FREQUENCIES);
15985                         if (!nl_freqs) {
15986                                 nla_nest_cancel(msg, nl_match);
15987                                 goto out;
15988                         }
15989
15990                         for (j = 0; j < match->n_channels; j++) {
15991                                 if (nla_put_u32(msg, j, match->channels[j])) {
15992                                         nla_nest_cancel(msg, nl_freqs);
15993                                         nla_nest_cancel(msg, nl_match);
15994                                         goto out;
15995                                 }
15996                         }
15997
15998                         nla_nest_end(msg, nl_freqs);
15999                 }
16000
16001                 nla_nest_end(msg, nl_match);
16002         }
16003
16004 out:
16005         nla_nest_end(msg, nl_results);
16006         return 0;
16007 }
16008
16009 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
16010                                    struct cfg80211_wowlan_wakeup *wakeup,
16011                                    gfp_t gfp)
16012 {
16013         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16014         struct sk_buff *msg;
16015         void *hdr;
16016         int size = 200;
16017
16018         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
16019
16020         if (wakeup)
16021                 size += wakeup->packet_present_len;
16022
16023         msg = nlmsg_new(size, gfp);
16024         if (!msg)
16025                 return;
16026
16027         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
16028         if (!hdr)
16029                 goto free_msg;
16030
16031         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16032             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16033                               NL80211_ATTR_PAD))
16034                 goto free_msg;
16035
16036         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16037                                         wdev->netdev->ifindex))
16038                 goto free_msg;
16039
16040         if (wakeup) {
16041                 struct nlattr *reasons;
16042
16043                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
16044                 if (!reasons)
16045                         goto free_msg;
16046
16047                 if (wakeup->disconnect &&
16048                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
16049                         goto free_msg;
16050                 if (wakeup->magic_pkt &&
16051                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
16052                         goto free_msg;
16053                 if (wakeup->gtk_rekey_failure &&
16054                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
16055                         goto free_msg;
16056                 if (wakeup->eap_identity_req &&
16057                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
16058                         goto free_msg;
16059                 if (wakeup->four_way_handshake &&
16060                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
16061                         goto free_msg;
16062                 if (wakeup->rfkill_release &&
16063                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
16064                         goto free_msg;
16065
16066                 if (wakeup->pattern_idx >= 0 &&
16067                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
16068                                 wakeup->pattern_idx))
16069                         goto free_msg;
16070
16071                 if (wakeup->tcp_match &&
16072                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
16073                         goto free_msg;
16074
16075                 if (wakeup->tcp_connlost &&
16076                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
16077                         goto free_msg;
16078
16079                 if (wakeup->tcp_nomoretokens &&
16080                     nla_put_flag(msg,
16081                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
16082                         goto free_msg;
16083
16084                 if (wakeup->packet) {
16085                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
16086                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
16087
16088                         if (!wakeup->packet_80211) {
16089                                 pkt_attr =
16090                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
16091                                 len_attr =
16092                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
16093                         }
16094
16095                         if (wakeup->packet_len &&
16096                             nla_put_u32(msg, len_attr, wakeup->packet_len))
16097                                 goto free_msg;
16098
16099                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
16100                                     wakeup->packet))
16101                                 goto free_msg;
16102                 }
16103
16104                 if (wakeup->net_detect &&
16105                     cfg80211_net_detect_results(msg, wakeup))
16106                                 goto free_msg;
16107
16108                 nla_nest_end(msg, reasons);
16109         }
16110
16111         genlmsg_end(msg, hdr);
16112
16113         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16114                                 NL80211_MCGRP_MLME, gfp);
16115         return;
16116
16117  free_msg:
16118         nlmsg_free(msg);
16119 }
16120 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
16121 #endif
16122
16123 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
16124                                 enum nl80211_tdls_operation oper,
16125                                 u16 reason_code, gfp_t gfp)
16126 {
16127         struct wireless_dev *wdev = dev->ieee80211_ptr;
16128         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16129         struct sk_buff *msg;
16130         void *hdr;
16131
16132         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
16133                                          reason_code);
16134
16135         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16136         if (!msg)
16137                 return;
16138
16139         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
16140         if (!hdr) {
16141                 nlmsg_free(msg);
16142                 return;
16143         }
16144
16145         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16146             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16147             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
16148             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
16149             (reason_code > 0 &&
16150              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
16151                 goto nla_put_failure;
16152
16153         genlmsg_end(msg, hdr);
16154
16155         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16156                                 NL80211_MCGRP_MLME, gfp);
16157         return;
16158
16159  nla_put_failure:
16160         nlmsg_free(msg);
16161 }
16162 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
16163
16164 static int nl80211_netlink_notify(struct notifier_block * nb,
16165                                   unsigned long state,
16166                                   void *_notify)
16167 {
16168         struct netlink_notify *notify = _notify;
16169         struct cfg80211_registered_device *rdev;
16170         struct wireless_dev *wdev;
16171         struct cfg80211_beacon_registration *reg, *tmp;
16172
16173         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
16174                 return NOTIFY_DONE;
16175
16176         rcu_read_lock();
16177
16178         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
16179                 struct cfg80211_sched_scan_request *sched_scan_req;
16180
16181                 list_for_each_entry_rcu(sched_scan_req,
16182                                         &rdev->sched_scan_req_list,
16183                                         list) {
16184                         if (sched_scan_req->owner_nlportid == notify->portid) {
16185                                 sched_scan_req->nl_owner_dead = true;
16186                                 schedule_work(&rdev->sched_scan_stop_wk);
16187                         }
16188                 }
16189
16190                 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
16191                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
16192
16193                         if (wdev->owner_nlportid == notify->portid) {
16194                                 wdev->nl_owner_dead = true;
16195                                 schedule_work(&rdev->destroy_work);
16196                         } else if (wdev->conn_owner_nlportid == notify->portid) {
16197                                 schedule_work(&wdev->disconnect_wk);
16198                         }
16199
16200                         cfg80211_release_pmsr(wdev, notify->portid);
16201                 }
16202
16203                 spin_lock_bh(&rdev->beacon_registrations_lock);
16204                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
16205                                          list) {
16206                         if (reg->nlportid == notify->portid) {
16207                                 list_del(&reg->list);
16208                                 kfree(reg);
16209                                 break;
16210                         }
16211                 }
16212                 spin_unlock_bh(&rdev->beacon_registrations_lock);
16213         }
16214
16215         rcu_read_unlock();
16216
16217         /*
16218          * It is possible that the user space process that is controlling the
16219          * indoor setting disappeared, so notify the regulatory core.
16220          */
16221         regulatory_netlink_notify(notify->portid);
16222         return NOTIFY_OK;
16223 }
16224
16225 static struct notifier_block nl80211_netlink_notifier = {
16226         .notifier_call = nl80211_netlink_notify,
16227 };
16228
16229 void cfg80211_ft_event(struct net_device *netdev,
16230                        struct cfg80211_ft_event_params *ft_event)
16231 {
16232         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
16233         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16234         struct sk_buff *msg;
16235         void *hdr;
16236
16237         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
16238
16239         if (!ft_event->target_ap)
16240                 return;
16241
16242         msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
16243                         GFP_KERNEL);
16244         if (!msg)
16245                 return;
16246
16247         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
16248         if (!hdr)
16249                 goto out;
16250
16251         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16252             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16253             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
16254                 goto out;
16255
16256         if (ft_event->ies &&
16257             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
16258                 goto out;
16259         if (ft_event->ric_ies &&
16260             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
16261                     ft_event->ric_ies))
16262                 goto out;
16263
16264         genlmsg_end(msg, hdr);
16265
16266         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16267                                 NL80211_MCGRP_MLME, GFP_KERNEL);
16268         return;
16269  out:
16270         nlmsg_free(msg);
16271 }
16272 EXPORT_SYMBOL(cfg80211_ft_event);
16273
16274 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
16275 {
16276         struct cfg80211_registered_device *rdev;
16277         struct sk_buff *msg;
16278         void *hdr;
16279         u32 nlportid;
16280
16281         rdev = wiphy_to_rdev(wdev->wiphy);
16282         if (!rdev->crit_proto_nlportid)
16283                 return;
16284
16285         nlportid = rdev->crit_proto_nlportid;
16286         rdev->crit_proto_nlportid = 0;
16287
16288         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16289         if (!msg)
16290                 return;
16291
16292         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
16293         if (!hdr)
16294                 goto nla_put_failure;
16295
16296         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16297             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16298                               NL80211_ATTR_PAD))
16299                 goto nla_put_failure;
16300
16301         genlmsg_end(msg, hdr);
16302
16303         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
16304         return;
16305
16306  nla_put_failure:
16307         nlmsg_free(msg);
16308 }
16309 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
16310
16311 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
16312 {
16313         struct wiphy *wiphy = wdev->wiphy;
16314         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16315         struct sk_buff *msg;
16316         void *hdr;
16317
16318         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16319         if (!msg)
16320                 return;
16321
16322         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
16323         if (!hdr)
16324                 goto out;
16325
16326         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16327             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
16328             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16329                               NL80211_ATTR_PAD))
16330                 goto out;
16331
16332         genlmsg_end(msg, hdr);
16333
16334         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
16335                                 NL80211_MCGRP_MLME, GFP_KERNEL);
16336         return;
16337  out:
16338         nlmsg_free(msg);
16339 }
16340
16341 int cfg80211_external_auth_request(struct net_device *dev,
16342                                    struct cfg80211_external_auth_params *params,
16343                                    gfp_t gfp)
16344 {
16345         struct wireless_dev *wdev = dev->ieee80211_ptr;
16346         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16347         struct sk_buff *msg;
16348         void *hdr;
16349
16350         if (!wdev->conn_owner_nlportid)
16351                 return -EINVAL;
16352
16353         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16354         if (!msg)
16355                 return -ENOMEM;
16356
16357         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
16358         if (!hdr)
16359                 goto nla_put_failure;
16360
16361         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16362             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16363             nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) ||
16364             nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
16365                         params->action) ||
16366             nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
16367             nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
16368                     params->ssid.ssid))
16369                 goto nla_put_failure;
16370
16371         genlmsg_end(msg, hdr);
16372         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
16373                         wdev->conn_owner_nlportid);
16374         return 0;
16375
16376  nla_put_failure:
16377         nlmsg_free(msg);
16378         return -ENOBUFS;
16379 }
16380 EXPORT_SYMBOL(cfg80211_external_auth_request);
16381
16382 void cfg80211_update_owe_info_event(struct net_device *netdev,
16383                                     struct cfg80211_update_owe_info *owe_info,
16384                                     gfp_t gfp)
16385 {
16386         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
16387         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16388         struct sk_buff *msg;
16389         void *hdr;
16390
16391         trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info);
16392
16393         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16394         if (!msg)
16395                 return;
16396
16397         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO);
16398         if (!hdr)
16399                 goto nla_put_failure;
16400
16401         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16402             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16403             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer))
16404                 goto nla_put_failure;
16405
16406         if (!owe_info->ie_len ||
16407             nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie))
16408                 goto nla_put_failure;
16409
16410         genlmsg_end(msg, hdr);
16411
16412         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16413                                 NL80211_MCGRP_MLME, gfp);
16414         return;
16415
16416 nla_put_failure:
16417         genlmsg_cancel(msg, hdr);
16418         nlmsg_free(msg);
16419 }
16420 EXPORT_SYMBOL(cfg80211_update_owe_info_event);
16421
16422 /* initialisation/exit functions */
16423
16424 int __init nl80211_init(void)
16425 {
16426         int err;
16427
16428         err = genl_register_family(&nl80211_fam);
16429         if (err)
16430                 return err;
16431
16432         err = netlink_register_notifier(&nl80211_netlink_notifier);
16433         if (err)
16434                 goto err_out;
16435
16436         return 0;
16437  err_out:
16438         genl_unregister_family(&nl80211_fam);
16439         return err;
16440 }
16441
16442 void nl80211_exit(void)
16443 {
16444         netlink_unregister_notifier(&nl80211_netlink_notifier);
16445         genl_unregister_family(&nl80211_fam);
16446 }