net/wireless/nl80211.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * This is the new netlink-based wireless configuration interface.
   4  *
   5  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   6  * Copyright 2013-2014  Intel Mobile Communications GmbH
   7  * Copyright 2015-2017  Intel Deutschland GmbH
   8  * Copyright (C) 2018-2019 Intel Corporation
   9  */
  10
  11 #include <linux/if.h>
  12 #include <linux/module.h>
  13 #include <linux/err.h>
  14 #include <linux/slab.h>
  15 #include <linux/list.h>
  16 #include <linux/if_ether.h>
  17 #include <linux/ieee80211.h>
  18 #include <linux/nl80211.h>
  19 #include <linux/rtnetlink.h>
  20 #include <linux/netlink.h>
  21 #include <linux/nospec.h>
  22 #include <linux/etherdevice.h>
  23 #include <net/net_namespace.h>
  24 #include <net/genetlink.h>
  25 #include <net/cfg80211.h>
  26 #include <net/sock.h>
  27 #include <net/inet_connection_sock.h>
  28 #include "core.h"
  29 #include "nl80211.h"
  30 #include "reg.h"
  31 #include "rdev-ops.h"
  32
  33 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  34                                    struct genl_info *info,
  35                                    struct cfg80211_crypto_settings *settings,
  36                                    int cipher_limit);
  37
  38 /* the netlink family */
  39 static struct genl_family nl80211_fam;
  40
  41 /* multicast groups */
  42 enum nl80211_multicast_groups {
  43         NL80211_MCGRP_CONFIG,
  44         NL80211_MCGRP_SCAN,
  45         NL80211_MCGRP_REGULATORY,
  46         NL80211_MCGRP_MLME,
  47         NL80211_MCGRP_VENDOR,
  48         NL80211_MCGRP_NAN,
  49         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  50 };
  51
  52 static const struct genl_multicast_group nl80211_mcgrps[] = {
  53         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  54         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  55         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  56         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  57         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  58         [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
  59 #ifdef CONFIG_NL80211_TESTMODE
  60         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  61 #endif
  62 };
  63
  64 /* returns ERR_PTR values */
  65 static struct wireless_dev *
  66 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  67 {
  68         struct cfg80211_registered_device *rdev;
  69         struct wireless_dev *result = NULL;
  70         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  71         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  72         u64 wdev_id;
  73         int wiphy_idx = -1;
  74         int ifidx = -1;
  75
  76         ASSERT_RTNL();
  77
  78         if (!have_ifidx && !have_wdev_id)
  79                 return ERR_PTR(-EINVAL);
  80
  81         if (have_ifidx)
  82                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  83         if (have_wdev_id) {
  84                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  85                 wiphy_idx = wdev_id >> 32;
  86         }
  87
  88         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  89                 struct wireless_dev *wdev;
  90
  91                 if (wiphy_net(&rdev->wiphy) != netns)
  92                         continue;
  93
  94                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  95                         continue;
  96
  97                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
  98                         if (have_ifidx && wdev->netdev &&
  99                             wdev->netdev->ifindex == ifidx) {
 100                                 result = wdev;
 101                                 break;
 102                         }
 103                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 104                                 result = wdev;
 105                                 break;
 106                         }
 107                 }
 108
 109                 if (result)
 110                         break;
 111         }
 112
 113         if (result)
 114                 return result;
 115         return ERR_PTR(-ENODEV);
 116 }
 117
 118 static struct cfg80211_registered_device *
 119 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 120 {
 121         struct cfg80211_registered_device *rdev = NULL, *tmp;
 122         struct net_device *netdev;
 123
 124         ASSERT_RTNL();
 125
 126         if (!attrs[NL80211_ATTR_WIPHY] &&
 127             !attrs[NL80211_ATTR_IFINDEX] &&
 128             !attrs[NL80211_ATTR_WDEV])
 129                 return ERR_PTR(-EINVAL);
 130
 131         if (attrs[NL80211_ATTR_WIPHY])
 132                 rdev = cfg80211_rdev_by_wiphy_idx(
 133                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 134
 135         if (attrs[NL80211_ATTR_WDEV]) {
 136                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 137                 struct wireless_dev *wdev;
 138                 bool found = false;
 139
 140                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 141                 if (tmp) {
 142                         /* make sure wdev exists */
 143                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 144                                 if (wdev->identifier != (u32)wdev_id)
 145                                         continue;
 146                                 found = true;
 147                                 break;
 148                         }
 149
 150                         if (!found)
 151                                 tmp = NULL;
 152
 153                         if (rdev && tmp != rdev)
 154                                 return ERR_PTR(-EINVAL);
 155                         rdev = tmp;
 156                 }
 157         }
 158
 159         if (attrs[NL80211_ATTR_IFINDEX]) {
 160                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 161
 162                 netdev = __dev_get_by_index(netns, ifindex);
 163                 if (netdev) {
 164                         if (netdev->ieee80211_ptr)
 165                                 tmp = wiphy_to_rdev(
 166                                         netdev->ieee80211_ptr->wiphy);
 167                         else
 168                                 tmp = NULL;
 169
 170                         /* not wireless device -- return error */
 171                         if (!tmp)
 172                                 return ERR_PTR(-EINVAL);
 173
 174                         /* mismatch -- return error */
 175                         if (rdev && tmp != rdev)
 176                                 return ERR_PTR(-EINVAL);
 177
 178                         rdev = tmp;
 179                 }
 180         }
 181
 182         if (!rdev)
 183                 return ERR_PTR(-ENODEV);
 184
 185         if (netns != wiphy_net(&rdev->wiphy))
 186                 return ERR_PTR(-ENODEV);
 187
 188         return rdev;
 189 }
 190
 191 /*
 192  * This function returns a pointer to the driver
 193  * that the genl_info item that is passed refers to.
 194  *
 195  * The result of this can be a PTR_ERR and hence must
 196  * be checked with IS_ERR() for errors.
 197  */
 198 static struct cfg80211_registered_device *
 199 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 200 {
 201         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 202 }
 203
 204 static int validate_ie_attr(const struct nlattr *attr,
 205                             struct netlink_ext_ack *extack)
 206 {
 207         const u8 *data = nla_data(attr);
 208         unsigned int len = nla_len(attr);
 209         const struct element *elem;
 210
 211         for_each_element(elem, data, len) {
 212                 /* nothing */
 213         }
 214
 215         if (for_each_element_completed(elem, data, len))
 216                 return 0;
 217
 218         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
 219         return -EINVAL;
 220 }
 221
 222 /* policy for the attributes */
 223 static const struct nla_policy
 224 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
 225         [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
 226         [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
 227                                         .len = U8_MAX },
 228         [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
 229                                              .len = U8_MAX },
 230 };
 231
 232 static const struct nla_policy
 233 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
 234         [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
 235         [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
 236         [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
 237                 NLA_POLICY_MAX(NLA_U8, 15),
 238         [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
 239         [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
 240                 NLA_POLICY_MAX(NLA_U8, 15),
 241         [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] =
 242                 NLA_POLICY_MAX(NLA_U8, 31),
 243         [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
 244         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
 245         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
 246 };
 247
 248 static const struct nla_policy
 249 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
 250         [NL80211_PMSR_TYPE_FTM] =
 251                 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
 252 };
 253
 254 static const struct nla_policy
 255 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
 256         [NL80211_PMSR_REQ_ATTR_DATA] =
 257                 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
 258         [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
 259 };
 260
 261 static const struct nla_policy
 262 nl80211_psmr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
 263         [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
 264         /*
 265          * we could specify this again to be the top-level policy,
 266          * but that would open us up to recursion problems ...
 267          */
 268         [NL80211_PMSR_PEER_ATTR_CHAN] = { .type = NLA_NESTED },
 269         [NL80211_PMSR_PEER_ATTR_REQ] =
 270                 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
 271         [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
 272 };
 273
 274 static const struct nla_policy
 275 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
 276         [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
 277         [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
 278         [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
 279         [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
 280         [NL80211_PMSR_ATTR_PEERS] =
 281                 NLA_POLICY_NESTED_ARRAY(nl80211_psmr_peer_attr_policy),
 282 };
 283
 284 const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 285         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 286         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 287                                       .len = 20-1 },
 288         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 289
 290         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 291         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 292         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 293         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 294         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 295
 296         [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 297         [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 298         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 299         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 300         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 301         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 302
 303         [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
 304         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 305         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 306
 307         [NL80211_ATTR_MAC] = { .type = NLA_EXACT_LEN_WARN, .len = ETH_ALEN },
 308         [NL80211_ATTR_PREV_BSSID] = {
 309                 .type = NLA_EXACT_LEN_WARN,
 310                 .len = ETH_ALEN
 311         },
 312
 313         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 314         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 315                                     .len = WLAN_MAX_KEY_LEN },
 316         [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 5),
 317         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 318         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 319         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 320         [NL80211_ATTR_KEY_TYPE] =
 321                 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
 322
 323         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 324         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 325         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 326                                        .len = IEEE80211_MAX_DATA_LEN },
 327         [NL80211_ATTR_BEACON_TAIL] =
 328                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 329                                        IEEE80211_MAX_DATA_LEN),
 330         [NL80211_ATTR_STA_AID] =
 331                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 332         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 333         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 334         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 335                                                .len = NL80211_MAX_SUPP_RATES },
 336         [NL80211_ATTR_STA_PLINK_ACTION] =
 337                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
 338         [NL80211_ATTR_STA_TX_POWER_SETTING] =
 339                 NLA_POLICY_RANGE(NLA_U8,
 340                                  NL80211_TX_POWER_AUTOMATIC,
 341                                  NL80211_TX_POWER_FIXED),
 342         [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 },
 343         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 344         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 345         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 346                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 347         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 348
 349         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 350         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 351
 352         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 353         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 354         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 355         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 356                                            .len = NL80211_MAX_SUPP_RATES },
 357         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 358
 359         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 360         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 361
 362         [NL80211_ATTR_HT_CAPABILITY] = {
 363                 .type = NLA_EXACT_LEN_WARN,
 364                 .len = NL80211_HT_CAPABILITY_LEN
 365         },
 366
 367         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 368         [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
 369                                                    validate_ie_attr,
 370                                                    IEEE80211_MAX_DATA_LEN),
 371         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 372         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 373
 374         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 375                                 .len = IEEE80211_MAX_SSID_LEN },
 376         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 377         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 378         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 379         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 380         [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
 381                                                   NL80211_MFP_NO,
 382                                                   NL80211_MFP_OPTIONAL),
 383         [NL80211_ATTR_STA_FLAGS2] = {
 384                 .len = sizeof(struct nl80211_sta_flag_update),
 385         },
 386         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 387         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 388         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 389         [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
 390         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 391         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 392         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 393         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 394         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 395         [NL80211_ATTR_PMKID] = {
 396                 .type = NLA_EXACT_LEN_WARN,
 397                 .len = WLAN_PMKID_LEN
 398         },
 399         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 400         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 401         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 402         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 403                                  .len = IEEE80211_MAX_DATA_LEN },
 404         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 405         [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
 406                                                    NL80211_PS_DISABLED,
 407                                                    NL80211_PS_ENABLED),
 408         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 409         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 410         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 411         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 412         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 413         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 414         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 415         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 416         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 417         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 418         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 419         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 420         [NL80211_ATTR_STA_PLINK_STATE] =
 421                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
 422         [NL80211_ATTR_MESH_PEER_AID] =
 423                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 424         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 425         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 426         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 427         [NL80211_ATTR_HIDDEN_SSID] =
 428                 NLA_POLICY_RANGE(NLA_U32,
 429                                  NL80211_HIDDEN_SSID_NOT_IN_USE,
 430                                  NL80211_HIDDEN_SSID_ZERO_CONTENTS),
 431         [NL80211_ATTR_IE_PROBE_RESP] =
 432                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 433                                        IEEE80211_MAX_DATA_LEN),
 434         [NL80211_ATTR_IE_ASSOC_RESP] =
 435                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 436                                        IEEE80211_MAX_DATA_LEN),
 437         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 438         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 439         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 440         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 441         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 442         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 443         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 444         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 445         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 446         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 447         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 448                                       .len = IEEE80211_MAX_DATA_LEN },
 449         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 450         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 451         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 452                 .len = NL80211_HT_CAPABILITY_LEN
 453         },
 454         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 455         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 456         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 457         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 458         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 459         [NL80211_ATTR_AUTH_DATA] = { .type = NLA_BINARY, },
 460         [NL80211_ATTR_VHT_CAPABILITY] = {
 461                 .type = NLA_EXACT_LEN_WARN,
 462                 .len = NL80211_VHT_CAPABILITY_LEN
 463         },
 464         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 465         [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
 466         [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
 467         [NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
 468                 NLA_POLICY_RANGE(NLA_U32,
 469                                  NL80211_MESH_POWER_UNKNOWN + 1,
 470                                  NL80211_MESH_POWER_MAX),
 471         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 472         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 473         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 474         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 475         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 476         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 477         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 478                 .len = NL80211_VHT_CAPABILITY_LEN,
 479         },
 480         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 481         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 482                                   .len = IEEE80211_MAX_DATA_LEN },
 483         [NL80211_ATTR_PEER_AID] =
 484                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 485         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 486         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 487         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 488         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 489         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 490         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 491         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 492         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 493         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 494         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 495         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 496         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 497         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 498                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 499         [NL80211_ATTR_MAC_HINT] = {
 500                 .type = NLA_EXACT_LEN_WARN,
 501                 .len = ETH_ALEN
 502         },
 503         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 504         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 505         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 506         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 507         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 508         [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
 509         [NL80211_ATTR_USER_PRIO] =
 510                 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
 511         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 512         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 513         [NL80211_ATTR_MAC_MASK] = {
 514                 .type = NLA_EXACT_LEN_WARN,
 515                 .len = ETH_ALEN
 516         },
 517         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 518         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 519         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 520         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 521         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 522         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 523         [NL80211_ATTR_STA_SUPPORT_P2P_PS] =
 524                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
 525         [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 526                 .len = VHT_MUMIMO_GROUPS_DATA_LEN
 527         },
 528         [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = {
 529                 .type = NLA_EXACT_LEN_WARN,
 530                 .len = ETH_ALEN
 531         },
 532         [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
 533         [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
 534         [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 535         [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
 536                                     .len = FILS_MAX_KEK_LEN },
 537         [NL80211_ATTR_FILS_NONCES] = {
 538                 .type = NLA_EXACT_LEN_WARN,
 539                 .len = 2 * FILS_NONCE_LEN
 540         },
 541         [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
 542         [NL80211_ATTR_BSSID] = { .type = NLA_EXACT_LEN_WARN, .len = ETH_ALEN },
 543         [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
 544         [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
 545                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 546         },
 547         [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
 548         [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
 549                                              .len = FILS_ERP_MAX_USERNAME_LEN },
 550         [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
 551                                           .len = FILS_ERP_MAX_REALM_LEN },
 552         [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
 553         [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
 554                                         .len = FILS_ERP_MAX_RRK_LEN },
 555         [NL80211_ATTR_FILS_CACHE_ID] = { .type = NLA_EXACT_LEN_WARN, .len = 2 },
 556         [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
 557         [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
 558         [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
 559
 560         [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
 561         [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
 562         [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
 563         [NL80211_ATTR_HE_CAPABILITY] = { .type = NLA_BINARY,
 564                                          .len = NL80211_HE_MAX_CAPABILITY_LEN },
 565
 566         [NL80211_ATTR_FTM_RESPONDER] = {
 567                 .type = NLA_NESTED,
 568                 .validation_data = nl80211_ftm_responder_policy,
 569         },
 570         [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
 571         [NL80211_ATTR_PEER_MEASUREMENTS] =
 572                 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
 573         [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
 574 };
 575
 576 /* policy for the key attributes */
 577 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 578         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 579         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 580         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 581         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 582         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 583         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 584         [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
 585         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 586         [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
 587 };
 588
 589 /* policy for the key default flags */
 590 static const struct nla_policy
 591 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 592         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 593         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 594 };
 595
 596 #ifdef CONFIG_PM
 597 /* policy for WoWLAN attributes */
 598 static const struct nla_policy
 599 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 600         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 601         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 602         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 603         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 604         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 605         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 606         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 607         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 608         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 609         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 610 };
 611
 612 static const struct nla_policy
 613 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 614         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 615         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 616         [NL80211_WOWLAN_TCP_DST_MAC] = {
 617                 .type = NLA_EXACT_LEN_WARN,
 618                 .len = ETH_ALEN
 619         },
 620         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 621         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 622         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .type = NLA_MIN_LEN, .len = 1 },
 623         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 624                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 625         },
 626         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 627                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 628         },
 629         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 630         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .type = NLA_MIN_LEN, .len = 1 },
 631         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .type = NLA_MIN_LEN, .len = 1 },
 632 };
 633 #endif /* CONFIG_PM */
 634
 635 /* policy for coalesce rule attributes */
 636 static const struct nla_policy
 637 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 638         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 639         [NL80211_ATTR_COALESCE_RULE_CONDITION] =
 640                 NLA_POLICY_RANGE(NLA_U32,
 641                                  NL80211_COALESCE_CONDITION_MATCH,
 642                                  NL80211_COALESCE_CONDITION_NO_MATCH),
 643         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 644 };
 645
 646 /* policy for GTK rekey offload attributes */
 647 static const struct nla_policy
 648 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 649         [NL80211_REKEY_DATA_KEK] = {
 650                 .type = NLA_EXACT_LEN_WARN,
 651                 .len = NL80211_KEK_LEN,
 652         },
 653         [NL80211_REKEY_DATA_KCK] = {
 654                 .type = NLA_EXACT_LEN_WARN,
 655                 .len = NL80211_KCK_LEN,
 656         },
 657         [NL80211_REKEY_DATA_REPLAY_CTR] = {
 658                 .type = NLA_EXACT_LEN_WARN,
 659                 .len = NL80211_REPLAY_CTR_LEN
 660         },
 661 };
 662
 663 static const struct nla_policy
 664 nl80211_match_band_rssi_policy[NUM_NL80211_BANDS] = {
 665         [NL80211_BAND_2GHZ] = { .type = NLA_S32 },
 666         [NL80211_BAND_5GHZ] = { .type = NLA_S32 },
 667         [NL80211_BAND_60GHZ] = { .type = NLA_S32 },
 668 };
 669
 670 static const struct nla_policy
 671 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 672         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 673                                                  .len = IEEE80211_MAX_SSID_LEN },
 674         [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = {
 675                 .type = NLA_EXACT_LEN_WARN,
 676                 .len = ETH_ALEN
 677         },
 678         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 679         [NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI] =
 680                 NLA_POLICY_NESTED(nl80211_match_band_rssi_policy),
 681 };
 682
 683 static const struct nla_policy
 684 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 685         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 686         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 687 };
 688
 689 static const struct nla_policy
 690 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 691         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 692         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 693         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 694                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 695         },
 696 };
 697
 698 /* policy for NAN function attributes */
 699 static const struct nla_policy
 700 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 701         [NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 },
 702         [NL80211_NAN_FUNC_SERVICE_ID] = {
 703                                     .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 704         [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 705         [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 706         [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 707         [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 708         [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 709         [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = {
 710                 .type = NLA_EXACT_LEN_WARN,
 711                 .len = ETH_ALEN
 712         },
 713         [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 714         [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 715         [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 716                         .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 717         [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 718         [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 719         [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 720         [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 721         [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 722 };
 723
 724 /* policy for Service Response Filter attributes */
 725 static const struct nla_policy
 726 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 727         [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 728         [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 729                                  .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 730         [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 731         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 732 };
 733
 734 /* policy for packet pattern attributes */
 735 static const struct nla_policy
 736 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
 737         [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
 738         [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
 739         [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
 740 };
 741
 742 int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
 743                               struct cfg80211_registered_device **rdev,
 744                               struct wireless_dev **wdev)
 745 {
 746         int err;
 747
 748         if (!cb->args[0]) {
 749                 err = nlmsg_parse_deprecated(cb->nlh,
 750                                              GENL_HDRLEN + nl80211_fam.hdrsize,
 751                                              genl_family_attrbuf(&nl80211_fam),
 752                                              nl80211_fam.maxattr,
 753                                              nl80211_policy, NULL);
 754                 if (err)
 755                         return err;
 756
 757                 *wdev = __cfg80211_wdev_from_attrs(
 758                                         sock_net(cb->skb->sk),
 759                                         genl_family_attrbuf(&nl80211_fam));
 760                 if (IS_ERR(*wdev))
 761                         return PTR_ERR(*wdev);
 762                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 763                 /* 0 is the first index - add 1 to parse only once */
 764                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 765                 cb->args[1] = (*wdev)->identifier;
 766         } else {
 767                 /* subtract the 1 again here */
 768                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 769                 struct wireless_dev *tmp;
 770
 771                 if (!wiphy)
 772                         return -ENODEV;
 773                 *rdev = wiphy_to_rdev(wiphy);
 774                 *wdev = NULL;
 775
 776                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
 777                         if (tmp->identifier == cb->args[1]) {
 778                                 *wdev = tmp;
 779                                 break;
 780                         }
 781                 }
 782
 783                 if (!*wdev)
 784                         return -ENODEV;
 785         }
 786
 787         return 0;
 788 }
 789
 790 /* message building helper */
 791 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 792                      int flags, u8 cmd)
 793 {
 794         /* since there is no private header just add the generic one */
 795         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 796 }
 797
 798 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
 799                                      const struct ieee80211_reg_rule *rule)
 800 {
 801         int j;
 802         struct nlattr *nl_wmm_rules =
 803                 nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM);
 804
 805         if (!nl_wmm_rules)
 806                 goto nla_put_failure;
 807
 808         for (j = 0; j < IEEE80211_NUM_ACS; j++) {
 809                 struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j);
 810
 811                 if (!nl_wmm_rule)
 812                         goto nla_put_failure;
 813
 814                 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
 815                                 rule->wmm_rule.client[j].cw_min) ||
 816                     nla_put_u16(msg, NL80211_WMMR_CW_MAX,
 817                                 rule->wmm_rule.client[j].cw_max) ||
 818                     nla_put_u8(msg, NL80211_WMMR_AIFSN,
 819                                rule->wmm_rule.client[j].aifsn) ||
 820                     nla_put_u16(msg, NL80211_WMMR_TXOP,
 821                                 rule->wmm_rule.client[j].cot))
 822                         goto nla_put_failure;
 823
 824                 nla_nest_end(msg, nl_wmm_rule);
 825         }
 826         nla_nest_end(msg, nl_wmm_rules);
 827
 828         return 0;
 829
 830 nla_put_failure:
 831         return -ENOBUFS;
 832 }
 833
 834 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
 835                                    struct ieee80211_channel *chan,
 836                                    bool large)
 837 {
 838         /* Some channels must be completely excluded from the
 839          * list to protect old user-space tools from breaking
 840          */
 841         if (!large && chan->flags &
 842             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 843                 return 0;
 844
 845         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 846                         chan->center_freq))
 847                 goto nla_put_failure;
 848
 849         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 850             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 851                 goto nla_put_failure;
 852         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 853                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 854                         goto nla_put_failure;
 855                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 856                         goto nla_put_failure;
 857         }
 858         if (chan->flags & IEEE80211_CHAN_RADAR) {
 859                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 860                         goto nla_put_failure;
 861                 if (large) {
 862                         u32 time;
 863
 864                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 865
 866                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 867                                         chan->dfs_state))
 868                                 goto nla_put_failure;
 869                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 870                                         time))
 871                                 goto nla_put_failure;
 872                         if (nla_put_u32(msg,
 873                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 874                                         chan->dfs_cac_ms))
 875                                 goto nla_put_failure;
 876                 }
 877         }
 878
 879         if (large) {
 880                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 881                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 882                         goto nla_put_failure;
 883                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 884                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 885                         goto nla_put_failure;
 886                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 887                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 888                         goto nla_put_failure;
 889                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 890                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 891                         goto nla_put_failure;
 892                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 893                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 894                         goto nla_put_failure;
 895                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
 896                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
 897                         goto nla_put_failure;
 898                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 899                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 900                         goto nla_put_failure;
 901                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 902                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 903                         goto nla_put_failure;
 904         }
 905
 906         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 907                         DBM_TO_MBM(chan->max_power)))
 908                 goto nla_put_failure;
 909
 910         if (large) {
 911                 const struct ieee80211_reg_rule *rule =
 912                         freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
 913
 914                 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
 915                         if (nl80211_msg_put_wmm_rules(msg, rule))
 916                                 goto nla_put_failure;
 917                 }
 918         }
 919
 920         return 0;
 921
 922  nla_put_failure:
 923         return -ENOBUFS;
 924 }
 925
 926 static bool nl80211_put_txq_stats(struct sk_buff *msg,
 927                                   struct cfg80211_txq_stats *txqstats,
 928                                   int attrtype)
 929 {
 930         struct nlattr *txqattr;
 931
 932 #define PUT_TXQVAL_U32(attr, memb) do {                                   \
 933         if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) &&         \
 934             nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
 935                 return false;                                             \
 936         } while (0)
 937
 938         txqattr = nla_nest_start_noflag(msg, attrtype);
 939         if (!txqattr)
 940                 return false;
 941
 942         PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
 943         PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
 944         PUT_TXQVAL_U32(FLOWS, flows);
 945         PUT_TXQVAL_U32(DROPS, drops);
 946         PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
 947         PUT_TXQVAL_U32(OVERLIMIT, overlimit);
 948         PUT_TXQVAL_U32(OVERMEMORY, overmemory);
 949         PUT_TXQVAL_U32(COLLISIONS, collisions);
 950         PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
 951         PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
 952         PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
 953         nla_nest_end(msg, txqattr);
 954
 955 #undef PUT_TXQVAL_U32
 956         return true;
 957 }
 958
 959 /* netlink command implementations */
 960
 961 struct key_parse {
 962         struct key_params p;
 963         int idx;
 964         int type;
 965         bool def, defmgmt;
 966         bool def_uni, def_multi;
 967 };
 968
 969 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
 970                                  struct key_parse *k)
 971 {
 972         struct nlattr *tb[NL80211_KEY_MAX + 1];
 973         int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key,
 974                                               nl80211_key_policy,
 975                                               info->extack);
 976         if (err)
 977                 return err;
 978
 979         k->def = !!tb[NL80211_KEY_DEFAULT];
 980         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 981
 982         if (k->def) {
 983                 k->def_uni = true;
 984                 k->def_multi = true;
 985         }
 986         if (k->defmgmt)
 987                 k->def_multi = true;
 988
 989         if (tb[NL80211_KEY_IDX])
 990                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 991
 992         if (tb[NL80211_KEY_DATA]) {
 993                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 994                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 995         }
 996
 997         if (tb[NL80211_KEY_SEQ]) {
 998                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 999                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
1000         }
1001
1002         if (tb[NL80211_KEY_CIPHER])
1003                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
1004
1005         if (tb[NL80211_KEY_TYPE])
1006                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
1007
1008         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
1009                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1010
1011                 err = nla_parse_nested_deprecated(kdt,
1012                                                   NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1013                                                   tb[NL80211_KEY_DEFAULT_TYPES],
1014                                                   nl80211_key_default_policy,
1015                                                   info->extack);
1016                 if (err)
1017                         return err;
1018
1019                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1020                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1021         }
1022
1023         if (tb[NL80211_KEY_MODE])
1024                 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
1025
1026         return 0;
1027 }
1028
1029 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
1030 {
1031         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1032                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1033                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1034         }
1035
1036         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1037                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1038                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1039         }
1040
1041         if (info->attrs[NL80211_ATTR_KEY_IDX])
1042                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1043
1044         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
1045                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1046
1047         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
1048         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
1049
1050         if (k->def) {
1051                 k->def_uni = true;
1052                 k->def_multi = true;
1053         }
1054         if (k->defmgmt)
1055                 k->def_multi = true;
1056
1057         if (info->attrs[NL80211_ATTR_KEY_TYPE])
1058                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1059
1060         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
1061                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1062                 int err = nla_parse_nested_deprecated(kdt,
1063                                                       NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1064                                                       info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
1065                                                       nl80211_key_default_policy,
1066                                                       info->extack);
1067                 if (err)
1068                         return err;
1069
1070                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1071                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1072         }
1073
1074         return 0;
1075 }
1076
1077 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
1078 {
1079         int err;
1080
1081         memset(k, 0, sizeof(*k));
1082         k->idx = -1;
1083         k->type = -1;
1084
1085         if (info->attrs[NL80211_ATTR_KEY])
1086                 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
1087         else
1088                 err = nl80211_parse_key_old(info, k);
1089
1090         if (err)
1091                 return err;
1092
1093         if (k->def && k->defmgmt) {
1094                 GENL_SET_ERR_MSG(info, "key with def && defmgmt is invalid");
1095                 return -EINVAL;
1096         }
1097
1098         if (k->defmgmt) {
1099                 if (k->def_uni || !k->def_multi) {
1100                         GENL_SET_ERR_MSG(info, "defmgmt key must be mcast");
1101                         return -EINVAL;
1102                 }
1103         }
1104
1105         if (k->idx != -1) {
1106                 if (k->defmgmt) {
1107                         if (k->idx < 4 || k->idx > 5) {
1108                                 GENL_SET_ERR_MSG(info,
1109                                                  "defmgmt key idx not 4 or 5");
1110                                 return -EINVAL;
1111                         }
1112                 } else if (k->def) {
1113                         if (k->idx < 0 || k->idx > 3) {
1114                                 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1115                                 return -EINVAL;
1116                         }
1117                 } else {
1118                         if (k->idx < 0 || k->idx > 5) {
1119                                 GENL_SET_ERR_MSG(info, "key idx not 0-5");
1120                                 return -EINVAL;
1121                         }
1122                 }
1123         }
1124
1125         return 0;
1126 }
1127
1128 static struct cfg80211_cached_keys *
1129 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1130                        struct genl_info *info, bool *no_ht)
1131 {
1132         struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1133         struct key_parse parse;
1134         struct nlattr *key;
1135         struct cfg80211_cached_keys *result;
1136         int rem, err, def = 0;
1137         bool have_key = false;
1138
1139         nla_for_each_nested(key, keys, rem) {
1140                 have_key = true;
1141                 break;
1142         }
1143
1144         if (!have_key)
1145                 return NULL;
1146
1147         result = kzalloc(sizeof(*result), GFP_KERNEL);
1148         if (!result)
1149                 return ERR_PTR(-ENOMEM);
1150
1151         result->def = -1;
1152
1153         nla_for_each_nested(key, keys, rem) {
1154                 memset(&parse, 0, sizeof(parse));
1155                 parse.idx = -1;
1156
1157                 err = nl80211_parse_key_new(info, key, &parse);
1158                 if (err)
1159                         goto error;
1160                 err = -EINVAL;
1161                 if (!parse.p.key)
1162                         goto error;
1163                 if (parse.idx < 0 || parse.idx > 3) {
1164                         GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1165                         goto error;
1166                 }
1167                 if (parse.def) {
1168                         if (def) {
1169                                 GENL_SET_ERR_MSG(info,
1170                                                  "only one key can be default");
1171                                 goto error;
1172                         }
1173                         def = 1;
1174                         result->def = parse.idx;
1175                         if (!parse.def_uni || !parse.def_multi)
1176                                 goto error;
1177                 } else if (parse.defmgmt)
1178                         goto error;
1179                 err = cfg80211_validate_key_settings(rdev, &parse.p,
1180                                                      parse.idx, false, NULL);
1181                 if (err)
1182                         goto error;
1183                 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1184                     parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1185                         GENL_SET_ERR_MSG(info, "connect key must be WEP");
1186                         err = -EINVAL;
1187                         goto error;
1188                 }
1189                 result->params[parse.idx].cipher = parse.p.cipher;
1190                 result->params[parse.idx].key_len = parse.p.key_len;
1191                 result->params[parse.idx].key = result->data[parse.idx];
1192                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1193
1194                 /* must be WEP key if we got here */
1195                 if (no_ht)
1196                         *no_ht = true;
1197         }
1198
1199         if (result->def < 0) {
1200                 err = -EINVAL;
1201                 GENL_SET_ERR_MSG(info, "need a default/TX key");
1202                 goto error;
1203         }
1204
1205         return result;
1206  error:
1207         kfree(result);
1208         return ERR_PTR(err);
1209 }
1210
1211 static int nl80211_key_allowed(struct wireless_dev *wdev)
1212 {
1213         ASSERT_WDEV_LOCK(wdev);
1214
1215         switch (wdev->iftype) {
1216         case NL80211_IFTYPE_AP:
1217         case NL80211_IFTYPE_AP_VLAN:
1218         case NL80211_IFTYPE_P2P_GO:
1219         case NL80211_IFTYPE_MESH_POINT:
1220                 break;
1221         case NL80211_IFTYPE_ADHOC:
1222         case NL80211_IFTYPE_STATION:
1223         case NL80211_IFTYPE_P2P_CLIENT:
1224                 if (!wdev->current_bss)
1225                         return -ENOLINK;
1226                 break;
1227         case NL80211_IFTYPE_UNSPECIFIED:
1228         case NL80211_IFTYPE_OCB:
1229         case NL80211_IFTYPE_MONITOR:
1230         case NL80211_IFTYPE_NAN:
1231         case NL80211_IFTYPE_P2P_DEVICE:
1232         case NL80211_IFTYPE_WDS:
1233         case NUM_NL80211_IFTYPES:
1234                 return -EINVAL;
1235         }
1236
1237         return 0;
1238 }
1239
1240 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1241                                                         struct nlattr *tb)
1242 {
1243         struct ieee80211_channel *chan;
1244
1245         if (tb == NULL)
1246                 return NULL;
1247         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
1248         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1249                 return NULL;
1250         return chan;
1251 }
1252
1253 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1254 {
1255         struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr);
1256         int i;
1257
1258         if (!nl_modes)
1259                 goto nla_put_failure;
1260
1261         i = 0;
1262         while (ifmodes) {
1263                 if ((ifmodes & 1) && nla_put_flag(msg, i))
1264                         goto nla_put_failure;
1265                 ifmodes >>= 1;
1266                 i++;
1267         }
1268
1269         nla_nest_end(msg, nl_modes);
1270         return 0;
1271
1272 nla_put_failure:
1273         return -ENOBUFS;
1274 }
1275
1276 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1277                                           struct sk_buff *msg,
1278                                           bool large)
1279 {
1280         struct nlattr *nl_combis;
1281         int i, j;
1282
1283         nl_combis = nla_nest_start_noflag(msg,
1284                                           NL80211_ATTR_INTERFACE_COMBINATIONS);
1285         if (!nl_combis)
1286                 goto nla_put_failure;
1287
1288         for (i = 0; i < wiphy->n_iface_combinations; i++) {
1289                 const struct ieee80211_iface_combination *c;
1290                 struct nlattr *nl_combi, *nl_limits;
1291
1292                 c = &wiphy->iface_combinations[i];
1293
1294                 nl_combi = nla_nest_start_noflag(msg, i + 1);
1295                 if (!nl_combi)
1296                         goto nla_put_failure;
1297
1298                 nl_limits = nla_nest_start_noflag(msg,
1299                                                   NL80211_IFACE_COMB_LIMITS);
1300                 if (!nl_limits)
1301                         goto nla_put_failure;
1302
1303                 for (j = 0; j < c->n_limits; j++) {
1304                         struct nlattr *nl_limit;
1305
1306                         nl_limit = nla_nest_start_noflag(msg, j + 1);
1307                         if (!nl_limit)
1308                                 goto nla_put_failure;
1309                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1310                                         c->limits[j].max))
1311                                 goto nla_put_failure;
1312                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1313                                                 c->limits[j].types))
1314                                 goto nla_put_failure;
1315                         nla_nest_end(msg, nl_limit);
1316                 }
1317
1318                 nla_nest_end(msg, nl_limits);
1319
1320                 if (c->beacon_int_infra_match &&
1321                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1322                         goto nla_put_failure;
1323                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1324                                 c->num_different_channels) ||
1325                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1326                                 c->max_interfaces))
1327                         goto nla_put_failure;
1328                 if (large &&
1329                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1330                                 c->radar_detect_widths) ||
1331                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1332                                 c->radar_detect_regions)))
1333                         goto nla_put_failure;
1334                 if (c->beacon_int_min_gcd &&
1335                     nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1336                                 c->beacon_int_min_gcd))
1337                         goto nla_put_failure;
1338
1339                 nla_nest_end(msg, nl_combi);
1340         }
1341
1342         nla_nest_end(msg, nl_combis);
1343
1344         return 0;
1345 nla_put_failure:
1346         return -ENOBUFS;
1347 }
1348
1349 #ifdef CONFIG_PM
1350 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1351                                         struct sk_buff *msg)
1352 {
1353         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1354         struct nlattr *nl_tcp;
1355
1356         if (!tcp)
1357                 return 0;
1358
1359         nl_tcp = nla_nest_start_noflag(msg,
1360                                        NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1361         if (!nl_tcp)
1362                 return -ENOBUFS;
1363
1364         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1365                         tcp->data_payload_max))
1366                 return -ENOBUFS;
1367
1368         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1369                         tcp->data_payload_max))
1370                 return -ENOBUFS;
1371
1372         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1373                 return -ENOBUFS;
1374
1375         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1376                                 sizeof(*tcp->tok), tcp->tok))
1377                 return -ENOBUFS;
1378
1379         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1380                         tcp->data_interval_max))
1381                 return -ENOBUFS;
1382
1383         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1384                         tcp->wake_payload_max))
1385                 return -ENOBUFS;
1386
1387         nla_nest_end(msg, nl_tcp);
1388         return 0;
1389 }
1390
1391 static int nl80211_send_wowlan(struct sk_buff *msg,
1392                                struct cfg80211_registered_device *rdev,
1393                                bool large)
1394 {
1395         struct nlattr *nl_wowlan;
1396
1397         if (!rdev->wiphy.wowlan)
1398                 return 0;
1399
1400         nl_wowlan = nla_nest_start_noflag(msg,
1401                                           NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1402         if (!nl_wowlan)
1403                 return -ENOBUFS;
1404
1405         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1406              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1407             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1408              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1409             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1410              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1411             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1412              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1413             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1414              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1415             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1416              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1417             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1418              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1419             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1420              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1421                 return -ENOBUFS;
1422
1423         if (rdev->wiphy.wowlan->n_patterns) {
1424                 struct nl80211_pattern_support pat = {
1425                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1426                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1427                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1428                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1429                 };
1430
1431                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1432                             sizeof(pat), &pat))
1433                         return -ENOBUFS;
1434         }
1435
1436         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1437             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1438                         rdev->wiphy.wowlan->max_nd_match_sets))
1439                 return -ENOBUFS;
1440
1441         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1442                 return -ENOBUFS;
1443
1444         nla_nest_end(msg, nl_wowlan);
1445
1446         return 0;
1447 }
1448 #endif
1449
1450 static int nl80211_send_coalesce(struct sk_buff *msg,
1451                                  struct cfg80211_registered_device *rdev)
1452 {
1453         struct nl80211_coalesce_rule_support rule;
1454
1455         if (!rdev->wiphy.coalesce)
1456                 return 0;
1457
1458         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1459         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1460         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1461         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1462         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1463         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1464
1465         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1466                 return -ENOBUFS;
1467
1468         return 0;
1469 }
1470
1471 static int
1472 nl80211_send_iftype_data(struct sk_buff *msg,
1473                          const struct ieee80211_sband_iftype_data *iftdata)
1474 {
1475         const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1476
1477         if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1478                                 iftdata->types_mask))
1479                 return -ENOBUFS;
1480
1481         if (he_cap->has_he) {
1482                 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1483                             sizeof(he_cap->he_cap_elem.mac_cap_info),
1484                             he_cap->he_cap_elem.mac_cap_info) ||
1485                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1486                             sizeof(he_cap->he_cap_elem.phy_cap_info),
1487                             he_cap->he_cap_elem.phy_cap_info) ||
1488                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1489                             sizeof(he_cap->he_mcs_nss_supp),
1490                             &he_cap->he_mcs_nss_supp) ||
1491                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1492                             sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1493                         return -ENOBUFS;
1494         }
1495
1496         return 0;
1497 }
1498
1499 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1500                                       struct ieee80211_supported_band *sband)
1501 {
1502         struct nlattr *nl_rates, *nl_rate;
1503         struct ieee80211_rate *rate;
1504         int i;
1505
1506         /* add HT info */
1507         if (sband->ht_cap.ht_supported &&
1508             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1509                      sizeof(sband->ht_cap.mcs),
1510                      &sband->ht_cap.mcs) ||
1511              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1512                          sband->ht_cap.cap) ||
1513              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1514                         sband->ht_cap.ampdu_factor) ||
1515              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1516                         sband->ht_cap.ampdu_density)))
1517                 return -ENOBUFS;
1518
1519         /* add VHT info */
1520         if (sband->vht_cap.vht_supported &&
1521             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1522                      sizeof(sband->vht_cap.vht_mcs),
1523                      &sband->vht_cap.vht_mcs) ||
1524              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1525                          sband->vht_cap.cap)))
1526                 return -ENOBUFS;
1527
1528         if (sband->n_iftype_data) {
1529                 struct nlattr *nl_iftype_data =
1530                         nla_nest_start_noflag(msg,
1531                                               NL80211_BAND_ATTR_IFTYPE_DATA);
1532                 int err;
1533
1534                 if (!nl_iftype_data)
1535                         return -ENOBUFS;
1536
1537                 for (i = 0; i < sband->n_iftype_data; i++) {
1538                         struct nlattr *iftdata;
1539
1540                         iftdata = nla_nest_start_noflag(msg, i + 1);
1541                         if (!iftdata)
1542                                 return -ENOBUFS;
1543
1544                         err = nl80211_send_iftype_data(msg,
1545                                                        &sband->iftype_data[i]);
1546                         if (err)
1547                                 return err;
1548
1549                         nla_nest_end(msg, iftdata);
1550                 }
1551
1552                 nla_nest_end(msg, nl_iftype_data);
1553         }
1554
1555         /* add bitrates */
1556         nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES);
1557         if (!nl_rates)
1558                 return -ENOBUFS;
1559
1560         for (i = 0; i < sband->n_bitrates; i++) {
1561                 nl_rate = nla_nest_start_noflag(msg, i);
1562                 if (!nl_rate)
1563                         return -ENOBUFS;
1564
1565                 rate = &sband->bitrates[i];
1566                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1567                                 rate->bitrate))
1568                         return -ENOBUFS;
1569                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1570                     nla_put_flag(msg,
1571                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1572                         return -ENOBUFS;
1573
1574                 nla_nest_end(msg, nl_rate);
1575         }
1576
1577         nla_nest_end(msg, nl_rates);
1578
1579         return 0;
1580 }
1581
1582 static int
1583 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1584                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1585 {
1586         u16 stypes;
1587         struct nlattr *nl_ftypes, *nl_ifs;
1588         enum nl80211_iftype ift;
1589         int i;
1590
1591         if (!mgmt_stypes)
1592                 return 0;
1593
1594         nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES);
1595         if (!nl_ifs)
1596                 return -ENOBUFS;
1597
1598         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1599                 nl_ftypes = nla_nest_start_noflag(msg, ift);
1600                 if (!nl_ftypes)
1601                         return -ENOBUFS;
1602                 i = 0;
1603                 stypes = mgmt_stypes[ift].tx;
1604                 while (stypes) {
1605                         if ((stypes & 1) &&
1606                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1607                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1608                                 return -ENOBUFS;
1609                         stypes >>= 1;
1610                         i++;
1611                 }
1612                 nla_nest_end(msg, nl_ftypes);
1613         }
1614
1615         nla_nest_end(msg, nl_ifs);
1616
1617         nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES);
1618         if (!nl_ifs)
1619                 return -ENOBUFS;
1620
1621         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1622                 nl_ftypes = nla_nest_start_noflag(msg, ift);
1623                 if (!nl_ftypes)
1624                         return -ENOBUFS;
1625                 i = 0;
1626                 stypes = mgmt_stypes[ift].rx;
1627                 while (stypes) {
1628                         if ((stypes & 1) &&
1629                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1630                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1631                                 return -ENOBUFS;
1632                         stypes >>= 1;
1633                         i++;
1634                 }
1635                 nla_nest_end(msg, nl_ftypes);
1636         }
1637         nla_nest_end(msg, nl_ifs);
1638
1639         return 0;
1640 }
1641
1642 #define CMD(op, n)                                                      \
1643          do {                                                           \
1644                 if (rdev->ops->op) {                                    \
1645                         i++;                                            \
1646                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n))     \
1647                                 goto nla_put_failure;                   \
1648                 }                                                       \
1649         } while (0)
1650
1651 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
1652                                         struct sk_buff *msg)
1653 {
1654         int i = 0;
1655
1656         /*
1657          * do *NOT* add anything into this function, new things need to be
1658          * advertised only to new versions of userspace that can deal with
1659          * the split (and they can't possibly care about new features...
1660          */
1661         CMD(add_virtual_intf, NEW_INTERFACE);
1662         CMD(change_virtual_intf, SET_INTERFACE);
1663         CMD(add_key, NEW_KEY);
1664         CMD(start_ap, START_AP);
1665         CMD(add_station, NEW_STATION);
1666         CMD(add_mpath, NEW_MPATH);
1667         CMD(update_mesh_config, SET_MESH_CONFIG);
1668         CMD(change_bss, SET_BSS);
1669         CMD(auth, AUTHENTICATE);
1670         CMD(assoc, ASSOCIATE);
1671         CMD(deauth, DEAUTHENTICATE);
1672         CMD(disassoc, DISASSOCIATE);
1673         CMD(join_ibss, JOIN_IBSS);
1674         CMD(join_mesh, JOIN_MESH);
1675         CMD(set_pmksa, SET_PMKSA);
1676         CMD(del_pmksa, DEL_PMKSA);
1677         CMD(flush_pmksa, FLUSH_PMKSA);
1678         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1679                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1680         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1681         CMD(mgmt_tx, FRAME);
1682         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1683         if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1684                 i++;
1685                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1686                         goto nla_put_failure;
1687         }
1688         if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1689             rdev->ops->join_mesh) {
1690                 i++;
1691                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1692                         goto nla_put_failure;
1693         }
1694         CMD(set_wds_peer, SET_WDS_PEER);
1695         if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1696                 CMD(tdls_mgmt, TDLS_MGMT);
1697                 CMD(tdls_oper, TDLS_OPER);
1698         }
1699         if (rdev->wiphy.max_sched_scan_reqs)
1700                 CMD(sched_scan_start, START_SCHED_SCAN);
1701         CMD(probe_client, PROBE_CLIENT);
1702         CMD(set_noack_map, SET_NOACK_MAP);
1703         if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1704                 i++;
1705                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1706                         goto nla_put_failure;
1707         }
1708         CMD(start_p2p_device, START_P2P_DEVICE);
1709         CMD(set_mcast_rate, SET_MCAST_RATE);
1710 #ifdef CONFIG_NL80211_TESTMODE
1711         CMD(testmode_cmd, TESTMODE);
1712 #endif
1713
1714         if (rdev->ops->connect || rdev->ops->auth) {
1715                 i++;
1716                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1717                         goto nla_put_failure;
1718         }
1719
1720         if (rdev->ops->disconnect || rdev->ops->deauth) {
1721                 i++;
1722                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1723                         goto nla_put_failure;
1724         }
1725
1726         return i;
1727  nla_put_failure:
1728         return -ENOBUFS;
1729 }
1730
1731 static int
1732 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
1733                            struct sk_buff *msg)
1734 {
1735         struct nlattr *ftm;
1736
1737         if (!cap->ftm.supported)
1738                 return 0;
1739
1740         ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM);
1741         if (!ftm)
1742                 return -ENOBUFS;
1743
1744         if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
1745                 return -ENOBUFS;
1746         if (cap->ftm.non_asap &&
1747             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
1748                 return -ENOBUFS;
1749         if (cap->ftm.request_lci &&
1750             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
1751                 return -ENOBUFS;
1752         if (cap->ftm.request_civicloc &&
1753             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
1754                 return -ENOBUFS;
1755         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
1756                         cap->ftm.preambles))
1757                 return -ENOBUFS;
1758         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
1759                         cap->ftm.bandwidths))
1760                 return -ENOBUFS;
1761         if (cap->ftm.max_bursts_exponent >= 0 &&
1762             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
1763                         cap->ftm.max_bursts_exponent))
1764                 return -ENOBUFS;
1765         if (cap->ftm.max_ftms_per_burst &&
1766             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
1767                         cap->ftm.max_ftms_per_burst))
1768                 return -ENOBUFS;
1769
1770         nla_nest_end(msg, ftm);
1771         return 0;
1772 }
1773
1774 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
1775                                   struct sk_buff *msg)
1776 {
1777         const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
1778         struct nlattr *pmsr, *caps;
1779
1780         if (!cap)
1781                 return 0;
1782
1783         /*
1784          * we don't need to clean up anything here since the caller
1785          * will genlmsg_cancel() if we fail
1786          */
1787
1788         pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS);
1789         if (!pmsr)
1790                 return -ENOBUFS;
1791
1792         if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
1793                 return -ENOBUFS;
1794
1795         if (cap->report_ap_tsf &&
1796             nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
1797                 return -ENOBUFS;
1798
1799         if (cap->randomize_mac_addr &&
1800             nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
1801                 return -ENOBUFS;
1802
1803         caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
1804         if (!caps)
1805                 return -ENOBUFS;
1806
1807         if (nl80211_send_pmsr_ftm_capa(cap, msg))
1808                 return -ENOBUFS;
1809
1810         nla_nest_end(msg, caps);
1811         nla_nest_end(msg, pmsr);
1812
1813         return 0;
1814 }
1815
1816 struct nl80211_dump_wiphy_state {
1817         s64 filter_wiphy;
1818         long start;
1819         long split_start, band_start, chan_start, capa_start;
1820         bool split;
1821 };
1822
1823 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1824                               enum nl80211_commands cmd,
1825                               struct sk_buff *msg, u32 portid, u32 seq,
1826                               int flags, struct nl80211_dump_wiphy_state *state)
1827 {
1828         void *hdr;
1829         struct nlattr *nl_bands, *nl_band;
1830         struct nlattr *nl_freqs, *nl_freq;
1831         struct nlattr *nl_cmds;
1832         enum nl80211_band band;
1833         struct ieee80211_channel *chan;
1834         int i;
1835         const struct ieee80211_txrx_stypes *mgmt_stypes =
1836                                 rdev->wiphy.mgmt_stypes;
1837         u32 features;
1838
1839         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1840         if (!hdr)
1841                 return -ENOBUFS;
1842
1843         if (WARN_ON(!state))
1844                 return -EINVAL;
1845
1846         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1847             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1848                            wiphy_name(&rdev->wiphy)) ||
1849             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1850                         cfg80211_rdev_list_generation))
1851                 goto nla_put_failure;
1852
1853         if (cmd != NL80211_CMD_NEW_WIPHY)
1854                 goto finish;
1855
1856         switch (state->split_start) {
1857         case 0:
1858                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1859                                rdev->wiphy.retry_short) ||
1860                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1861                                rdev->wiphy.retry_long) ||
1862                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1863                                 rdev->wiphy.frag_threshold) ||
1864                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1865                                 rdev->wiphy.rts_threshold) ||
1866                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1867                                rdev->wiphy.coverage_class) ||
1868                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1869                                rdev->wiphy.max_scan_ssids) ||
1870                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1871                                rdev->wiphy.max_sched_scan_ssids) ||
1872                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1873                                 rdev->wiphy.max_scan_ie_len) ||
1874                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1875                                 rdev->wiphy.max_sched_scan_ie_len) ||
1876                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1877                                rdev->wiphy.max_match_sets) ||
1878                     nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1879                                 rdev->wiphy.max_sched_scan_plans) ||
1880                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1881                                 rdev->wiphy.max_sched_scan_plan_interval) ||
1882                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1883                                 rdev->wiphy.max_sched_scan_plan_iterations))
1884                         goto nla_put_failure;
1885
1886                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1887                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1888                         goto nla_put_failure;
1889                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1890                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1891                         goto nla_put_failure;
1892                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1893                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1894                         goto nla_put_failure;
1895                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1896                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1897                         goto nla_put_failure;
1898                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1899                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1900                         goto nla_put_failure;
1901                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1902                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1903                         goto nla_put_failure;
1904                 state->split_start++;
1905                 if (state->split)
1906                         break;
1907                 /* fall through */
1908         case 1:
1909                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1910                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1911                             rdev->wiphy.cipher_suites))
1912                         goto nla_put_failure;
1913
1914                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1915                                rdev->wiphy.max_num_pmkids))
1916                         goto nla_put_failure;
1917
1918                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1919                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1920                         goto nla_put_failure;
1921
1922                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1923                                 rdev->wiphy.available_antennas_tx) ||
1924                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1925                                 rdev->wiphy.available_antennas_rx))
1926                         goto nla_put_failure;
1927
1928                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1929                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1930                                 rdev->wiphy.probe_resp_offload))
1931                         goto nla_put_failure;
1932
1933                 if ((rdev->wiphy.available_antennas_tx ||
1934                      rdev->wiphy.available_antennas_rx) &&
1935                     rdev->ops->get_antenna) {
1936                         u32 tx_ant = 0, rx_ant = 0;
1937                         int res;
1938
1939                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1940                         if (!res) {
1941                                 if (nla_put_u32(msg,
1942                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1943                                                 tx_ant) ||
1944                                     nla_put_u32(msg,
1945                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1946                                                 rx_ant))
1947                                         goto nla_put_failure;
1948                         }
1949                 }
1950
1951                 state->split_start++;
1952                 if (state->split)
1953                         break;
1954                 /* fall through */
1955         case 2:
1956                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1957                                         rdev->wiphy.interface_modes))
1958                                 goto nla_put_failure;
1959                 state->split_start++;
1960                 if (state->split)
1961                         break;
1962                 /* fall through */
1963         case 3:
1964                 nl_bands = nla_nest_start_noflag(msg,
1965                                                  NL80211_ATTR_WIPHY_BANDS);
1966                 if (!nl_bands)
1967                         goto nla_put_failure;
1968
1969                 for (band = state->band_start;
1970                      band < NUM_NL80211_BANDS; band++) {
1971                         struct ieee80211_supported_band *sband;
1972
1973                         sband = rdev->wiphy.bands[band];
1974
1975                         if (!sband)
1976                                 continue;
1977
1978                         nl_band = nla_nest_start_noflag(msg, band);
1979                         if (!nl_band)
1980                                 goto nla_put_failure;
1981
1982                         switch (state->chan_start) {
1983                         case 0:
1984                                 if (nl80211_send_band_rateinfo(msg, sband))
1985                                         goto nla_put_failure;
1986                                 state->chan_start++;
1987                                 if (state->split)
1988                                         break;
1989                                 /* fall through */
1990                         default:
1991                                 /* add frequencies */
1992                                 nl_freqs = nla_nest_start_noflag(msg,
1993                                                                  NL80211_BAND_ATTR_FREQS);
1994                                 if (!nl_freqs)
1995                                         goto nla_put_failure;
1996
1997                                 for (i = state->chan_start - 1;
1998                                      i < sband->n_channels;
1999                                      i++) {
2000                                         nl_freq = nla_nest_start_noflag(msg,
2001                                                                         i);
2002                                         if (!nl_freq)
2003                                                 goto nla_put_failure;
2004
2005                                         chan = &sband->channels[i];
2006
2007                                         if (nl80211_msg_put_channel(
2008                                                         msg, &rdev->wiphy, chan,
2009                                                         state->split))
2010                                                 goto nla_put_failure;
2011
2012                                         nla_nest_end(msg, nl_freq);
2013                                         if (state->split)
2014                                                 break;
2015                                 }
2016                                 if (i < sband->n_channels)
2017                                         state->chan_start = i + 2;
2018                                 else
2019                                         state->chan_start = 0;
2020                                 nla_nest_end(msg, nl_freqs);
2021                         }
2022
2023                         nla_nest_end(msg, nl_band);
2024
2025                         if (state->split) {
2026                                 /* start again here */
2027                                 if (state->chan_start)
2028                                         band--;
2029                                 break;
2030                         }
2031                 }
2032                 nla_nest_end(msg, nl_bands);
2033
2034                 if (band < NUM_NL80211_BANDS)
2035                         state->band_start = band + 1;
2036                 else
2037                         state->band_start = 0;
2038
2039                 /* if bands & channels are done, continue outside */
2040                 if (state->band_start == 0 && state->chan_start == 0)
2041                         state->split_start++;
2042                 if (state->split)
2043                         break;
2044                 /* fall through */
2045         case 4:
2046                 nl_cmds = nla_nest_start_noflag(msg,
2047                                                 NL80211_ATTR_SUPPORTED_COMMANDS);
2048                 if (!nl_cmds)
2049                         goto nla_put_failure;
2050
2051                 i = nl80211_add_commands_unsplit(rdev, msg);
2052                 if (i < 0)
2053                         goto nla_put_failure;
2054                 if (state->split) {
2055                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
2056                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
2057                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
2058                                 CMD(channel_switch, CHANNEL_SWITCH);
2059                         CMD(set_qos_map, SET_QOS_MAP);
2060                         if (rdev->wiphy.features &
2061                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
2062                                 CMD(add_tx_ts, ADD_TX_TS);
2063                         CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
2064                         CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
2065                 }
2066 #undef CMD
2067
2068                 nla_nest_end(msg, nl_cmds);
2069                 state->split_start++;
2070                 if (state->split)
2071                         break;
2072                 /* fall through */
2073         case 5:
2074                 if (rdev->ops->remain_on_channel &&
2075                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
2076                     nla_put_u32(msg,
2077                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
2078                                 rdev->wiphy.max_remain_on_channel_duration))
2079                         goto nla_put_failure;
2080
2081                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
2082                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
2083                         goto nla_put_failure;
2084
2085                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
2086                         goto nla_put_failure;
2087                 state->split_start++;
2088                 if (state->split)
2089                         break;
2090                 /* fall through */
2091         case 6:
2092 #ifdef CONFIG_PM
2093                 if (nl80211_send_wowlan(msg, rdev, state->split))
2094                         goto nla_put_failure;
2095                 state->split_start++;
2096                 if (state->split)
2097                         break;
2098 #else
2099                 state->split_start++;
2100 #endif
2101                 /* fall through */
2102         case 7:
2103                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
2104                                         rdev->wiphy.software_iftypes))
2105                         goto nla_put_failure;
2106
2107                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
2108                                                    state->split))
2109                         goto nla_put_failure;
2110
2111                 state->split_start++;
2112                 if (state->split)
2113                         break;
2114                 /* fall through */
2115         case 8:
2116                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
2117                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
2118                                 rdev->wiphy.ap_sme_capa))
2119                         goto nla_put_failure;
2120
2121                 features = rdev->wiphy.features;
2122                 /*
2123                  * We can only add the per-channel limit information if the
2124                  * dump is split, otherwise it makes it too big. Therefore
2125                  * only advertise it in that case.
2126                  */
2127                 if (state->split)
2128                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
2129                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
2130                         goto nla_put_failure;
2131
2132                 if (rdev->wiphy.ht_capa_mod_mask &&
2133                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
2134                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
2135                             rdev->wiphy.ht_capa_mod_mask))
2136                         goto nla_put_failure;
2137
2138                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
2139                     rdev->wiphy.max_acl_mac_addrs &&
2140                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
2141                                 rdev->wiphy.max_acl_mac_addrs))
2142                         goto nla_put_failure;
2143
2144                 /*
2145                  * Any information below this point is only available to
2146                  * applications that can deal with it being split. This
2147                  * helps ensure that newly added capabilities don't break
2148                  * older tools by overrunning their buffers.
2149                  *
2150                  * We still increment split_start so that in the split
2151                  * case we'll continue with more data in the next round,
2152                  * but break unconditionally so unsplit data stops here.
2153                  */
2154                 state->split_start++;
2155                 break;
2156         case 9:
2157                 if (rdev->wiphy.extended_capabilities &&
2158                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
2159                              rdev->wiphy.extended_capabilities_len,
2160                              rdev->wiphy.extended_capabilities) ||
2161                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2162                              rdev->wiphy.extended_capabilities_len,
2163                              rdev->wiphy.extended_capabilities_mask)))
2164                         goto nla_put_failure;
2165
2166                 if (rdev->wiphy.vht_capa_mod_mask &&
2167                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
2168                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
2169                             rdev->wiphy.vht_capa_mod_mask))
2170                         goto nla_put_failure;
2171
2172                 state->split_start++;
2173                 break;
2174         case 10:
2175                 if (nl80211_send_coalesce(msg, rdev))
2176                         goto nla_put_failure;
2177
2178                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
2179                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
2180                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
2181                         goto nla_put_failure;
2182
2183                 if (rdev->wiphy.max_ap_assoc_sta &&
2184                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
2185                                 rdev->wiphy.max_ap_assoc_sta))
2186                         goto nla_put_failure;
2187
2188                 state->split_start++;
2189                 break;
2190         case 11:
2191                 if (rdev->wiphy.n_vendor_commands) {
2192                         const struct nl80211_vendor_cmd_info *info;
2193                         struct nlattr *nested;
2194
2195                         nested = nla_nest_start_noflag(msg,
2196                                                        NL80211_ATTR_VENDOR_DATA);
2197                         if (!nested)
2198                                 goto nla_put_failure;
2199
2200                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
2201                                 info = &rdev->wiphy.vendor_commands[i].info;
2202                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2203                                         goto nla_put_failure;
2204                         }
2205                         nla_nest_end(msg, nested);
2206                 }
2207
2208                 if (rdev->wiphy.n_vendor_events) {
2209                         const struct nl80211_vendor_cmd_info *info;
2210                         struct nlattr *nested;
2211
2212                         nested = nla_nest_start_noflag(msg,
2213                                                        NL80211_ATTR_VENDOR_EVENTS);
2214                         if (!nested)
2215                                 goto nla_put_failure;
2216
2217                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
2218                                 info = &rdev->wiphy.vendor_events[i];
2219                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2220                                         goto nla_put_failure;
2221                         }
2222                         nla_nest_end(msg, nested);
2223                 }
2224                 state->split_start++;
2225                 break;
2226         case 12:
2227                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
2228                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
2229                                rdev->wiphy.max_num_csa_counters))
2230                         goto nla_put_failure;
2231
2232                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2233                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
2234                         goto nla_put_failure;
2235
2236                 if (rdev->wiphy.max_sched_scan_reqs &&
2237                     nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
2238                                 rdev->wiphy.max_sched_scan_reqs))
2239                         goto nla_put_failure;
2240
2241                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2242                             sizeof(rdev->wiphy.ext_features),
2243                             rdev->wiphy.ext_features))
2244                         goto nla_put_failure;
2245
2246                 if (rdev->wiphy.bss_select_support) {
2247                         struct nlattr *nested;
2248                         u32 bss_select_support = rdev->wiphy.bss_select_support;
2249
2250                         nested = nla_nest_start_noflag(msg,
2251                                                        NL80211_ATTR_BSS_SELECT);
2252                         if (!nested)
2253                                 goto nla_put_failure;
2254
2255                         i = 0;
2256                         while (bss_select_support) {
2257                                 if ((bss_select_support & 1) &&
2258                                     nla_put_flag(msg, i))
2259                                         goto nla_put_failure;
2260                                 i++;
2261                                 bss_select_support >>= 1;
2262                         }
2263                         nla_nest_end(msg, nested);
2264                 }
2265
2266                 state->split_start++;
2267                 break;
2268         case 13:
2269                 if (rdev->wiphy.num_iftype_ext_capab &&
2270                     rdev->wiphy.iftype_ext_capab) {
2271                         struct nlattr *nested_ext_capab, *nested;
2272
2273                         nested = nla_nest_start_noflag(msg,
2274                                                        NL80211_ATTR_IFTYPE_EXT_CAPA);
2275                         if (!nested)
2276                                 goto nla_put_failure;
2277
2278                         for (i = state->capa_start;
2279                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
2280                                 const struct wiphy_iftype_ext_capab *capab;
2281
2282                                 capab = &rdev->wiphy.iftype_ext_capab[i];
2283
2284                                 nested_ext_capab = nla_nest_start_noflag(msg,
2285                                                                          i);
2286                                 if (!nested_ext_capab ||
2287                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
2288                                                 capab->iftype) ||
2289                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
2290                                             capab->extended_capabilities_len,
2291                                             capab->extended_capabilities) ||
2292                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2293                                             capab->extended_capabilities_len,
2294                                             capab->extended_capabilities_mask))
2295                                         goto nla_put_failure;
2296
2297                                 nla_nest_end(msg, nested_ext_capab);
2298                                 if (state->split)
2299                                         break;
2300                         }
2301                         nla_nest_end(msg, nested);
2302                         if (i < rdev->wiphy.num_iftype_ext_capab) {
2303                                 state->capa_start = i + 1;
2304                                 break;
2305                         }
2306                 }
2307
2308                 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
2309                                 rdev->wiphy.nan_supported_bands))
2310                         goto nla_put_failure;
2311
2312                 if (wiphy_ext_feature_isset(&rdev->wiphy,
2313                                             NL80211_EXT_FEATURE_TXQS)) {
2314                         struct cfg80211_txq_stats txqstats = {};
2315                         int res;
2316
2317                         res = rdev_get_txq_stats(rdev, NULL, &txqstats);
2318                         if (!res &&
2319                             !nl80211_put_txq_stats(msg, &txqstats,
2320                                                    NL80211_ATTR_TXQ_STATS))
2321                                 goto nla_put_failure;
2322
2323                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
2324                                         rdev->wiphy.txq_limit))
2325                                 goto nla_put_failure;
2326                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
2327                                         rdev->wiphy.txq_memory_limit))
2328                                 goto nla_put_failure;
2329                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
2330                                         rdev->wiphy.txq_quantum))
2331                                 goto nla_put_failure;
2332                 }
2333
2334                 state->split_start++;
2335                 break;
2336         case 14:
2337                 if (nl80211_send_pmsr_capa(rdev, msg))
2338                         goto nla_put_failure;
2339
2340                 state->split_start++;
2341                 break;
2342         case 15:
2343                 if (rdev->wiphy.akm_suites &&
2344                     nla_put(msg, NL80211_ATTR_AKM_SUITES,
2345                             sizeof(u32) * rdev->wiphy.n_akm_suites,
2346                             rdev->wiphy.akm_suites))
2347                         goto nla_put_failure;
2348
2349                 /* done */
2350                 state->split_start = 0;
2351                 break;
2352         }
2353  finish:
2354         genlmsg_end(msg, hdr);
2355         return 0;
2356
2357  nla_put_failure:
2358         genlmsg_cancel(msg, hdr);
2359         return -EMSGSIZE;
2360 }
2361
2362 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
2363                                     struct netlink_callback *cb,
2364                                     struct nl80211_dump_wiphy_state *state)
2365 {
2366         struct nlattr **tb = genl_family_attrbuf(&nl80211_fam);
2367         int ret = nlmsg_parse_deprecated(cb->nlh,
2368                                          GENL_HDRLEN + nl80211_fam.hdrsize,
2369                                          tb, nl80211_fam.maxattr,
2370                                          nl80211_policy, NULL);
2371         /* ignore parse errors for backward compatibility */
2372         if (ret)
2373                 return 0;
2374
2375         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
2376         if (tb[NL80211_ATTR_WIPHY])
2377                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
2378         if (tb[NL80211_ATTR_WDEV])
2379                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
2380         if (tb[NL80211_ATTR_IFINDEX]) {
2381                 struct net_device *netdev;
2382                 struct cfg80211_registered_device *rdev;
2383                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2384
2385                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2386                 if (!netdev)
2387                         return -ENODEV;
2388                 if (netdev->ieee80211_ptr) {
2389                         rdev = wiphy_to_rdev(
2390                                 netdev->ieee80211_ptr->wiphy);
2391                         state->filter_wiphy = rdev->wiphy_idx;
2392                 }
2393         }
2394
2395         return 0;
2396 }
2397
2398 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
2399 {
2400         int idx = 0, ret;
2401         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
2402         struct cfg80211_registered_device *rdev;
2403
2404         rtnl_lock();
2405         if (!state) {
2406                 state = kzalloc(sizeof(*state), GFP_KERNEL);
2407                 if (!state) {
2408                         rtnl_unlock();
2409                         return -ENOMEM;
2410                 }
2411                 state->filter_wiphy = -1;
2412                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
2413                 if (ret) {
2414                         kfree(state);
2415                         rtnl_unlock();
2416                         return ret;
2417                 }
2418                 cb->args[0] = (long)state;
2419         }
2420
2421         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2422                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2423                         continue;
2424                 if (++idx <= state->start)
2425                         continue;
2426                 if (state->filter_wiphy != -1 &&
2427                     state->filter_wiphy != rdev->wiphy_idx)
2428                         continue;
2429                 /* attempt to fit multiple wiphy data chunks into the skb */
2430                 do {
2431                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
2432                                                  skb,
2433                                                  NETLINK_CB(cb->skb).portid,
2434                                                  cb->nlh->nlmsg_seq,
2435                                                  NLM_F_MULTI, state);
2436                         if (ret < 0) {
2437                                 /*
2438                                  * If sending the wiphy data didn't fit (ENOBUFS
2439                                  * or EMSGSIZE returned), this SKB is still
2440                                  * empty (so it's not too big because another
2441                                  * wiphy dataset is already in the skb) and
2442                                  * we've not tried to adjust the dump allocation
2443                                  * yet ... then adjust the alloc size to be
2444                                  * bigger, and return 1 but with the empty skb.
2445                                  * This results in an empty message being RX'ed
2446                                  * in userspace, but that is ignored.
2447                                  *
2448                                  * We can then retry with the larger buffer.
2449                                  */
2450                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
2451                                     !skb->len && !state->split &&
2452                                     cb->min_dump_alloc < 4096) {
2453                                         cb->min_dump_alloc = 4096;
2454                                         state->split_start = 0;
2455                                         rtnl_unlock();
2456                                         return 1;
2457                                 }
2458                                 idx--;
2459                                 break;
2460                         }
2461                 } while (state->split_start > 0);
2462                 break;
2463         }
2464         rtnl_unlock();
2465
2466         state->start = idx;
2467
2468         return skb->len;
2469 }
2470
2471 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
2472 {
2473         kfree((void *)cb->args[0]);
2474         return 0;
2475 }
2476
2477 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
2478 {
2479         struct sk_buff *msg;
2480         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2481         struct nl80211_dump_wiphy_state state = {};
2482
2483         msg = nlmsg_new(4096, GFP_KERNEL);
2484         if (!msg)
2485                 return -ENOMEM;
2486
2487         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
2488                                info->snd_portid, info->snd_seq, 0,
2489                                &state) < 0) {
2490                 nlmsg_free(msg);
2491                 return -ENOBUFS;
2492         }
2493
2494         return genlmsg_reply(msg, info);
2495 }
2496
2497 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2498         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
2499         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
2500         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
2501         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
2502         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
2503 };
2504
2505 static int parse_txq_params(struct nlattr *tb[],
2506                             struct ieee80211_txq_params *txq_params)
2507 {
2508         u8 ac;
2509
2510         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2511             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2512             !tb[NL80211_TXQ_ATTR_AIFS])
2513                 return -EINVAL;
2514
2515         ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2516         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2517         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2518         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2519         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2520
2521         if (ac >= NL80211_NUM_ACS)
2522                 return -EINVAL;
2523         txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
2524         return 0;
2525 }
2526
2527 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2528 {
2529         /*
2530          * You can only set the channel explicitly for WDS interfaces,
2531          * all others have their channel managed via their respective
2532          * "establish a connection" command (connect, join, ...)
2533          *
2534          * For AP/GO and mesh mode, the channel can be set with the
2535          * channel userspace API, but is only stored and passed to the
2536          * low-level driver when the AP starts or the mesh is joined.
2537          * This is for backward compatibility, userspace can also give
2538          * the channel in the start-ap or join-mesh commands instead.
2539          *
2540          * Monitors are special as they are normally slaved to
2541          * whatever else is going on, so they have their own special
2542          * operation to set the monitor channel if possible.
2543          */
2544         return !wdev ||
2545                 wdev->iftype == NL80211_IFTYPE_AP ||
2546                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2547                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
2548                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
2549 }
2550
2551 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2552                           struct genl_info *info,
2553                           struct cfg80211_chan_def *chandef)
2554 {
2555         struct netlink_ext_ack *extack = info->extack;
2556         struct nlattr **attrs = info->attrs;
2557         u32 control_freq;
2558
2559         if (!attrs[NL80211_ATTR_WIPHY_FREQ])
2560                 return -EINVAL;
2561
2562         control_freq = nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ]);
2563
2564         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
2565         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2566         chandef->center_freq1 = control_freq;
2567         chandef->center_freq2 = 0;
2568
2569         /* Primary channel not allowed */
2570         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) {
2571                 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
2572                                     "Channel is disabled");
2573                 return -EINVAL;
2574         }
2575
2576         if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2577                 enum nl80211_channel_type chantype;
2578
2579                 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2580
2581                 switch (chantype) {
2582                 case NL80211_CHAN_NO_HT:
2583                 case NL80211_CHAN_HT20:
2584                 case NL80211_CHAN_HT40PLUS:
2585                 case NL80211_CHAN_HT40MINUS:
2586                         cfg80211_chandef_create(chandef, chandef->chan,
2587                                                 chantype);
2588                         /* user input for center_freq is incorrect */
2589                         if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
2590                             chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
2591                                 NL_SET_ERR_MSG_ATTR(extack,
2592                                                     attrs[NL80211_ATTR_CENTER_FREQ1],
2593                                                     "bad center frequency 1");
2594                                 return -EINVAL;
2595                         }
2596                         /* center_freq2 must be zero */
2597                         if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
2598                             nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
2599                                 NL_SET_ERR_MSG_ATTR(extack,
2600                                                     attrs[NL80211_ATTR_CENTER_FREQ2],
2601                                                     "center frequency 2 can't be used");
2602                                 return -EINVAL;
2603                         }
2604                         break;
2605                 default:
2606                         NL_SET_ERR_MSG_ATTR(extack,
2607                                             attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
2608                                             "invalid channel type");
2609                         return -EINVAL;
2610                 }
2611         } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2612                 chandef->width =
2613                         nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2614                 if (attrs[NL80211_ATTR_CENTER_FREQ1])
2615                         chandef->center_freq1 =
2616                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
2617                 if (attrs[NL80211_ATTR_CENTER_FREQ2])
2618                         chandef->center_freq2 =
2619                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
2620         }
2621
2622         if (!cfg80211_chandef_valid(chandef)) {
2623                 NL_SET_ERR_MSG(extack, "invalid channel definition");
2624                 return -EINVAL;
2625         }
2626
2627         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2628                                      IEEE80211_CHAN_DISABLED)) {
2629                 NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
2630                 return -EINVAL;
2631         }
2632
2633         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2634              chandef->width == NL80211_CHAN_WIDTH_10) &&
2635             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
2636                 NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
2637                 return -EINVAL;
2638         }
2639
2640         return 0;
2641 }
2642
2643 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
2644                                  struct net_device *dev,
2645                                  struct genl_info *info)
2646 {
2647         struct cfg80211_chan_def chandef;
2648         int result;
2649         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2650         struct wireless_dev *wdev = NULL;
2651
2652         if (dev)
2653                 wdev = dev->ieee80211_ptr;
2654         if (!nl80211_can_set_dev_channel(wdev))
2655                 return -EOPNOTSUPP;
2656         if (wdev)
2657                 iftype = wdev->iftype;
2658
2659         result = nl80211_parse_chandef(rdev, info, &chandef);
2660         if (result)
2661                 return result;
2662
2663         switch (iftype) {
2664         case NL80211_IFTYPE_AP:
2665         case NL80211_IFTYPE_P2P_GO:
2666                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2667                                                    iftype)) {
2668                         result = -EINVAL;
2669                         break;
2670                 }
2671                 if (wdev->beacon_interval) {
2672                         if (!dev || !rdev->ops->set_ap_chanwidth ||
2673                             !(rdev->wiphy.features &
2674                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2675                                 result = -EBUSY;
2676                                 break;
2677                         }
2678
2679                         /* Only allow dynamic channel width changes */
2680                         if (chandef.chan != wdev->preset_chandef.chan) {
2681                                 result = -EBUSY;
2682                                 break;
2683                         }
2684                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2685                         if (result)
2686                                 break;
2687                 }
2688                 wdev->preset_chandef = chandef;
2689                 result = 0;
2690                 break;
2691         case NL80211_IFTYPE_MESH_POINT:
2692                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2693                 break;
2694         case NL80211_IFTYPE_MONITOR:
2695                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2696                 break;
2697         default:
2698                 result = -EINVAL;
2699         }
2700
2701         return result;
2702 }
2703
2704 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2705 {
2706         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2707         struct net_device *netdev = info->user_ptr[1];
2708
2709         return __nl80211_set_channel(rdev, netdev, info);
2710 }
2711
2712 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2713 {
2714         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2715         struct net_device *dev = info->user_ptr[1];
2716         struct wireless_dev *wdev = dev->ieee80211_ptr;
2717         const u8 *bssid;
2718
2719         if (!info->attrs[NL80211_ATTR_MAC])
2720                 return -EINVAL;
2721
2722         if (netif_running(dev))
2723                 return -EBUSY;
2724
2725         if (!rdev->ops->set_wds_peer)
2726                 return -EOPNOTSUPP;
2727
2728         if (wdev->iftype != NL80211_IFTYPE_WDS)
2729                 return -EOPNOTSUPP;
2730
2731         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2732         return rdev_set_wds_peer(rdev, dev, bssid);
2733 }
2734
2735 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2736 {
2737         struct cfg80211_registered_device *rdev;
2738         struct net_device *netdev = NULL;
2739         struct wireless_dev *wdev;
2740         int result = 0, rem_txq_params = 0;
2741         struct nlattr *nl_txq_params;
2742         u32 changed;
2743         u8 retry_short = 0, retry_long = 0;
2744         u32 frag_threshold = 0, rts_threshold = 0;
2745         u8 coverage_class = 0;
2746         u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
2747
2748         ASSERT_RTNL();
2749
2750         /*
2751          * Try to find the wiphy and netdev. Normally this
2752          * function shouldn't need the netdev, but this is
2753          * done for backward compatibility -- previously
2754          * setting the channel was done per wiphy, but now
2755          * it is per netdev. Previous userland like hostapd
2756          * also passed a netdev to set_wiphy, so that it is
2757          * possible to let that go to the right netdev!
2758          */
2759
2760         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2761                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2762
2763                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2764                 if (netdev && netdev->ieee80211_ptr)
2765                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2766                 else
2767                         netdev = NULL;
2768         }
2769
2770         if (!netdev) {
2771                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2772                                                   info->attrs);
2773                 if (IS_ERR(rdev))
2774                         return PTR_ERR(rdev);
2775                 wdev = NULL;
2776                 netdev = NULL;
2777                 result = 0;
2778         } else
2779                 wdev = netdev->ieee80211_ptr;
2780
2781         /*
2782          * end workaround code, by now the rdev is available
2783          * and locked, and wdev may or may not be NULL.
2784          */
2785
2786         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2787                 result = cfg80211_dev_rename(
2788                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2789
2790         if (result)
2791                 return result;
2792
2793         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2794                 struct ieee80211_txq_params txq_params;
2795                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2796
2797                 if (!rdev->ops->set_txq_params)
2798                         return -EOPNOTSUPP;
2799
2800                 if (!netdev)
2801                         return -EINVAL;
2802
2803                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2804                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2805                         return -EINVAL;
2806
2807                 if (!netif_running(netdev))
2808                         return -ENETDOWN;
2809
2810                 nla_for_each_nested(nl_txq_params,
2811                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2812                                     rem_txq_params) {
2813                         result = nla_parse_nested_deprecated(tb,
2814                                                              NL80211_TXQ_ATTR_MAX,
2815                                                              nl_txq_params,
2816                                                              txq_params_policy,
2817                                                              info->extack);
2818                         if (result)
2819                                 return result;
2820                         result = parse_txq_params(tb, &txq_params);
2821                         if (result)
2822                                 return result;
2823
2824                         result = rdev_set_txq_params(rdev, netdev,
2825                                                      &txq_params);
2826                         if (result)
2827                                 return result;
2828                 }
2829         }
2830
2831         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2832                 result = __nl80211_set_channel(
2833                         rdev,
2834                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2835                         info);
2836                 if (result)
2837                         return result;
2838         }
2839
2840         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2841                 struct wireless_dev *txp_wdev = wdev;
2842                 enum nl80211_tx_power_setting type;
2843                 int idx, mbm = 0;
2844
2845                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2846                         txp_wdev = NULL;
2847
2848                 if (!rdev->ops->set_tx_power)
2849                         return -EOPNOTSUPP;
2850
2851                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2852                 type = nla_get_u32(info->attrs[idx]);
2853
2854                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2855                     (type != NL80211_TX_POWER_AUTOMATIC))
2856                         return -EINVAL;
2857
2858                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2859                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2860                         mbm = nla_get_u32(info->attrs[idx]);
2861                 }
2862
2863                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2864                 if (result)
2865                         return result;
2866         }
2867
2868         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2869             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2870                 u32 tx_ant, rx_ant;
2871
2872                 if ((!rdev->wiphy.available_antennas_tx &&
2873                      !rdev->wiphy.available_antennas_rx) ||
2874                     !rdev->ops->set_antenna)
2875                         return -EOPNOTSUPP;
2876
2877                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2878                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2879
2880                 /* reject antenna configurations which don't match the
2881                  * available antenna masks, except for the "all" mask */
2882                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2883                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2884                         return -EINVAL;
2885
2886                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2887                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2888
2889                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2890                 if (result)
2891                         return result;
2892         }
2893
2894         changed = 0;
2895
2896         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2897                 retry_short = nla_get_u8(
2898                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2899
2900                 changed |= WIPHY_PARAM_RETRY_SHORT;
2901         }
2902
2903         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2904                 retry_long = nla_get_u8(
2905                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2906
2907                 changed |= WIPHY_PARAM_RETRY_LONG;
2908         }
2909
2910         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2911                 frag_threshold = nla_get_u32(
2912                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2913                 if (frag_threshold < 256)
2914                         return -EINVAL;
2915
2916                 if (frag_threshold != (u32) -1) {
2917                         /*
2918                          * Fragments (apart from the last one) are required to
2919                          * have even length. Make the fragmentation code
2920                          * simpler by stripping LSB should someone try to use
2921                          * odd threshold value.
2922                          */
2923                         frag_threshold &= ~0x1;
2924                 }
2925                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2926         }
2927
2928         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2929                 rts_threshold = nla_get_u32(
2930                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2931                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2932         }
2933
2934         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2935                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2936                         return -EINVAL;
2937
2938                 coverage_class = nla_get_u8(
2939                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2940                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2941         }
2942
2943         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2944                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2945                         return -EOPNOTSUPP;
2946
2947                 changed |= WIPHY_PARAM_DYN_ACK;
2948         }
2949
2950         if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
2951                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2952                                              NL80211_EXT_FEATURE_TXQS))
2953                         return -EOPNOTSUPP;
2954                 txq_limit = nla_get_u32(
2955                         info->attrs[NL80211_ATTR_TXQ_LIMIT]);
2956                 changed |= WIPHY_PARAM_TXQ_LIMIT;
2957         }
2958
2959         if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
2960                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2961                                              NL80211_EXT_FEATURE_TXQS))
2962                         return -EOPNOTSUPP;
2963                 txq_memory_limit = nla_get_u32(
2964                         info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
2965                 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
2966         }
2967
2968         if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
2969                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2970                                              NL80211_EXT_FEATURE_TXQS))
2971                         return -EOPNOTSUPP;
2972                 txq_quantum = nla_get_u32(
2973                         info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
2974                 changed |= WIPHY_PARAM_TXQ_QUANTUM;
2975         }
2976
2977         if (changed) {
2978                 u8 old_retry_short, old_retry_long;
2979                 u32 old_frag_threshold, old_rts_threshold;
2980                 u8 old_coverage_class;
2981                 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
2982
2983                 if (!rdev->ops->set_wiphy_params)
2984                         return -EOPNOTSUPP;
2985
2986                 old_retry_short = rdev->wiphy.retry_short;
2987                 old_retry_long = rdev->wiphy.retry_long;
2988                 old_frag_threshold = rdev->wiphy.frag_threshold;
2989                 old_rts_threshold = rdev->wiphy.rts_threshold;
2990                 old_coverage_class = rdev->wiphy.coverage_class;
2991                 old_txq_limit = rdev->wiphy.txq_limit;
2992                 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
2993                 old_txq_quantum = rdev->wiphy.txq_quantum;
2994
2995                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2996                         rdev->wiphy.retry_short = retry_short;
2997                 if (changed & WIPHY_PARAM_RETRY_LONG)
2998                         rdev->wiphy.retry_long = retry_long;
2999                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
3000                         rdev->wiphy.frag_threshold = frag_threshold;
3001                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
3002                         rdev->wiphy.rts_threshold = rts_threshold;
3003                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
3004                         rdev->wiphy.coverage_class = coverage_class;
3005                 if (changed & WIPHY_PARAM_TXQ_LIMIT)
3006                         rdev->wiphy.txq_limit = txq_limit;
3007                 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
3008                         rdev->wiphy.txq_memory_limit = txq_memory_limit;
3009                 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
3010                         rdev->wiphy.txq_quantum = txq_quantum;
3011
3012                 result = rdev_set_wiphy_params(rdev, changed);
3013                 if (result) {
3014                         rdev->wiphy.retry_short = old_retry_short;
3015                         rdev->wiphy.retry_long = old_retry_long;
3016                         rdev->wiphy.frag_threshold = old_frag_threshold;
3017                         rdev->wiphy.rts_threshold = old_rts_threshold;
3018                         rdev->wiphy.coverage_class = old_coverage_class;
3019                         rdev->wiphy.txq_limit = old_txq_limit;
3020                         rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
3021                         rdev->wiphy.txq_quantum = old_txq_quantum;
3022                         return result;
3023                 }
3024         }
3025         return 0;
3026 }
3027
3028 static int nl80211_send_chandef(struct sk_buff *msg,
3029                                 const struct cfg80211_chan_def *chandef)
3030 {
3031         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
3032                 return -EINVAL;
3033
3034         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
3035                         chandef->chan->center_freq))
3036                 return -ENOBUFS;
3037         switch (chandef->width) {
3038         case NL80211_CHAN_WIDTH_20_NOHT:
3039         case NL80211_CHAN_WIDTH_20:
3040         case NL80211_CHAN_WIDTH_40:
3041                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3042                                 cfg80211_get_chandef_type(chandef)))
3043                         return -ENOBUFS;
3044                 break;
3045         default:
3046                 break;
3047         }
3048         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
3049                 return -ENOBUFS;
3050         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
3051                 return -ENOBUFS;
3052         if (chandef->center_freq2 &&
3053             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
3054                 return -ENOBUFS;
3055         return 0;
3056 }
3057
3058 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
3059                               struct cfg80211_registered_device *rdev,
3060                               struct wireless_dev *wdev,
3061                               enum nl80211_commands cmd)
3062 {
3063         struct net_device *dev = wdev->netdev;
3064         void *hdr;
3065
3066         WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
3067                 cmd != NL80211_CMD_DEL_INTERFACE &&
3068                 cmd != NL80211_CMD_SET_INTERFACE);
3069
3070         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3071         if (!hdr)
3072                 return -1;
3073
3074         if (dev &&
3075             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3076              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
3077                 goto nla_put_failure;
3078
3079         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
3080             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
3081             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
3082                               NL80211_ATTR_PAD) ||
3083             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
3084             nla_put_u32(msg, NL80211_ATTR_GENERATION,
3085                         rdev->devlist_generation ^
3086                         (cfg80211_rdev_list_generation << 2)) ||
3087             nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr))
3088                 goto nla_put_failure;
3089
3090         if (rdev->ops->get_channel) {
3091                 int ret;
3092                 struct cfg80211_chan_def chandef;
3093
3094                 ret = rdev_get_channel(rdev, wdev, &chandef);
3095                 if (ret == 0) {
3096                         if (nl80211_send_chandef(msg, &chandef))
3097                                 goto nla_put_failure;
3098                 }
3099         }
3100
3101         if (rdev->ops->get_tx_power) {
3102                 int dbm, ret;
3103
3104                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
3105                 if (ret == 0 &&
3106                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
3107                                 DBM_TO_MBM(dbm)))
3108                         goto nla_put_failure;
3109         }
3110
3111         wdev_lock(wdev);
3112         switch (wdev->iftype) {
3113         case NL80211_IFTYPE_AP:
3114                 if (wdev->ssid_len &&
3115                     nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
3116                         goto nla_put_failure_locked;
3117                 break;
3118         case NL80211_IFTYPE_STATION:
3119         case NL80211_IFTYPE_P2P_CLIENT:
3120         case NL80211_IFTYPE_ADHOC: {
3121                 const u8 *ssid_ie;
3122                 if (!wdev->current_bss)
3123                         break;
3124                 rcu_read_lock();
3125                 ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
3126                                                WLAN_EID_SSID);
3127                 if (ssid_ie &&
3128                     nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2))
3129                         goto nla_put_failure_rcu_locked;
3130                 rcu_read_unlock();
3131                 break;
3132                 }
3133         default:
3134                 /* nothing */
3135                 break;
3136         }
3137         wdev_unlock(wdev);
3138
3139         if (rdev->ops->get_txq_stats) {
3140                 struct cfg80211_txq_stats txqstats = {};
3141                 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
3142
3143                 if (ret == 0 &&
3144                     !nl80211_put_txq_stats(msg, &txqstats,
3145                                            NL80211_ATTR_TXQ_STATS))
3146                         goto nla_put_failure;
3147         }
3148
3149         genlmsg_end(msg, hdr);
3150         return 0;
3151
3152  nla_put_failure_rcu_locked:
3153         rcu_read_unlock();
3154  nla_put_failure_locked:
3155         wdev_unlock(wdev);
3156  nla_put_failure:
3157         genlmsg_cancel(msg, hdr);
3158         return -EMSGSIZE;
3159 }
3160
3161 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
3162 {
3163         int wp_idx = 0;
3164         int if_idx = 0;
3165         int wp_start = cb->args[0];
3166         int if_start = cb->args[1];
3167         int filter_wiphy = -1;
3168         struct cfg80211_registered_device *rdev;
3169         struct wireless_dev *wdev;
3170         int ret;
3171
3172         rtnl_lock();
3173         if (!cb->args[2]) {
3174                 struct nl80211_dump_wiphy_state state = {
3175                         .filter_wiphy = -1,
3176                 };
3177
3178                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
3179                 if (ret)
3180                         goto out_unlock;
3181
3182                 filter_wiphy = state.filter_wiphy;
3183
3184                 /*
3185                  * if filtering, set cb->args[2] to +1 since 0 is the default
3186                  * value needed to determine that parsing is necessary.
3187                  */
3188                 if (filter_wiphy >= 0)
3189                         cb->args[2] = filter_wiphy + 1;
3190                 else
3191                         cb->args[2] = -1;
3192         } else if (cb->args[2] > 0) {
3193                 filter_wiphy = cb->args[2] - 1;
3194         }
3195
3196         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3197                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3198                         continue;
3199                 if (wp_idx < wp_start) {
3200                         wp_idx++;
3201                         continue;
3202                 }
3203
3204                 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
3205                         continue;
3206
3207                 if_idx = 0;
3208
3209                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3210                         if (if_idx < if_start) {
3211                                 if_idx++;
3212                                 continue;
3213                         }
3214                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
3215                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
3216                                                rdev, wdev,
3217                                                NL80211_CMD_NEW_INTERFACE) < 0) {
3218                                 goto out;
3219                         }
3220                         if_idx++;
3221                 }
3222
3223                 wp_idx++;
3224         }
3225  out:
3226         cb->args[0] = wp_idx;
3227         cb->args[1] = if_idx;
3228
3229         ret = skb->len;
3230  out_unlock:
3231         rtnl_unlock();
3232
3233         return ret;
3234 }
3235
3236 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
3237 {
3238         struct sk_buff *msg;
3239         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3240         struct wireless_dev *wdev = info->user_ptr[1];
3241
3242         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3243         if (!msg)
3244                 return -ENOMEM;
3245
3246         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3247                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
3248                 nlmsg_free(msg);
3249                 return -ENOBUFS;
3250         }
3251
3252         return genlmsg_reply(msg, info);
3253 }
3254
3255 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
3256         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
3257         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
3258         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
3259         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
3260         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
3261         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
3262 };
3263
3264 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
3265 {
3266         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
3267         int flag;
3268
3269         *mntrflags = 0;
3270
3271         if (!nla)
3272                 return -EINVAL;
3273
3274         if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL))
3275                 return -EINVAL;
3276
3277         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
3278                 if (flags[flag])
3279                         *mntrflags |= (1<<flag);
3280
3281         *mntrflags |= MONITOR_FLAG_CHANGED;
3282
3283         return 0;
3284 }
3285
3286 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
3287                                      enum nl80211_iftype type,
3288                                      struct genl_info *info,
3289                                      struct vif_params *params)
3290 {
3291         bool change = false;
3292         int err;
3293
3294         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
3295                 if (type != NL80211_IFTYPE_MONITOR)
3296                         return -EINVAL;
3297
3298                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
3299                                           &params->flags);
3300                 if (err)
3301                         return err;
3302
3303                 change = true;
3304         }
3305
3306         if (params->flags & MONITOR_FLAG_ACTIVE &&
3307             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
3308                 return -EOPNOTSUPP;
3309
3310         if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
3311                 const u8 *mumimo_groups;
3312                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3313
3314                 if (type != NL80211_IFTYPE_MONITOR)
3315                         return -EINVAL;
3316
3317                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3318                         return -EOPNOTSUPP;
3319
3320                 mumimo_groups =
3321                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
3322
3323                 /* bits 0 and 63 are reserved and must be zero */
3324                 if ((mumimo_groups[0] & BIT(0)) ||
3325                     (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
3326                         return -EINVAL;
3327
3328                 params->vht_mumimo_groups = mumimo_groups;
3329                 change = true;
3330         }
3331
3332         if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
3333                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3334
3335                 if (type != NL80211_IFTYPE_MONITOR)
3336                         return -EINVAL;
3337
3338                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3339                         return -EOPNOTSUPP;
3340
3341                 params->vht_mumimo_follow_addr =
3342                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
3343                 change = true;
3344         }
3345
3346         return change ? 1 : 0;
3347 }
3348
3349 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
3350                                struct net_device *netdev, u8 use_4addr,
3351                                enum nl80211_iftype iftype)
3352 {
3353         if (!use_4addr) {
3354                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
3355                         return -EBUSY;
3356                 return 0;
3357         }
3358
3359         switch (iftype) {
3360         case NL80211_IFTYPE_AP_VLAN:
3361                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
3362                         return 0;
3363                 break;
3364         case NL80211_IFTYPE_STATION:
3365                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
3366                         return 0;
3367                 break;
3368         default:
3369                 break;
3370         }
3371
3372         return -EOPNOTSUPP;
3373 }
3374
3375 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
3376 {
3377         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3378         struct vif_params params;
3379         int err;
3380         enum nl80211_iftype otype, ntype;
3381         struct net_device *dev = info->user_ptr[1];
3382         bool change = false;
3383
3384         memset(&params, 0, sizeof(params));
3385
3386         otype = ntype = dev->ieee80211_ptr->iftype;
3387
3388         if (info->attrs[NL80211_ATTR_IFTYPE]) {
3389                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3390                 if (otype != ntype)
3391                         change = true;
3392         }
3393
3394         if (info->attrs[NL80211_ATTR_MESH_ID]) {
3395                 struct wireless_dev *wdev = dev->ieee80211_ptr;
3396
3397                 if (ntype != NL80211_IFTYPE_MESH_POINT)
3398                         return -EINVAL;
3399                 if (netif_running(dev))
3400                         return -EBUSY;
3401
3402                 wdev_lock(wdev);
3403                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3404                              IEEE80211_MAX_MESH_ID_LEN);
3405                 wdev->mesh_id_up_len =
3406                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3407                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3408                        wdev->mesh_id_up_len);
3409                 wdev_unlock(wdev);
3410         }
3411
3412         if (info->attrs[NL80211_ATTR_4ADDR]) {
3413                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3414                 change = true;
3415                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
3416                 if (err)
3417                         return err;
3418         } else {
3419                 params.use_4addr = -1;
3420         }
3421
3422         err = nl80211_parse_mon_options(rdev, ntype, info, &params);
3423         if (err < 0)
3424                 return err;
3425         if (err > 0)
3426                 change = true;
3427
3428         if (change)
3429                 err = cfg80211_change_iface(rdev, dev, ntype, &params);
3430         else
3431                 err = 0;
3432
3433         if (!err && params.use_4addr != -1)
3434                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
3435
3436         if (change && !err) {
3437                 struct wireless_dev *wdev = dev->ieee80211_ptr;
3438
3439                 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
3440         }
3441
3442         return err;
3443 }
3444
3445 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
3446 {
3447         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3448         struct vif_params params;
3449         struct wireless_dev *wdev;
3450         struct sk_buff *msg;
3451         int err;
3452         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
3453
3454         /* to avoid failing a new interface creation due to pending removal */
3455         cfg80211_destroy_ifaces(rdev);
3456
3457         memset(&params, 0, sizeof(params));
3458
3459         if (!info->attrs[NL80211_ATTR_IFNAME])
3460                 return -EINVAL;
3461
3462         if (info->attrs[NL80211_ATTR_IFTYPE])
3463                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3464
3465         if (!rdev->ops->add_virtual_intf)
3466                 return -EOPNOTSUPP;
3467
3468         if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
3469              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
3470             info->attrs[NL80211_ATTR_MAC]) {
3471                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
3472                            ETH_ALEN);
3473                 if (!is_valid_ether_addr(params.macaddr))
3474                         return -EADDRNOTAVAIL;
3475         }
3476
3477         if (info->attrs[NL80211_ATTR_4ADDR]) {
3478                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3479                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
3480                 if (err)
3481                         return err;
3482         }
3483
3484         if (!(rdev->wiphy.interface_modes & (1 << type)) &&
3485             !(type == NL80211_IFTYPE_AP_VLAN && params.use_4addr &&
3486               rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP))
3487                 return -EOPNOTSUPP;
3488
3489         err = nl80211_parse_mon_options(rdev, type, info, &params);
3490         if (err < 0)
3491                 return err;
3492
3493         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3494         if (!msg)
3495                 return -ENOMEM;
3496
3497         wdev = rdev_add_virtual_intf(rdev,
3498                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
3499                                 NET_NAME_USER, type, &params);
3500         if (WARN_ON(!wdev)) {
3501                 nlmsg_free(msg);
3502                 return -EPROTO;
3503         } else if (IS_ERR(wdev)) {
3504                 nlmsg_free(msg);
3505                 return PTR_ERR(wdev);
3506         }
3507
3508         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
3509                 wdev->owner_nlportid = info->snd_portid;
3510
3511         switch (type) {
3512         case NL80211_IFTYPE_MESH_POINT:
3513                 if (!info->attrs[NL80211_ATTR_MESH_ID])
3514                         break;
3515                 wdev_lock(wdev);
3516                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3517                              IEEE80211_MAX_MESH_ID_LEN);
3518                 wdev->mesh_id_up_len =
3519                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3520                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3521                        wdev->mesh_id_up_len);
3522                 wdev_unlock(wdev);
3523                 break;
3524         case NL80211_IFTYPE_NAN:
3525         case NL80211_IFTYPE_P2P_DEVICE:
3526                 /*
3527                  * P2P Device and NAN do not have a netdev, so don't go
3528                  * through the netdev notifier and must be added here
3529                  */
3530                 cfg80211_init_wdev(rdev, wdev);
3531                 break;
3532         default:
3533                 break;
3534         }
3535
3536         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3537                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
3538                 nlmsg_free(msg);
3539                 return -ENOBUFS;
3540         }
3541
3542         return genlmsg_reply(msg, info);
3543 }
3544
3545 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
3546 {
3547         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3548         struct wireless_dev *wdev = info->user_ptr[1];
3549
3550         if (!rdev->ops->del_virtual_intf)
3551                 return -EOPNOTSUPP;
3552
3553         /*
3554          * If we remove a wireless device without a netdev then clear
3555          * user_ptr[1] so that nl80211_post_doit won't dereference it
3556          * to check if it needs to do dev_put(). Otherwise it crashes
3557          * since the wdev has been freed, unlike with a netdev where
3558          * we need the dev_put() for the netdev to really be freed.
3559          */
3560         if (!wdev->netdev)
3561                 info->user_ptr[1] = NULL;
3562
3563         return rdev_del_virtual_intf(rdev, wdev);
3564 }
3565
3566 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
3567 {
3568         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3569         struct net_device *dev = info->user_ptr[1];
3570         u16 noack_map;
3571
3572         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
3573                 return -EINVAL;
3574
3575         if (!rdev->ops->set_noack_map)
3576                 return -EOPNOTSUPP;
3577
3578         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
3579
3580         return rdev_set_noack_map(rdev, dev, noack_map);
3581 }
3582
3583 struct get_key_cookie {
3584         struct sk_buff *msg;
3585         int error;
3586         int idx;
3587 };
3588
3589 static void get_key_callback(void *c, struct key_params *params)
3590 {
3591         struct nlattr *key;
3592         struct get_key_cookie *cookie = c;
3593
3594         if ((params->key &&
3595              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
3596                      params->key_len, params->key)) ||
3597             (params->seq &&
3598              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
3599                      params->seq_len, params->seq)) ||
3600             (params->cipher &&
3601              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
3602                          params->cipher)))
3603                 goto nla_put_failure;
3604
3605         key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY);
3606         if (!key)
3607                 goto nla_put_failure;
3608
3609         if ((params->key &&
3610              nla_put(cookie->msg, NL80211_KEY_DATA,
3611                      params->key_len, params->key)) ||
3612             (params->seq &&
3613              nla_put(cookie->msg, NL80211_KEY_SEQ,
3614                      params->seq_len, params->seq)) ||
3615             (params->cipher &&
3616              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
3617                          params->cipher)))
3618                 goto nla_put_failure;
3619
3620         if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
3621                 goto nla_put_failure;
3622
3623         nla_nest_end(cookie->msg, key);
3624
3625         return;
3626  nla_put_failure:
3627         cookie->error = 1;
3628 }
3629
3630 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
3631 {
3632         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3633         int err;
3634         struct net_device *dev = info->user_ptr[1];
3635         u8 key_idx = 0;
3636         const u8 *mac_addr = NULL;
3637         bool pairwise;
3638         struct get_key_cookie cookie = {
3639                 .error = 0,
3640         };
3641         void *hdr;
3642         struct sk_buff *msg;
3643
3644         if (info->attrs[NL80211_ATTR_KEY_IDX])
3645                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
3646
3647         if (info->attrs[NL80211_ATTR_MAC])
3648                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3649
3650         pairwise = !!mac_addr;
3651         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
3652                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
3653
3654                 if (kt != NL80211_KEYTYPE_GROUP &&
3655                     kt != NL80211_KEYTYPE_PAIRWISE)
3656                         return -EINVAL;
3657                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
3658         }
3659
3660         if (!rdev->ops->get_key)
3661                 return -EOPNOTSUPP;
3662
3663         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3664                 return -ENOENT;
3665
3666         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3667         if (!msg)
3668                 return -ENOMEM;
3669
3670         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3671                              NL80211_CMD_NEW_KEY);
3672         if (!hdr)
3673                 goto nla_put_failure;
3674
3675         cookie.msg = msg;
3676         cookie.idx = key_idx;
3677
3678         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3679             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
3680                 goto nla_put_failure;
3681         if (mac_addr &&
3682             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
3683                 goto nla_put_failure;
3684
3685         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
3686                            get_key_callback);
3687
3688         if (err)
3689                 goto free_msg;
3690
3691         if (cookie.error)
3692                 goto nla_put_failure;
3693
3694         genlmsg_end(msg, hdr);
3695         return genlmsg_reply(msg, info);
3696
3697  nla_put_failure:
3698         err = -ENOBUFS;
3699  free_msg:
3700         nlmsg_free(msg);
3701         return err;
3702 }
3703
3704 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
3705 {
3706         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3707         struct key_parse key;
3708         int err;
3709         struct net_device *dev = info->user_ptr[1];
3710
3711         err = nl80211_parse_key(info, &key);
3712         if (err)
3713                 return err;
3714
3715         if (key.idx < 0)
3716                 return -EINVAL;
3717
3718         /* Only support setting default key and
3719          * Extended Key ID action NL80211_KEY_SET_TX.
3720          */
3721         if (!key.def && !key.defmgmt &&
3722             !(key.p.mode == NL80211_KEY_SET_TX))
3723                 return -EINVAL;
3724
3725         wdev_lock(dev->ieee80211_ptr);
3726
3727         if (key.def) {
3728                 if (!rdev->ops->set_default_key) {
3729                         err = -EOPNOTSUPP;
3730                         goto out;
3731                 }
3732
3733                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3734                 if (err)
3735                         goto out;
3736
3737                 err = rdev_set_default_key(rdev, dev, key.idx,
3738                                                  key.def_uni, key.def_multi);
3739
3740                 if (err)
3741                         goto out;
3742
3743 #ifdef CONFIG_CFG80211_WEXT
3744                 dev->ieee80211_ptr->wext.default_key = key.idx;
3745 #endif
3746         } else if (key.defmgmt) {
3747                 if (key.def_uni || !key.def_multi) {
3748                         err = -EINVAL;
3749                         goto out;
3750                 }
3751
3752                 if (!rdev->ops->set_default_mgmt_key) {
3753                         err = -EOPNOTSUPP;
3754                         goto out;
3755                 }
3756
3757                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3758                 if (err)
3759                         goto out;
3760
3761                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
3762                 if (err)
3763                         goto out;
3764
3765 #ifdef CONFIG_CFG80211_WEXT
3766                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3767 #endif
3768         } else if (key.p.mode == NL80211_KEY_SET_TX &&
3769                    wiphy_ext_feature_isset(&rdev->wiphy,
3770                                            NL80211_EXT_FEATURE_EXT_KEY_ID)) {
3771                 u8 *mac_addr = NULL;
3772
3773                 if (info->attrs[NL80211_ATTR_MAC])
3774                         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3775
3776                 if (!mac_addr || key.idx < 0 || key.idx > 1) {
3777                         err = -EINVAL;
3778                         goto out;
3779                 }
3780
3781                 err = rdev_add_key(rdev, dev, key.idx,
3782                                    NL80211_KEYTYPE_PAIRWISE,
3783                                    mac_addr, &key.p);
3784         } else {
3785                 err = -EINVAL;
3786         }
3787  out:
3788         wdev_unlock(dev->ieee80211_ptr);
3789
3790         return err;
3791 }
3792
3793 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3794 {
3795         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3796         int err;
3797         struct net_device *dev = info->user_ptr[1];
3798         struct key_parse key;
3799         const u8 *mac_addr = NULL;
3800
3801         err = nl80211_parse_key(info, &key);
3802         if (err)
3803                 return err;
3804
3805         if (!key.p.key)
3806                 return -EINVAL;
3807
3808         if (info->attrs[NL80211_ATTR_MAC])
3809                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3810
3811         if (key.type == -1) {
3812                 if (mac_addr)
3813                         key.type = NL80211_KEYTYPE_PAIRWISE;
3814                 else
3815                         key.type = NL80211_KEYTYPE_GROUP;
3816         }
3817
3818         /* for now */
3819         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3820             key.type != NL80211_KEYTYPE_GROUP)
3821                 return -EINVAL;
3822
3823         if (!rdev->ops->add_key)
3824                 return -EOPNOTSUPP;
3825
3826         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3827                                            key.type == NL80211_KEYTYPE_PAIRWISE,
3828                                            mac_addr))
3829                 return -EINVAL;
3830
3831         wdev_lock(dev->ieee80211_ptr);
3832         err = nl80211_key_allowed(dev->ieee80211_ptr);
3833         if (!err)
3834                 err = rdev_add_key(rdev, dev, key.idx,
3835                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3836                                     mac_addr, &key.p);
3837         wdev_unlock(dev->ieee80211_ptr);
3838
3839         return err;
3840 }
3841
3842 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3843 {
3844         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3845         int err;
3846         struct net_device *dev = info->user_ptr[1];
3847         u8 *mac_addr = NULL;
3848         struct key_parse key;
3849
3850         err = nl80211_parse_key(info, &key);
3851         if (err)
3852                 return err;
3853
3854         if (info->attrs[NL80211_ATTR_MAC])
3855                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3856
3857         if (key.type == -1) {
3858                 if (mac_addr)
3859                         key.type = NL80211_KEYTYPE_PAIRWISE;
3860                 else
3861                         key.type = NL80211_KEYTYPE_GROUP;
3862         }
3863
3864         /* for now */
3865         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3866             key.type != NL80211_KEYTYPE_GROUP)
3867                 return -EINVAL;
3868
3869         if (!rdev->ops->del_key)
3870                 return -EOPNOTSUPP;
3871
3872         wdev_lock(dev->ieee80211_ptr);
3873         err = nl80211_key_allowed(dev->ieee80211_ptr);
3874
3875         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3876             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3877                 err = -ENOENT;
3878
3879         if (!err)
3880                 err = rdev_del_key(rdev, dev, key.idx,
3881                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3882                                    mac_addr);
3883
3884 #ifdef CONFIG_CFG80211_WEXT
3885         if (!err) {
3886                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3887                         dev->ieee80211_ptr->wext.default_key = -1;
3888                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3889                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3890         }
3891 #endif
3892         wdev_unlock(dev->ieee80211_ptr);
3893
3894         return err;
3895 }
3896
3897 /* This function returns an error or the number of nested attributes */
3898 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3899 {
3900         struct nlattr *attr;
3901         int n_entries = 0, tmp;
3902
3903         nla_for_each_nested(attr, nl_attr, tmp) {
3904                 if (nla_len(attr) != ETH_ALEN)
3905                         return -EINVAL;
3906
3907                 n_entries++;
3908         }
3909
3910         return n_entries;
3911 }
3912
3913 /*
3914  * This function parses ACL information and allocates memory for ACL data.
3915  * On successful return, the calling function is responsible to free the
3916  * ACL buffer returned by this function.
3917  */
3918 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3919                                                 struct genl_info *info)
3920 {
3921         enum nl80211_acl_policy acl_policy;
3922         struct nlattr *attr;
3923         struct cfg80211_acl_data *acl;
3924         int i = 0, n_entries, tmp;
3925
3926         if (!wiphy->max_acl_mac_addrs)
3927                 return ERR_PTR(-EOPNOTSUPP);
3928
3929         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3930                 return ERR_PTR(-EINVAL);
3931
3932         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3933         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3934             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3935                 return ERR_PTR(-EINVAL);
3936
3937         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3938                 return ERR_PTR(-EINVAL);
3939
3940         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3941         if (n_entries < 0)
3942                 return ERR_PTR(n_entries);
3943
3944         if (n_entries > wiphy->max_acl_mac_addrs)
3945                 return ERR_PTR(-ENOTSUPP);
3946
3947         acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL);
3948         if (!acl)
3949                 return ERR_PTR(-ENOMEM);
3950
3951         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3952                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3953                 i++;
3954         }
3955
3956         acl->n_acl_entries = n_entries;
3957         acl->acl_policy = acl_policy;
3958
3959         return acl;
3960 }
3961
3962 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3963 {
3964         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3965         struct net_device *dev = info->user_ptr[1];
3966         struct cfg80211_acl_data *acl;
3967         int err;
3968
3969         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3970             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3971                 return -EOPNOTSUPP;
3972
3973         if (!dev->ieee80211_ptr->beacon_interval)
3974                 return -EINVAL;
3975
3976         acl = parse_acl_data(&rdev->wiphy, info);
3977         if (IS_ERR(acl))
3978                 return PTR_ERR(acl);
3979
3980         err = rdev_set_mac_acl(rdev, dev, acl);
3981
3982         kfree(acl);
3983
3984         return err;
3985 }
3986
3987 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
3988                            u8 *rates, u8 rates_len)
3989 {
3990         u8 i;
3991         u32 mask = 0;
3992
3993         for (i = 0; i < rates_len; i++) {
3994                 int rate = (rates[i] & 0x7f) * 5;
3995                 int ridx;
3996
3997                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
3998                         struct ieee80211_rate *srate =
3999                                 &sband->bitrates[ridx];
4000                         if (rate == srate->bitrate) {
4001                                 mask |= 1 << ridx;
4002                                 break;
4003                         }
4004                 }
4005                 if (ridx == sband->n_bitrates)
4006                         return 0; /* rate not found */
4007         }
4008
4009         return mask;
4010 }
4011
4012 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
4013                                u8 *rates, u8 rates_len,
4014                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
4015 {
4016         u8 i;
4017
4018         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
4019
4020         for (i = 0; i < rates_len; i++) {
4021                 int ridx, rbit;
4022
4023                 ridx = rates[i] / 8;
4024                 rbit = BIT(rates[i] % 8);
4025
4026                 /* check validity */
4027                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
4028                         return false;
4029
4030                 /* check availability */
4031                 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
4032                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
4033                         mcs[ridx] |= rbit;
4034                 else
4035                         return false;
4036         }
4037
4038         return true;
4039 }
4040
4041 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
4042 {
4043         u16 mcs_mask = 0;
4044
4045         switch (vht_mcs_map) {
4046         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
4047                 break;
4048         case IEEE80211_VHT_MCS_SUPPORT_0_7:
4049                 mcs_mask = 0x00FF;
4050                 break;
4051         case IEEE80211_VHT_MCS_SUPPORT_0_8:
4052                 mcs_mask = 0x01FF;
4053                 break;
4054         case IEEE80211_VHT_MCS_SUPPORT_0_9:
4055                 mcs_mask = 0x03FF;
4056                 break;
4057         default:
4058                 break;
4059         }
4060
4061         return mcs_mask;
4062 }
4063
4064 static void vht_build_mcs_mask(u16 vht_mcs_map,
4065                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
4066 {
4067         u8 nss;
4068
4069         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
4070                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
4071                 vht_mcs_map >>= 2;
4072         }
4073 }
4074
4075 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
4076                              struct nl80211_txrate_vht *txrate,
4077                              u16 mcs[NL80211_VHT_NSS_MAX])
4078 {
4079         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4080         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
4081         u8 i;
4082
4083         if (!sband->vht_cap.vht_supported)
4084                 return false;
4085
4086         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
4087
4088         /* Build vht_mcs_mask from VHT capabilities */
4089         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
4090
4091         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
4092                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
4093                         mcs[i] = txrate->mcs[i];
4094                 else
4095                         return false;
4096         }
4097
4098         return true;
4099 }
4100
4101 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
4102         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
4103                                     .len = NL80211_MAX_SUPP_RATES },
4104         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
4105                                 .len = NL80211_MAX_SUPP_HT_RATES },
4106         [NL80211_TXRATE_VHT] = {
4107                 .type = NLA_EXACT_LEN_WARN,
4108                 .len = sizeof(struct nl80211_txrate_vht),
4109         },
4110         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
4111 };
4112
4113 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
4114                                          struct cfg80211_bitrate_mask *mask)
4115 {
4116         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
4117         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4118         int rem, i;
4119         struct nlattr *tx_rates;
4120         struct ieee80211_supported_band *sband;
4121         u16 vht_tx_mcs_map;
4122
4123         memset(mask, 0, sizeof(*mask));
4124         /* Default to all rates enabled */
4125         for (i = 0; i < NUM_NL80211_BANDS; i++) {
4126                 sband = rdev->wiphy.bands[i];
4127
4128                 if (!sband)
4129                         continue;
4130
4131                 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
4132                 memcpy(mask->control[i].ht_mcs,
4133                        sband->ht_cap.mcs.rx_mask,
4134                        sizeof(mask->control[i].ht_mcs));
4135
4136                 if (!sband->vht_cap.vht_supported)
4137                         continue;
4138
4139                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4140                 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
4141         }
4142
4143         /* if no rates are given set it back to the defaults */
4144         if (!info->attrs[NL80211_ATTR_TX_RATES])
4145                 goto out;
4146
4147         /* The nested attribute uses enum nl80211_band as the index. This maps
4148          * directly to the enum nl80211_band values used in cfg80211.
4149          */
4150         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
4151         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
4152                 enum nl80211_band band = nla_type(tx_rates);
4153                 int err;
4154
4155                 if (band < 0 || band >= NUM_NL80211_BANDS)
4156                         return -EINVAL;
4157                 sband = rdev->wiphy.bands[band];
4158                 if (sband == NULL)
4159                         return -EINVAL;
4160                 err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX,
4161                                                   tx_rates,
4162                                                   nl80211_txattr_policy,
4163                                                   info->extack);
4164                 if (err)
4165                         return err;
4166                 if (tb[NL80211_TXRATE_LEGACY]) {
4167                         mask->control[band].legacy = rateset_to_mask(
4168                                 sband,
4169                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
4170                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
4171                         if ((mask->control[band].legacy == 0) &&
4172                             nla_len(tb[NL80211_TXRATE_LEGACY]))
4173                                 return -EINVAL;
4174                 }
4175                 if (tb[NL80211_TXRATE_HT]) {
4176                         if (!ht_rateset_to_mask(
4177                                         sband,
4178                                         nla_data(tb[NL80211_TXRATE_HT]),
4179                                         nla_len(tb[NL80211_TXRATE_HT]),
4180                                         mask->control[band].ht_mcs))
4181                                 return -EINVAL;
4182                 }
4183                 if (tb[NL80211_TXRATE_VHT]) {
4184                         if (!vht_set_mcs_mask(
4185                                         sband,
4186                                         nla_data(tb[NL80211_TXRATE_VHT]),
4187                                         mask->control[band].vht_mcs))
4188                                 return -EINVAL;
4189                 }
4190                 if (tb[NL80211_TXRATE_GI]) {
4191                         mask->control[band].gi =
4192                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
4193                         if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
4194                                 return -EINVAL;
4195                 }
4196
4197                 if (mask->control[band].legacy == 0) {
4198                         /* don't allow empty legacy rates if HT or VHT
4199                          * are not even supported.
4200                          */
4201                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
4202                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
4203                                 return -EINVAL;
4204
4205                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
4206                                 if (mask->control[band].ht_mcs[i])
4207                                         goto out;
4208
4209                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
4210                                 if (mask->control[band].vht_mcs[i])
4211                                         goto out;
4212
4213                         /* legacy and mcs rates may not be both empty */
4214                         return -EINVAL;
4215                 }
4216         }
4217
4218 out:
4219         return 0;
4220 }
4221
4222 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
4223                                    enum nl80211_band band,
4224                                    struct cfg80211_bitrate_mask *beacon_rate)
4225 {
4226         u32 count_ht, count_vht, i;
4227         u32 rate = beacon_rate->control[band].legacy;
4228
4229         /* Allow only one rate */
4230         if (hweight32(rate) > 1)
4231                 return -EINVAL;
4232
4233         count_ht = 0;
4234         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
4235                 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
4236                         return -EINVAL;
4237                 } else if (beacon_rate->control[band].ht_mcs[i]) {
4238                         count_ht++;
4239                         if (count_ht > 1)
4240                                 return -EINVAL;
4241                 }
4242                 if (count_ht && rate)
4243                         return -EINVAL;
4244         }
4245
4246         count_vht = 0;
4247         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
4248                 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
4249                         return -EINVAL;
4250                 } else if (beacon_rate->control[band].vht_mcs[i]) {
4251                         count_vht++;
4252                         if (count_vht > 1)
4253                                 return -EINVAL;
4254                 }
4255                 if (count_vht && rate)
4256                         return -EINVAL;
4257         }
4258
4259         if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht))
4260                 return -EINVAL;
4261
4262         if (rate &&
4263             !wiphy_ext_feature_isset(&rdev->wiphy,
4264                                      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
4265                 return -EINVAL;
4266         if (count_ht &&
4267             !wiphy_ext_feature_isset(&rdev->wiphy,
4268                                      NL80211_EXT_FEATURE_BEACON_RATE_HT))
4269                 return -EINVAL;
4270         if (count_vht &&
4271             !wiphy_ext_feature_isset(&rdev->wiphy,
4272                                      NL80211_EXT_FEATURE_BEACON_RATE_VHT))
4273                 return -EINVAL;
4274
4275         return 0;
4276 }
4277
4278 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
4279                                 struct nlattr *attrs[],
4280                                 struct cfg80211_beacon_data *bcn)
4281 {
4282         bool haveinfo = false;
4283         int err;
4284
4285         memset(bcn, 0, sizeof(*bcn));
4286
4287         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
4288                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
4289                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
4290                 if (!bcn->head_len)
4291                         return -EINVAL;
4292                 haveinfo = true;
4293         }
4294
4295         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
4296                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
4297                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
4298                 haveinfo = true;
4299         }
4300
4301         if (!haveinfo)
4302                 return -EINVAL;
4303
4304         if (attrs[NL80211_ATTR_IE]) {
4305                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
4306                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
4307         }
4308
4309         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
4310                 bcn->proberesp_ies =
4311                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4312                 bcn->proberesp_ies_len =
4313                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4314         }
4315
4316         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
4317                 bcn->assocresp_ies =
4318                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4319                 bcn->assocresp_ies_len =
4320                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4321         }
4322
4323         if (attrs[NL80211_ATTR_PROBE_RESP]) {
4324                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
4325                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
4326         }
4327
4328         if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
4329                 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
4330
4331                 err = nla_parse_nested_deprecated(tb,
4332                                                   NL80211_FTM_RESP_ATTR_MAX,
4333                                                   attrs[NL80211_ATTR_FTM_RESPONDER],
4334                                                   NULL, NULL);
4335                 if (err)
4336                         return err;
4337
4338                 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
4339                     wiphy_ext_feature_isset(&rdev->wiphy,
4340                                             NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
4341                         bcn->ftm_responder = 1;
4342                 else
4343                         return -EOPNOTSUPP;
4344
4345                 if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
4346                         bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
4347                         bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
4348                 }
4349
4350                 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
4351                         bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
4352                         bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
4353                 }
4354         } else {
4355                 bcn->ftm_responder = -1;
4356         }
4357
4358         return 0;
4359 }
4360
4361 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
4362                                             const u8 *rates)
4363 {
4364         int i;
4365
4366         if (!rates)
4367                 return;
4368
4369         for (i = 0; i < rates[1]; i++) {
4370                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
4371                         params->ht_required = true;
4372                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
4373                         params->vht_required = true;
4374         }
4375 }
4376
4377 /*
4378  * Since the nl80211 API didn't include, from the beginning, attributes about
4379  * HT/VHT requirements/capabilities, we parse them out of the IEs for the
4380  * benefit of drivers that rebuild IEs in the firmware.
4381  */
4382 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
4383 {
4384         const struct cfg80211_beacon_data *bcn = &params->beacon;
4385         size_t ies_len = bcn->tail_len;
4386         const u8 *ies = bcn->tail;
4387         const u8 *rates;
4388         const u8 *cap;
4389
4390         rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len);
4391         nl80211_check_ap_rate_selectors(params, rates);
4392
4393         rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
4394         nl80211_check_ap_rate_selectors(params, rates);
4395
4396         cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len);
4397         if (cap && cap[1] >= sizeof(*params->ht_cap))
4398                 params->ht_cap = (void *)(cap + 2);
4399         cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
4400         if (cap && cap[1] >= sizeof(*params->vht_cap))
4401                 params->vht_cap = (void *)(cap + 2);
4402         cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
4403         if (cap && cap[1] >= sizeof(*params->he_cap) + 1)
4404                 params->he_cap = (void *)(cap + 3);
4405 }
4406
4407 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
4408                                    struct cfg80211_ap_settings *params)
4409 {
4410         struct wireless_dev *wdev;
4411         bool ret = false;
4412
4413         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
4414                 if (wdev->iftype != NL80211_IFTYPE_AP &&
4415                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
4416                         continue;
4417
4418                 if (!wdev->preset_chandef.chan)
4419                         continue;
4420
4421                 params->chandef = wdev->preset_chandef;
4422                 ret = true;
4423                 break;
4424         }
4425
4426         return ret;
4427 }
4428
4429 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
4430                                     enum nl80211_auth_type auth_type,
4431                                     enum nl80211_commands cmd)
4432 {
4433         if (auth_type > NL80211_AUTHTYPE_MAX)
4434                 return false;
4435
4436         switch (cmd) {
4437         case NL80211_CMD_AUTHENTICATE:
4438                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
4439                     auth_type == NL80211_AUTHTYPE_SAE)
4440                         return false;
4441                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
4442                                              NL80211_EXT_FEATURE_FILS_STA) &&
4443                     (auth_type == NL80211_AUTHTYPE_FILS_SK ||
4444                      auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4445                      auth_type == NL80211_AUTHTYPE_FILS_PK))
4446                         return false;
4447                 return true;
4448         case NL80211_CMD_CONNECT:
4449                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
4450                     auth_type == NL80211_AUTHTYPE_SAE)
4451                         return false;
4452
4453                 /* FILS with SK PFS or PK not supported yet */
4454                 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4455                     auth_type == NL80211_AUTHTYPE_FILS_PK)
4456                         return false;
4457                 if (!wiphy_ext_feature_isset(
4458                             &rdev->wiphy,
4459                             NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
4460                     auth_type == NL80211_AUTHTYPE_FILS_SK)
4461                         return false;
4462                 return true;
4463         case NL80211_CMD_START_AP:
4464                 /* SAE not supported yet */
4465                 if (auth_type == NL80211_AUTHTYPE_SAE)
4466                         return false;
4467                 /* FILS not supported yet */
4468                 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
4469                     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4470                     auth_type == NL80211_AUTHTYPE_FILS_PK)
4471                         return false;
4472                 return true;
4473         default:
4474                 return false;
4475         }
4476 }
4477
4478 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
4479 {
4480         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4481         struct net_device *dev = info->user_ptr[1];
4482         struct wireless_dev *wdev = dev->ieee80211_ptr;
4483         struct cfg80211_ap_settings params;
4484         int err;
4485
4486         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4487             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4488                 return -EOPNOTSUPP;
4489
4490         if (!rdev->ops->start_ap)
4491                 return -EOPNOTSUPP;
4492
4493         if (wdev->beacon_interval)
4494                 return -EALREADY;
4495
4496         memset(&params, 0, sizeof(params));
4497
4498         /* these are required for START_AP */
4499         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
4500             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
4501             !info->attrs[NL80211_ATTR_BEACON_HEAD])
4502                 return -EINVAL;
4503
4504         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon);
4505         if (err)
4506                 return err;
4507
4508         params.beacon_interval =
4509                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
4510         params.dtim_period =
4511                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
4512
4513         err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
4514                                            params.beacon_interval);
4515         if (err)
4516                 return err;
4517
4518         /*
4519          * In theory, some of these attributes should be required here
4520          * but since they were not used when the command was originally
4521          * added, keep them optional for old user space programs to let
4522          * them continue to work with drivers that do not need the
4523          * additional information -- drivers must check!
4524          */
4525         if (info->attrs[NL80211_ATTR_SSID]) {
4526                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4527                 params.ssid_len =
4528                         nla_len(info->attrs[NL80211_ATTR_SSID]);
4529                 if (params.ssid_len == 0 ||
4530                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
4531                         return -EINVAL;
4532         }
4533
4534         if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
4535                 params.hidden_ssid = nla_get_u32(
4536                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
4537
4538         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
4539
4540         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4541                 params.auth_type = nla_get_u32(
4542                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
4543                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
4544                                              NL80211_CMD_START_AP))
4545                         return -EINVAL;
4546         } else
4547                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4548
4549         err = nl80211_crypto_settings(rdev, info, &params.crypto,
4550                                       NL80211_MAX_NR_CIPHER_SUITES);
4551         if (err)
4552                 return err;
4553
4554         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
4555                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
4556                         return -EOPNOTSUPP;
4557                 params.inactivity_timeout = nla_get_u16(
4558                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
4559         }
4560
4561         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4562                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4563                         return -EINVAL;
4564                 params.p2p_ctwindow =
4565                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4566                 if (params.p2p_ctwindow != 0 &&
4567                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4568                         return -EINVAL;
4569         }
4570
4571         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4572                 u8 tmp;
4573
4574                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4575                         return -EINVAL;
4576                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4577                 params.p2p_opp_ps = tmp;
4578                 if (params.p2p_opp_ps != 0 &&
4579                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4580                         return -EINVAL;
4581         }
4582
4583         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4584                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
4585                 if (err)
4586                         return err;
4587         } else if (wdev->preset_chandef.chan) {
4588                 params.chandef = wdev->preset_chandef;
4589         } else if (!nl80211_get_ap_channel(rdev, &params))
4590                 return -EINVAL;
4591
4592         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
4593                                            wdev->iftype))
4594                 return -EINVAL;
4595
4596         if (info->attrs[NL80211_ATTR_TX_RATES]) {
4597                 err = nl80211_parse_tx_bitrate_mask(info, &params.beacon_rate);
4598                 if (err)
4599                         return err;
4600
4601                 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
4602                                               &params.beacon_rate);
4603                 if (err)
4604                         return err;
4605         }
4606
4607         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
4608                 params.smps_mode =
4609                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
4610                 switch (params.smps_mode) {
4611                 case NL80211_SMPS_OFF:
4612                         break;
4613                 case NL80211_SMPS_STATIC:
4614                         if (!(rdev->wiphy.features &
4615                               NL80211_FEATURE_STATIC_SMPS))
4616                                 return -EINVAL;
4617                         break;
4618                 case NL80211_SMPS_DYNAMIC:
4619                         if (!(rdev->wiphy.features &
4620                               NL80211_FEATURE_DYNAMIC_SMPS))
4621                                 return -EINVAL;
4622                         break;
4623                 default:
4624                         return -EINVAL;
4625                 }
4626         } else {
4627                 params.smps_mode = NL80211_SMPS_OFF;
4628         }
4629
4630         params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
4631         if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
4632                 return -EOPNOTSUPP;
4633
4634         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
4635                 params.acl = parse_acl_data(&rdev->wiphy, info);
4636                 if (IS_ERR(params.acl))
4637                         return PTR_ERR(params.acl);
4638         }
4639
4640         nl80211_calculate_ap_params(&params);
4641
4642         if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
4643                 params.flags |= AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
4644
4645         wdev_lock(wdev);
4646         err = rdev_start_ap(rdev, dev, &params);
4647         if (!err) {
4648                 wdev->preset_chandef = params.chandef;
4649                 wdev->beacon_interval = params.beacon_interval;
4650                 wdev->chandef = params.chandef;
4651                 wdev->ssid_len = params.ssid_len;
4652                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
4653
4654                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4655                         wdev->conn_owner_nlportid = info->snd_portid;
4656         }
4657         wdev_unlock(wdev);
4658
4659         kfree(params.acl);
4660
4661         return err;
4662 }
4663
4664 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
4665 {
4666         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4667         struct net_device *dev = info->user_ptr[1];
4668         struct wireless_dev *wdev = dev->ieee80211_ptr;
4669         struct cfg80211_beacon_data params;
4670         int err;
4671
4672         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4673             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4674                 return -EOPNOTSUPP;
4675
4676         if (!rdev->ops->change_beacon)
4677                 return -EOPNOTSUPP;
4678
4679         if (!wdev->beacon_interval)
4680                 return -EINVAL;
4681
4682         err = nl80211_parse_beacon(rdev, info->attrs, &params);
4683         if (err)
4684                 return err;
4685
4686         wdev_lock(wdev);
4687         err = rdev_change_beacon(rdev, dev, &params);
4688         wdev_unlock(wdev);
4689
4690         return err;
4691 }
4692
4693 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
4694 {
4695         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4696         struct net_device *dev = info->user_ptr[1];
4697
4698         return cfg80211_stop_ap(rdev, dev, false);
4699 }
4700
4701 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
4702         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
4703         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
4704         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
4705         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
4706         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
4707         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
4708 };
4709
4710 static int parse_station_flags(struct genl_info *info,
4711                                enum nl80211_iftype iftype,
4712                                struct station_parameters *params)
4713 {
4714         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
4715         struct nlattr *nla;
4716         int flag;
4717
4718         /*
4719          * Try parsing the new attribute first so userspace
4720          * can specify both for older kernels.
4721          */
4722         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
4723         if (nla) {
4724                 struct nl80211_sta_flag_update *sta_flags;
4725
4726                 sta_flags = nla_data(nla);
4727                 params->sta_flags_mask = sta_flags->mask;
4728                 params->sta_flags_set = sta_flags->set;
4729                 params->sta_flags_set &= params->sta_flags_mask;
4730                 if ((params->sta_flags_mask |
4731                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
4732                         return -EINVAL;
4733                 return 0;
4734         }
4735
4736         /* if present, parse the old attribute */
4737
4738         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
4739         if (!nla)
4740                 return 0;
4741
4742         if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack))
4743                 return -EINVAL;
4744
4745         /*
4746          * Only allow certain flags for interface types so that
4747          * other attributes are silently ignored. Remember that
4748          * this is backward compatibility code with old userspace
4749          * and shouldn't be hit in other cases anyway.
4750          */
4751         switch (iftype) {
4752         case NL80211_IFTYPE_AP:
4753         case NL80211_IFTYPE_AP_VLAN:
4754         case NL80211_IFTYPE_P2P_GO:
4755                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4756                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4757                                          BIT(NL80211_STA_FLAG_WME) |
4758                                          BIT(NL80211_STA_FLAG_MFP);
4759                 break;
4760         case NL80211_IFTYPE_P2P_CLIENT:
4761         case NL80211_IFTYPE_STATION:
4762                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4763                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
4764                 break;
4765         case NL80211_IFTYPE_MESH_POINT:
4766                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4767                                          BIT(NL80211_STA_FLAG_MFP) |
4768                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
4769                 break;
4770         default:
4771                 return -EINVAL;
4772         }
4773
4774         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
4775                 if (flags[flag]) {
4776                         params->sta_flags_set |= (1<<flag);
4777
4778                         /* no longer support new API additions in old API */
4779                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
4780                                 return -EINVAL;
4781                 }
4782         }
4783
4784         return 0;
4785 }
4786
4787 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
4788 {
4789         struct nlattr *rate;
4790         u32 bitrate;
4791         u16 bitrate_compat;
4792         enum nl80211_rate_info rate_flg;
4793
4794         rate = nla_nest_start_noflag(msg, attr);
4795         if (!rate)
4796                 return false;
4797
4798         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
4799         bitrate = cfg80211_calculate_bitrate(info);
4800         /* report 16-bit bitrate only if we can */
4801         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
4802         if (bitrate > 0 &&
4803             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
4804                 return false;
4805         if (bitrate_compat > 0 &&
4806             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
4807                 return false;
4808
4809         switch (info->bw) {
4810         case RATE_INFO_BW_5:
4811                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
4812                 break;
4813         case RATE_INFO_BW_10:
4814                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
4815                 break;
4816         default:
4817                 WARN_ON(1);
4818                 /* fall through */
4819         case RATE_INFO_BW_20:
4820                 rate_flg = 0;
4821                 break;
4822         case RATE_INFO_BW_40:
4823                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
4824                 break;
4825         case RATE_INFO_BW_80:
4826                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
4827                 break;
4828         case RATE_INFO_BW_160:
4829                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
4830                 break;
4831         case RATE_INFO_BW_HE_RU:
4832                 rate_flg = 0;
4833                 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
4834         }
4835
4836         if (rate_flg && nla_put_flag(msg, rate_flg))
4837                 return false;
4838
4839         if (info->flags & RATE_INFO_FLAGS_MCS) {
4840                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
4841                         return false;
4842                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4843                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4844                         return false;
4845         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
4846                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
4847                         return false;
4848                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
4849                         return false;
4850                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4851                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4852                         return false;
4853         } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
4854                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
4855                         return false;
4856                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
4857                         return false;
4858                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
4859                         return false;
4860                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
4861                         return false;
4862                 if (info->bw == RATE_INFO_BW_HE_RU &&
4863                     nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
4864                                info->he_ru_alloc))
4865                         return false;
4866         }
4867
4868         nla_nest_end(msg, rate);
4869         return true;
4870 }
4871
4872 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
4873                                int id)
4874 {
4875         void *attr;
4876         int i = 0;
4877
4878         if (!mask)
4879                 return true;
4880
4881         attr = nla_nest_start_noflag(msg, id);
4882         if (!attr)
4883                 return false;
4884
4885         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
4886                 if (!(mask & BIT(i)))
4887                         continue;
4888
4889                 if (nla_put_u8(msg, i, signal[i]))
4890                         return false;
4891         }
4892
4893         nla_nest_end(msg, attr);
4894
4895         return true;
4896 }
4897
4898 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
4899                                 u32 seq, int flags,
4900                                 struct cfg80211_registered_device *rdev,
4901                                 struct net_device *dev,
4902                                 const u8 *mac_addr, struct station_info *sinfo)
4903 {
4904         void *hdr;
4905         struct nlattr *sinfoattr, *bss_param;
4906
4907         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
4908         if (!hdr) {
4909                 cfg80211_sinfo_release_content(sinfo);
4910                 return -1;
4911         }
4912
4913         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4914             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
4915             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
4916                 goto nla_put_failure;
4917
4918         sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
4919         if (!sinfoattr)
4920                 goto nla_put_failure;
4921
4922 #define PUT_SINFO(attr, memb, type) do {                                \
4923         BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
4924         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
4925             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
4926                              sinfo->memb))                              \
4927                 goto nla_put_failure;                                   \
4928         } while (0)
4929 #define PUT_SINFO_U64(attr, memb) do {                                  \
4930         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
4931             nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
4932                               sinfo->memb, NL80211_STA_INFO_PAD))       \
4933                 goto nla_put_failure;                                   \
4934         } while (0)
4935
4936         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
4937         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
4938
4939         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
4940                              BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
4941             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
4942                         (u32)sinfo->rx_bytes))
4943                 goto nla_put_failure;
4944
4945         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
4946                              BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
4947             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
4948                         (u32)sinfo->tx_bytes))
4949                 goto nla_put_failure;
4950
4951         PUT_SINFO_U64(RX_BYTES64, rx_bytes);
4952         PUT_SINFO_U64(TX_BYTES64, tx_bytes);
4953         PUT_SINFO(LLID, llid, u16);
4954         PUT_SINFO(PLID, plid, u16);
4955         PUT_SINFO(PLINK_STATE, plink_state, u8);
4956         PUT_SINFO_U64(RX_DURATION, rx_duration);
4957         PUT_SINFO_U64(TX_DURATION, tx_duration);
4958
4959         if (wiphy_ext_feature_isset(&rdev->wiphy,
4960                                     NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
4961                 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
4962
4963         switch (rdev->wiphy.signal_type) {
4964         case CFG80211_SIGNAL_TYPE_MBM:
4965                 PUT_SINFO(SIGNAL, signal, u8);
4966                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
4967                 break;
4968         default:
4969                 break;
4970         }
4971         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
4972                 if (!nl80211_put_signal(msg, sinfo->chains,
4973                                         sinfo->chain_signal,
4974                                         NL80211_STA_INFO_CHAIN_SIGNAL))
4975                         goto nla_put_failure;
4976         }
4977         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
4978                 if (!nl80211_put_signal(msg, sinfo->chains,
4979                                         sinfo->chain_signal_avg,
4980                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
4981                         goto nla_put_failure;
4982         }
4983         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
4984                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
4985                                           NL80211_STA_INFO_TX_BITRATE))
4986                         goto nla_put_failure;
4987         }
4988         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
4989                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
4990                                           NL80211_STA_INFO_RX_BITRATE))
4991                         goto nla_put_failure;
4992         }
4993
4994         PUT_SINFO(RX_PACKETS, rx_packets, u32);
4995         PUT_SINFO(TX_PACKETS, tx_packets, u32);
4996         PUT_SINFO(TX_RETRIES, tx_retries, u32);
4997         PUT_SINFO(TX_FAILED, tx_failed, u32);
4998         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
4999         PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32);
5000         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
5001         PUT_SINFO(LOCAL_PM, local_pm, u32);
5002         PUT_SINFO(PEER_PM, peer_pm, u32);
5003         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
5004         PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8);
5005
5006         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
5007                 bss_param = nla_nest_start_noflag(msg,
5008                                                   NL80211_STA_INFO_BSS_PARAM);
5009                 if (!bss_param)
5010                         goto nla_put_failure;
5011
5012                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
5013                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
5014                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
5015                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
5016                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
5017                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
5018                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
5019                                sinfo->bss_param.dtim_period) ||
5020                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
5021                                 sinfo->bss_param.beacon_interval))
5022                         goto nla_put_failure;
5023
5024                 nla_nest_end(msg, bss_param);
5025         }
5026         if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
5027             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
5028                     sizeof(struct nl80211_sta_flag_update),
5029                     &sinfo->sta_flags))
5030                 goto nla_put_failure;
5031
5032         PUT_SINFO_U64(T_OFFSET, t_offset);
5033         PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
5034         PUT_SINFO_U64(BEACON_RX, rx_beacon);
5035         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
5036         PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
5037         PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
5038         if (wiphy_ext_feature_isset(&rdev->wiphy,
5039                                     NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
5040                 PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
5041                 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
5042         }
5043
5044 #undef PUT_SINFO
5045 #undef PUT_SINFO_U64
5046
5047         if (sinfo->pertid) {
5048                 struct nlattr *tidsattr;
5049                 int tid;
5050
5051                 tidsattr = nla_nest_start_noflag(msg,
5052                                                  NL80211_STA_INFO_TID_STATS);
5053                 if (!tidsattr)
5054                         goto nla_put_failure;
5055
5056                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
5057                         struct cfg80211_tid_stats *tidstats;
5058                         struct nlattr *tidattr;
5059
5060                         tidstats = &sinfo->pertid[tid];
5061
5062                         if (!tidstats->filled)
5063                                 continue;
5064
5065                         tidattr = nla_nest_start_noflag(msg, tid + 1);
5066                         if (!tidattr)
5067                                 goto nla_put_failure;
5068
5069 #define PUT_TIDVAL_U64(attr, memb) do {                                 \
5070         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
5071             nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,          \
5072                               tidstats->memb, NL80211_TID_STATS_PAD))   \
5073                 goto nla_put_failure;                                   \
5074         } while (0)
5075
5076                         PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
5077                         PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
5078                         PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
5079                         PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
5080
5081 #undef PUT_TIDVAL_U64
5082                         if ((tidstats->filled &
5083                              BIT(NL80211_TID_STATS_TXQ_STATS)) &&
5084                             !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
5085                                                    NL80211_TID_STATS_TXQ_STATS))
5086                                 goto nla_put_failure;
5087
5088                         nla_nest_end(msg, tidattr);
5089                 }
5090
5091                 nla_nest_end(msg, tidsattr);
5092         }
5093
5094         nla_nest_end(msg, sinfoattr);
5095
5096         if (sinfo->assoc_req_ies_len &&
5097             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
5098                     sinfo->assoc_req_ies))
5099                 goto nla_put_failure;
5100
5101         cfg80211_sinfo_release_content(sinfo);
5102         genlmsg_end(msg, hdr);
5103         return 0;
5104
5105  nla_put_failure:
5106         cfg80211_sinfo_release_content(sinfo);
5107         genlmsg_cancel(msg, hdr);
5108         return -EMSGSIZE;
5109 }
5110
5111 static int nl80211_dump_station(struct sk_buff *skb,
5112                                 struct netlink_callback *cb)
5113 {
5114         struct station_info sinfo;
5115         struct cfg80211_registered_device *rdev;
5116         struct wireless_dev *wdev;
5117         u8 mac_addr[ETH_ALEN];
5118         int sta_idx = cb->args[2];
5119         int err;
5120
5121         rtnl_lock();
5122         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
5123         if (err)
5124                 goto out_err;
5125
5126         if (!wdev->netdev) {
5127                 err = -EINVAL;
5128                 goto out_err;
5129         }
5130
5131         if (!rdev->ops->dump_station) {
5132                 err = -EOPNOTSUPP;
5133                 goto out_err;
5134         }
5135
5136         while (1) {
5137                 memset(&sinfo, 0, sizeof(sinfo));
5138                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
5139                                         mac_addr, &sinfo);
5140                 if (err == -ENOENT)
5141                         break;
5142                 if (err)
5143                         goto out_err;
5144
5145                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
5146                                 NETLINK_CB(cb->skb).portid,
5147                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5148                                 rdev, wdev->netdev, mac_addr,
5149                                 &sinfo) < 0)
5150                         goto out;
5151
5152                 sta_idx++;
5153         }
5154
5155  out:
5156         cb->args[2] = sta_idx;
5157         err = skb->len;
5158  out_err:
5159         rtnl_unlock();
5160
5161         return err;
5162 }
5163
5164 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
5165 {
5166         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5167         struct net_device *dev = info->user_ptr[1];
5168         struct station_info sinfo;
5169         struct sk_buff *msg;
5170         u8 *mac_addr = NULL;
5171         int err;
5172
5173         memset(&sinfo, 0, sizeof(sinfo));
5174
5175         if (!info->attrs[NL80211_ATTR_MAC])
5176                 return -EINVAL;
5177
5178         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5179
5180         if (!rdev->ops->get_station)
5181                 return -EOPNOTSUPP;
5182
5183         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
5184         if (err)
5185                 return err;
5186
5187         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5188         if (!msg) {
5189                 cfg80211_sinfo_release_content(&sinfo);
5190                 return -ENOMEM;
5191         }
5192
5193         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
5194                                  info->snd_portid, info->snd_seq, 0,
5195                                  rdev, dev, mac_addr, &sinfo) < 0) {
5196                 nlmsg_free(msg);
5197                 return -ENOBUFS;
5198         }
5199
5200         return genlmsg_reply(msg, info);
5201 }
5202
5203 int cfg80211_check_station_change(struct wiphy *wiphy,
5204                                   struct station_parameters *params,
5205                                   enum cfg80211_station_type statype)
5206 {
5207         if (params->listen_interval != -1 &&
5208             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
5209                 return -EINVAL;
5210
5211         if (params->support_p2p_ps != -1 &&
5212             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
5213                 return -EINVAL;
5214
5215         if (params->aid &&
5216             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
5217             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
5218                 return -EINVAL;
5219
5220         /* When you run into this, adjust the code below for the new flag */
5221         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
5222
5223         switch (statype) {
5224         case CFG80211_STA_MESH_PEER_KERNEL:
5225         case CFG80211_STA_MESH_PEER_USER:
5226                 /*
5227                  * No ignoring the TDLS flag here -- the userspace mesh
5228                  * code doesn't have the bug of including TDLS in the
5229                  * mask everywhere.
5230                  */
5231                 if (params->sta_flags_mask &
5232                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5233                                   BIT(NL80211_STA_FLAG_MFP) |
5234                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
5235                         return -EINVAL;
5236                 break;
5237         case CFG80211_STA_TDLS_PEER_SETUP:
5238         case CFG80211_STA_TDLS_PEER_ACTIVE:
5239                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
5240                         return -EINVAL;
5241                 /* ignore since it can't change */
5242                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5243                 break;
5244         default:
5245                 /* disallow mesh-specific things */
5246                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
5247                         return -EINVAL;
5248                 if (params->local_pm)
5249                         return -EINVAL;
5250                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
5251                         return -EINVAL;
5252         }
5253
5254         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
5255             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
5256                 /* TDLS can't be set, ... */
5257                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
5258                         return -EINVAL;
5259                 /*
5260                  * ... but don't bother the driver with it. This works around
5261                  * a hostapd/wpa_supplicant issue -- it always includes the
5262                  * TLDS_PEER flag in the mask even for AP mode.
5263                  */
5264                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5265         }
5266
5267         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
5268             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
5269                 /* reject other things that can't change */
5270                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
5271                         return -EINVAL;
5272                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
5273                         return -EINVAL;
5274                 if (params->supported_rates)
5275                         return -EINVAL;
5276                 if (params->ext_capab || params->ht_capa || params->vht_capa ||
5277                     params->he_capa)
5278                         return -EINVAL;
5279         }
5280
5281         if (statype != CFG80211_STA_AP_CLIENT &&
5282             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
5283                 if (params->vlan)
5284                         return -EINVAL;
5285         }
5286
5287         switch (statype) {
5288         case CFG80211_STA_AP_MLME_CLIENT:
5289                 /* Use this only for authorizing/unauthorizing a station */
5290                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
5291                         return -EOPNOTSUPP;
5292                 break;
5293         case CFG80211_STA_AP_CLIENT:
5294         case CFG80211_STA_AP_CLIENT_UNASSOC:
5295                 /* accept only the listed bits */
5296                 if (params->sta_flags_mask &
5297                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
5298                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5299                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
5300                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
5301                                   BIT(NL80211_STA_FLAG_WME) |
5302                                   BIT(NL80211_STA_FLAG_MFP)))
5303                         return -EINVAL;
5304
5305                 /* but authenticated/associated only if driver handles it */
5306                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5307                     params->sta_flags_mask &
5308                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5309                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
5310                         return -EINVAL;
5311                 break;
5312         case CFG80211_STA_IBSS:
5313         case CFG80211_STA_AP_STA:
5314                 /* reject any changes other than AUTHORIZED */
5315                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
5316                         return -EINVAL;
5317                 break;
5318         case CFG80211_STA_TDLS_PEER_SETUP:
5319                 /* reject any changes other than AUTHORIZED or WME */
5320                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
5321                                                BIT(NL80211_STA_FLAG_WME)))
5322                         return -EINVAL;
5323                 /* force (at least) rates when authorizing */
5324                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
5325                     !params->supported_rates)
5326                         return -EINVAL;
5327                 break;
5328         case CFG80211_STA_TDLS_PEER_ACTIVE:
5329                 /* reject any changes */
5330                 return -EINVAL;
5331         case CFG80211_STA_MESH_PEER_KERNEL:
5332                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
5333                         return -EINVAL;
5334                 break;
5335         case CFG80211_STA_MESH_PEER_USER:
5336                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
5337                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
5338                         return -EINVAL;
5339                 break;
5340         }
5341
5342         /*
5343          * Older kernel versions ignored this attribute entirely, so don't
5344          * reject attempts to update it but mark it as unused instead so the
5345          * driver won't look at the data.
5346          */
5347         if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
5348             statype != CFG80211_STA_TDLS_PEER_SETUP)
5349                 params->opmode_notif_used = false;
5350
5351         return 0;
5352 }
5353 EXPORT_SYMBOL(cfg80211_check_station_change);
5354
5355 /*
5356  * Get vlan interface making sure it is running and on the right wiphy.
5357  */
5358 static struct net_device *get_vlan(struct genl_info *info,
5359                                    struct cfg80211_registered_device *rdev)
5360 {
5361         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
5362         struct net_device *v;
5363         int ret;
5364
5365         if (!vlanattr)
5366                 return NULL;
5367
5368         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
5369         if (!v)
5370                 return ERR_PTR(-ENODEV);
5371
5372         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
5373                 ret = -EINVAL;
5374                 goto error;
5375         }
5376
5377         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5378             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5379             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
5380                 ret = -EINVAL;
5381                 goto error;
5382         }
5383
5384         if (!netif_running(v)) {
5385                 ret = -ENETDOWN;
5386                 goto error;
5387         }
5388
5389         return v;
5390  error:
5391         dev_put(v);
5392         return ERR_PTR(ret);
5393 }
5394
5395 static const struct nla_policy
5396 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
5397         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
5398         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
5399 };
5400
5401 static int nl80211_parse_sta_wme(struct genl_info *info,
5402                                  struct station_parameters *params)
5403 {
5404         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
5405         struct nlattr *nla;
5406         int err;
5407
5408         /* parse WME attributes if present */
5409         if (!info->attrs[NL80211_ATTR_STA_WME])
5410                 return 0;
5411
5412         nla = info->attrs[NL80211_ATTR_STA_WME];
5413         err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla,
5414                                           nl80211_sta_wme_policy,
5415                                           info->extack);
5416         if (err)
5417                 return err;
5418
5419         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
5420                 params->uapsd_queues = nla_get_u8(
5421                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
5422         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
5423                 return -EINVAL;
5424
5425         if (tb[NL80211_STA_WME_MAX_SP])
5426                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
5427
5428         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
5429                 return -EINVAL;
5430
5431         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
5432
5433         return 0;
5434 }
5435
5436 static int nl80211_parse_sta_channel_info(struct genl_info *info,
5437                                       struct station_parameters *params)
5438 {
5439         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
5440                 params->supported_channels =
5441                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
5442                 params->supported_channels_len =
5443                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
5444                 /*
5445                  * Need to include at least one (first channel, number of
5446                  * channels) tuple for each subband, and must have proper
5447                  * tuples for the rest of the data as well.
5448                  */
5449                 if (params->supported_channels_len < 2)
5450                         return -EINVAL;
5451                 if (params->supported_channels_len % 2)
5452                         return -EINVAL;
5453         }
5454
5455         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
5456                 params->supported_oper_classes =
5457                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
5458                 params->supported_oper_classes_len =
5459                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
5460                 /*
5461                  * The value of the Length field of the Supported Operating
5462                  * Classes element is between 2 and 253.
5463                  */
5464                 if (params->supported_oper_classes_len < 2 ||
5465                     params->supported_oper_classes_len > 253)
5466                         return -EINVAL;
5467         }
5468         return 0;
5469 }
5470
5471 static int nl80211_set_station_tdls(struct genl_info *info,
5472                                     struct station_parameters *params)
5473 {
5474         int err;
5475         /* Dummy STA entry gets updated once the peer capabilities are known */
5476         if (info->attrs[NL80211_ATTR_PEER_AID])
5477                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5478         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5479                 params->ht_capa =
5480                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5481         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5482                 params->vht_capa =
5483                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5484         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
5485                 params->he_capa =
5486                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5487                 params->he_capa_len =
5488                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5489
5490                 if (params->he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN)
5491                         return -EINVAL;
5492         }
5493
5494         err = nl80211_parse_sta_channel_info(info, params);
5495         if (err)
5496                 return err;
5497
5498         return nl80211_parse_sta_wme(info, params);
5499 }
5500
5501 static int nl80211_parse_sta_txpower_setting(struct genl_info *info,
5502                                              struct station_parameters *params)
5503 {
5504         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5505         int idx;
5506
5507         if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) {
5508                 if (!rdev->ops->set_tx_power ||
5509                     !wiphy_ext_feature_isset(&rdev->wiphy,
5510                                          NL80211_EXT_FEATURE_STA_TX_PWR))
5511                         return -EOPNOTSUPP;
5512
5513                 idx = NL80211_ATTR_STA_TX_POWER_SETTING;
5514                 params->txpwr.type = nla_get_u8(info->attrs[idx]);
5515
5516                 if (params->txpwr.type == NL80211_TX_POWER_LIMITED) {
5517                         idx = NL80211_ATTR_STA_TX_POWER;
5518
5519                         if (info->attrs[idx])
5520                                 params->txpwr.power =
5521                                         nla_get_s16(info->attrs[idx]);
5522                         else
5523                                 return -EINVAL;
5524                 }
5525                 params->sta_modify_mask |= STATION_PARAM_APPLY_STA_TXPOWER;
5526         }
5527
5528         return 0;
5529 }
5530
5531 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
5532 {
5533         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5534         struct net_device *dev = info->user_ptr[1];
5535         struct station_parameters params;
5536         u8 *mac_addr;
5537         int err;
5538
5539         memset(&params, 0, sizeof(params));
5540
5541         if (!rdev->ops->change_station)
5542                 return -EOPNOTSUPP;
5543
5544         /*
5545          * AID and listen_interval properties can be set only for unassociated
5546          * station. Include these parameters here and will check them in
5547          * cfg80211_check_station_change().
5548          */
5549         if (info->attrs[NL80211_ATTR_STA_AID])
5550                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5551
5552         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5553                 params.listen_interval =
5554                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5555         else
5556                 params.listen_interval = -1;
5557
5558         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
5559                 params.support_p2p_ps =
5560                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5561         else
5562                 params.support_p2p_ps = -1;
5563
5564         if (!info->attrs[NL80211_ATTR_MAC])
5565                 return -EINVAL;
5566
5567         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5568
5569         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
5570                 params.supported_rates =
5571                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5572                 params.supported_rates_len =
5573                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5574         }
5575
5576         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5577                 params.capability =
5578                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5579                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5580         }
5581
5582         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5583                 params.ext_capab =
5584                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5585                 params.ext_capab_len =
5586                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5587         }
5588
5589         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5590                 return -EINVAL;
5591
5592         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
5593                 params.plink_action =
5594                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5595
5596         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
5597                 params.plink_state =
5598                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
5599                 if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
5600                         params.peer_aid = nla_get_u16(
5601                                 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
5602                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
5603         }
5604
5605         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
5606                 params.local_pm = nla_get_u32(
5607                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
5608
5609         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5610                 params.opmode_notif_used = true;
5611                 params.opmode_notif =
5612                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5613         }
5614
5615         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
5616                 params.airtime_weight =
5617                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
5618
5619         if (params.airtime_weight &&
5620             !wiphy_ext_feature_isset(&rdev->wiphy,
5621                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
5622                 return -EOPNOTSUPP;
5623
5624         err = nl80211_parse_sta_txpower_setting(info, &params);
5625         if (err)
5626                 return err;
5627
5628         /* Include parameters for TDLS peer (will check later) */
5629         err = nl80211_set_station_tdls(info, &params);
5630         if (err)
5631                 return err;
5632
5633         params.vlan = get_vlan(info, rdev);
5634         if (IS_ERR(params.vlan))
5635                 return PTR_ERR(params.vlan);
5636
5637         switch (dev->ieee80211_ptr->iftype) {
5638         case NL80211_IFTYPE_AP:
5639         case NL80211_IFTYPE_AP_VLAN:
5640         case NL80211_IFTYPE_P2P_GO:
5641         case NL80211_IFTYPE_P2P_CLIENT:
5642         case NL80211_IFTYPE_STATION:
5643         case NL80211_IFTYPE_ADHOC:
5644         case NL80211_IFTYPE_MESH_POINT:
5645                 break;
5646         default:
5647                 err = -EOPNOTSUPP;
5648                 goto out_put_vlan;
5649         }
5650
5651         /* driver will call cfg80211_check_station_change() */
5652         err = rdev_change_station(rdev, dev, mac_addr, &params);
5653
5654  out_put_vlan:
5655         if (params.vlan)
5656                 dev_put(params.vlan);
5657
5658         return err;
5659 }
5660
5661 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
5662 {
5663         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5664         int err;
5665         struct net_device *dev = info->user_ptr[1];
5666         struct station_parameters params;
5667         u8 *mac_addr = NULL;
5668         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5669                          BIT(NL80211_STA_FLAG_ASSOCIATED);
5670
5671         memset(&params, 0, sizeof(params));
5672
5673         if (!rdev->ops->add_station)
5674                 return -EOPNOTSUPP;
5675
5676         if (!info->attrs[NL80211_ATTR_MAC])
5677                 return -EINVAL;
5678
5679         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5680                 return -EINVAL;
5681
5682         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
5683                 return -EINVAL;
5684
5685         if (!info->attrs[NL80211_ATTR_STA_AID] &&
5686             !info->attrs[NL80211_ATTR_PEER_AID])
5687                 return -EINVAL;
5688
5689         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5690         params.supported_rates =
5691                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5692         params.supported_rates_len =
5693                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5694         params.listen_interval =
5695                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5696
5697         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
5698                 params.support_p2p_ps =
5699                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5700         } else {
5701                 /*
5702                  * if not specified, assume it's supported for P2P GO interface,
5703                  * and is NOT supported for AP interface
5704                  */
5705                 params.support_p2p_ps =
5706                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
5707         }
5708
5709         if (info->attrs[NL80211_ATTR_PEER_AID])
5710                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5711         else
5712                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5713
5714         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5715                 params.capability =
5716                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5717                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5718         }
5719
5720         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5721                 params.ext_capab =
5722                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5723                 params.ext_capab_len =
5724                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5725         }
5726
5727         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5728                 params.ht_capa =
5729                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5730
5731         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5732                 params.vht_capa =
5733                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5734
5735         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
5736                 params.he_capa =
5737                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5738                 params.he_capa_len =
5739                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5740
5741                 /* max len is validated in nla policy */
5742                 if (params.he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN)
5743                         return -EINVAL;
5744         }
5745
5746         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5747                 params.opmode_notif_used = true;
5748                 params.opmode_notif =
5749                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5750         }
5751
5752         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
5753                 params.plink_action =
5754                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5755
5756         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
5757                 params.airtime_weight =
5758                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
5759
5760         if (params.airtime_weight &&
5761             !wiphy_ext_feature_isset(&rdev->wiphy,
5762                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
5763                 return -EOPNOTSUPP;
5764
5765         err = nl80211_parse_sta_txpower_setting(info, &params);
5766         if (err)
5767                 return err;
5768
5769         err = nl80211_parse_sta_channel_info(info, &params);
5770         if (err)
5771                 return err;
5772
5773         err = nl80211_parse_sta_wme(info, &params);
5774         if (err)
5775                 return err;
5776
5777         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5778                 return -EINVAL;
5779
5780         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
5781          * as userspace might just pass through the capabilities from the IEs
5782          * directly, rather than enforcing this restriction and returning an
5783          * error in this case.
5784          */
5785         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
5786                 params.ht_capa = NULL;
5787                 params.vht_capa = NULL;
5788
5789                 /* HE requires WME */
5790                 if (params.he_capa_len)
5791                         return -EINVAL;
5792         }
5793
5794         /* When you run into this, adjust the code below for the new flag */
5795         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
5796
5797         switch (dev->ieee80211_ptr->iftype) {
5798         case NL80211_IFTYPE_AP:
5799         case NL80211_IFTYPE_AP_VLAN:
5800         case NL80211_IFTYPE_P2P_GO:
5801                 /* ignore WME attributes if iface/sta is not capable */
5802                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
5803                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
5804                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5805
5806                 /* TDLS peers cannot be added */
5807                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5808                     info->attrs[NL80211_ATTR_PEER_AID])
5809                         return -EINVAL;
5810                 /* but don't bother the driver with it */
5811                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5812
5813                 /* allow authenticated/associated only if driver handles it */
5814                 if (!(rdev->wiphy.features &
5815                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5816                     params.sta_flags_mask & auth_assoc)
5817                         return -EINVAL;
5818
5819                 /* Older userspace, or userspace wanting to be compatible with
5820                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
5821                  * and assoc flags in the mask, but assumes the station will be
5822                  * added as associated anyway since this was the required driver
5823                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
5824                  * introduced.
5825                  * In order to not bother drivers with this quirk in the API
5826                  * set the flags in both the mask and set for new stations in
5827                  * this case.
5828                  */
5829                 if (!(params.sta_flags_mask & auth_assoc)) {
5830                         params.sta_flags_mask |= auth_assoc;
5831                         params.sta_flags_set |= auth_assoc;
5832                 }
5833
5834                 /* must be last in here for error handling */
5835                 params.vlan = get_vlan(info, rdev);
5836                 if (IS_ERR(params.vlan))
5837                         return PTR_ERR(params.vlan);
5838                 break;
5839         case NL80211_IFTYPE_MESH_POINT:
5840                 /* ignore uAPSD data */
5841                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5842
5843                 /* associated is disallowed */
5844                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
5845                         return -EINVAL;
5846                 /* TDLS peers cannot be added */
5847                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5848                     info->attrs[NL80211_ATTR_PEER_AID])
5849                         return -EINVAL;
5850                 break;
5851         case NL80211_IFTYPE_STATION:
5852         case NL80211_IFTYPE_P2P_CLIENT:
5853                 /* ignore uAPSD data */
5854                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5855
5856                 /* these are disallowed */
5857                 if (params.sta_flags_mask &
5858                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
5859                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
5860                         return -EINVAL;
5861                 /* Only TDLS peers can be added */
5862                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
5863                         return -EINVAL;
5864                 /* Can only add if TDLS ... */
5865                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
5866                         return -EOPNOTSUPP;
5867                 /* ... with external setup is supported */
5868                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
5869                         return -EOPNOTSUPP;
5870                 /*
5871                  * Older wpa_supplicant versions always mark the TDLS peer
5872                  * as authorized, but it shouldn't yet be.
5873                  */
5874                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
5875                 break;
5876         default:
5877                 return -EOPNOTSUPP;
5878         }
5879
5880         /* be aware of params.vlan when changing code here */
5881
5882         err = rdev_add_station(rdev, dev, mac_addr, &params);
5883
5884         if (params.vlan)
5885                 dev_put(params.vlan);
5886         return err;
5887 }
5888
5889 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
5890 {
5891         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5892         struct net_device *dev = info->user_ptr[1];
5893         struct station_del_parameters params;
5894
5895         memset(&params, 0, sizeof(params));
5896
5897         if (info->attrs[NL80211_ATTR_MAC])
5898                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
5899
5900         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5901             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5902             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5903             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5904                 return -EINVAL;
5905
5906         if (!rdev->ops->del_station)
5907                 return -EOPNOTSUPP;
5908
5909         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
5910                 params.subtype =
5911                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
5912                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
5913                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
5914                         return -EINVAL;
5915         } else {
5916                 /* Default to Deauthentication frame */
5917                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
5918         }
5919
5920         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
5921                 params.reason_code =
5922                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5923                 if (params.reason_code == 0)
5924                         return -EINVAL; /* 0 is reserved */
5925         } else {
5926                 /* Default to reason code 2 */
5927                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
5928         }
5929
5930         return rdev_del_station(rdev, dev, &params);
5931 }
5932
5933 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
5934                                 int flags, struct net_device *dev,
5935                                 u8 *dst, u8 *next_hop,
5936                                 struct mpath_info *pinfo)
5937 {
5938         void *hdr;
5939         struct nlattr *pinfoattr;
5940
5941         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
5942         if (!hdr)
5943                 return -1;
5944
5945         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5946             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
5947             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
5948             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
5949                 goto nla_put_failure;
5950
5951         pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO);
5952         if (!pinfoattr)
5953                 goto nla_put_failure;
5954         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
5955             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
5956                         pinfo->frame_qlen))
5957                 goto nla_put_failure;
5958         if (((pinfo->filled & MPATH_INFO_SN) &&
5959              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
5960             ((pinfo->filled & MPATH_INFO_METRIC) &&
5961              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
5962                          pinfo->metric)) ||
5963             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
5964              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
5965                          pinfo->exptime)) ||
5966             ((pinfo->filled & MPATH_INFO_FLAGS) &&
5967              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
5968                         pinfo->flags)) ||
5969             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
5970              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
5971                          pinfo->discovery_timeout)) ||
5972             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
5973              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
5974                         pinfo->discovery_retries)) ||
5975             ((pinfo->filled & MPATH_INFO_HOP_COUNT) &&
5976              nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT,
5977                         pinfo->hop_count)) ||
5978             ((pinfo->filled & MPATH_INFO_PATH_CHANGE) &&
5979              nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE,
5980                          pinfo->path_change_count)))
5981                 goto nla_put_failure;
5982
5983         nla_nest_end(msg, pinfoattr);
5984
5985         genlmsg_end(msg, hdr);
5986         return 0;
5987
5988  nla_put_failure:
5989         genlmsg_cancel(msg, hdr);
5990         return -EMSGSIZE;
5991 }
5992
5993 static int nl80211_dump_mpath(struct sk_buff *skb,
5994                               struct netlink_callback *cb)
5995 {
5996         struct mpath_info pinfo;
5997         struct cfg80211_registered_device *rdev;
5998         struct wireless_dev *wdev;
5999         u8 dst[ETH_ALEN];
6000         u8 next_hop[ETH_ALEN];
6001         int path_idx = cb->args[2];
6002         int err;
6003
6004         rtnl_lock();
6005         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
6006         if (err)
6007                 goto out_err;
6008
6009         if (!rdev->ops->dump_mpath) {
6010                 err = -EOPNOTSUPP;
6011                 goto out_err;
6012         }
6013
6014         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
6015                 err = -EOPNOTSUPP;
6016                 goto out_err;
6017         }
6018
6019         while (1) {
6020                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
6021                                       next_hop, &pinfo);
6022                 if (err == -ENOENT)
6023                         break;
6024                 if (err)
6025                         goto out_err;
6026
6027                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
6028                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
6029                                        wdev->netdev, dst, next_hop,
6030                                        &pinfo) < 0)
6031                         goto out;
6032
6033                 path_idx++;
6034         }
6035
6036  out:
6037         cb->args[2] = path_idx;
6038         err = skb->len;
6039  out_err:
6040         rtnl_unlock();
6041         return err;
6042 }
6043
6044 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
6045 {
6046         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6047         int err;
6048         struct net_device *dev = info->user_ptr[1];
6049         struct mpath_info pinfo;
6050         struct sk_buff *msg;
6051         u8 *dst = NULL;
6052         u8 next_hop[ETH_ALEN];
6053
6054         memset(&pinfo, 0, sizeof(pinfo));
6055
6056         if (!info->attrs[NL80211_ATTR_MAC])
6057                 return -EINVAL;
6058
6059         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6060
6061         if (!rdev->ops->get_mpath)
6062                 return -EOPNOTSUPP;
6063
6064         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6065                 return -EOPNOTSUPP;
6066
6067         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
6068         if (err)
6069                 return err;
6070
6071         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6072         if (!msg)
6073                 return -ENOMEM;
6074
6075         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
6076                                  dev, dst, next_hop, &pinfo) < 0) {
6077                 nlmsg_free(msg);
6078                 return -ENOBUFS;
6079         }
6080
6081         return genlmsg_reply(msg, info);
6082 }
6083
6084 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
6085 {
6086         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6087         struct net_device *dev = info->user_ptr[1];
6088         u8 *dst = NULL;
6089         u8 *next_hop = NULL;
6090
6091         if (!info->attrs[NL80211_ATTR_MAC])
6092                 return -EINVAL;
6093
6094         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
6095                 return -EINVAL;
6096
6097         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6098         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
6099
6100         if (!rdev->ops->change_mpath)
6101                 return -EOPNOTSUPP;
6102
6103         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6104                 return -EOPNOTSUPP;
6105
6106         return rdev_change_mpath(rdev, dev, dst, next_hop);
6107 }
6108
6109 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
6110 {
6111         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6112         struct net_device *dev = info->user_ptr[1];
6113         u8 *dst = NULL;
6114         u8 *next_hop = NULL;
6115
6116         if (!info->attrs[NL80211_ATTR_MAC])
6117                 return -EINVAL;
6118
6119         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
6120                 return -EINVAL;
6121
6122         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6123         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
6124
6125         if (!rdev->ops->add_mpath)
6126                 return -EOPNOTSUPP;
6127
6128         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6129                 return -EOPNOTSUPP;
6130
6131         return rdev_add_mpath(rdev, dev, dst, next_hop);
6132 }
6133
6134 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
6135 {
6136         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6137         struct net_device *dev = info->user_ptr[1];
6138         u8 *dst = NULL;
6139
6140         if (info->attrs[NL80211_ATTR_MAC])
6141                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6142
6143         if (!rdev->ops->del_mpath)
6144                 return -EOPNOTSUPP;
6145
6146         return rdev_del_mpath(rdev, dev, dst);
6147 }
6148
6149 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
6150 {
6151         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6152         int err;
6153         struct net_device *dev = info->user_ptr[1];
6154         struct mpath_info pinfo;
6155         struct sk_buff *msg;
6156         u8 *dst = NULL;
6157         u8 mpp[ETH_ALEN];
6158
6159         memset(&pinfo, 0, sizeof(pinfo));
6160
6161         if (!info->attrs[NL80211_ATTR_MAC])
6162                 return -EINVAL;
6163
6164         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6165
6166         if (!rdev->ops->get_mpp)
6167                 return -EOPNOTSUPP;
6168
6169         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6170                 return -EOPNOTSUPP;
6171
6172         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
6173         if (err)
6174                 return err;
6175
6176         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6177         if (!msg)
6178                 return -ENOMEM;
6179
6180         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
6181                                dev, dst, mpp, &pinfo) < 0) {
6182                 nlmsg_free(msg);
6183                 return -ENOBUFS;
6184         }
6185
6186         return genlmsg_reply(msg, info);
6187 }
6188
6189 static int nl80211_dump_mpp(struct sk_buff *skb,
6190                             struct netlink_callback *cb)
6191 {
6192         struct mpath_info pinfo;
6193         struct cfg80211_registered_device *rdev;
6194         struct wireless_dev *wdev;
6195         u8 dst[ETH_ALEN];
6196         u8 mpp[ETH_ALEN];
6197         int path_idx = cb->args[2];
6198         int err;
6199
6200         rtnl_lock();
6201         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
6202         if (err)
6203                 goto out_err;
6204
6205         if (!rdev->ops->dump_mpp) {
6206                 err = -EOPNOTSUPP;
6207                 goto out_err;
6208         }
6209
6210         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
6211                 err = -EOPNOTSUPP;
6212                 goto out_err;
6213         }
6214
6215         while (1) {
6216                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
6217                                     mpp, &pinfo);
6218                 if (err == -ENOENT)
6219                         break;
6220                 if (err)
6221                         goto out_err;
6222
6223                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
6224                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
6225                                        wdev->netdev, dst, mpp,
6226                                        &pinfo) < 0)
6227                         goto out;
6228
6229                 path_idx++;
6230         }
6231
6232  out:
6233         cb->args[2] = path_idx;
6234         err = skb->len;
6235  out_err:
6236         rtnl_unlock();
6237         return err;
6238 }
6239
6240 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
6241 {
6242         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6243         struct net_device *dev = info->user_ptr[1];
6244         struct wireless_dev *wdev = dev->ieee80211_ptr;
6245         struct bss_parameters params;
6246         int err;
6247
6248         memset(&params, 0, sizeof(params));
6249         /* default to not changing parameters */
6250         params.use_cts_prot = -1;
6251         params.use_short_preamble = -1;
6252         params.use_short_slot_time = -1;
6253         params.ap_isolate = -1;
6254         params.ht_opmode = -1;
6255         params.p2p_ctwindow = -1;
6256         params.p2p_opp_ps = -1;
6257
6258         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
6259                 params.use_cts_prot =
6260                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
6261         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
6262                 params.use_short_preamble =
6263                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
6264         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
6265                 params.use_short_slot_time =
6266                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
6267         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6268                 params.basic_rates =
6269                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6270                 params.basic_rates_len =
6271                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6272         }
6273         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
6274                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
6275         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
6276                 params.ht_opmode =
6277                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
6278
6279         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
6280                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6281                         return -EINVAL;
6282                 params.p2p_ctwindow =
6283                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
6284                 if (params.p2p_ctwindow != 0 &&
6285                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
6286                         return -EINVAL;
6287         }
6288
6289         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
6290                 u8 tmp;
6291
6292                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6293                         return -EINVAL;
6294                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
6295                 params.p2p_opp_ps = tmp;
6296                 if (params.p2p_opp_ps &&
6297                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
6298                         return -EINVAL;
6299         }
6300
6301         if (!rdev->ops->change_bss)
6302                 return -EOPNOTSUPP;
6303
6304         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6305             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6306                 return -EOPNOTSUPP;
6307
6308         wdev_lock(wdev);
6309         err = rdev_change_bss(rdev, dev, &params);
6310         wdev_unlock(wdev);
6311
6312         return err;
6313 }
6314
6315 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
6316 {
6317         char *data = NULL;
6318         bool is_indoor;
6319         enum nl80211_user_reg_hint_type user_reg_hint_type;
6320         u32 owner_nlportid;
6321
6322         /*
6323          * You should only get this when cfg80211 hasn't yet initialized
6324          * completely when built-in to the kernel right between the time
6325          * window between nl80211_init() and regulatory_init(), if that is
6326          * even possible.
6327          */
6328         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
6329                 return -EINPROGRESS;
6330
6331         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
6332                 user_reg_hint_type =
6333                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
6334         else
6335                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
6336
6337         switch (user_reg_hint_type) {
6338         case NL80211_USER_REG_HINT_USER:
6339         case NL80211_USER_REG_HINT_CELL_BASE:
6340                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6341                         return -EINVAL;
6342
6343                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6344                 return regulatory_hint_user(data, user_reg_hint_type);
6345         case NL80211_USER_REG_HINT_INDOOR:
6346                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
6347                         owner_nlportid = info->snd_portid;
6348                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
6349                 } else {
6350                         owner_nlportid = 0;
6351                         is_indoor = true;
6352                 }
6353
6354                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
6355         default:
6356                 return -EINVAL;
6357         }
6358 }
6359
6360 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
6361 {
6362         return reg_reload_regdb();
6363 }
6364
6365 static int nl80211_get_mesh_config(struct sk_buff *skb,
6366                                    struct genl_info *info)
6367 {
6368         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6369         struct net_device *dev = info->user_ptr[1];
6370         struct wireless_dev *wdev = dev->ieee80211_ptr;
6371         struct mesh_config cur_params;
6372         int err = 0;
6373         void *hdr;
6374         struct nlattr *pinfoattr;
6375         struct sk_buff *msg;
6376
6377         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6378                 return -EOPNOTSUPP;
6379
6380         if (!rdev->ops->get_mesh_config)
6381                 return -EOPNOTSUPP;
6382
6383         wdev_lock(wdev);
6384         /* If not connected, get default parameters */
6385         if (!wdev->mesh_id_len)
6386                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
6387         else
6388                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
6389         wdev_unlock(wdev);
6390
6391         if (err)
6392                 return err;
6393
6394         /* Draw up a netlink message to send back */
6395         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6396         if (!msg)
6397                 return -ENOMEM;
6398         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6399                              NL80211_CMD_GET_MESH_CONFIG);
6400         if (!hdr)
6401                 goto out;
6402         pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG);
6403         if (!pinfoattr)
6404                 goto nla_put_failure;
6405         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6406             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
6407                         cur_params.dot11MeshRetryTimeout) ||
6408             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
6409                         cur_params.dot11MeshConfirmTimeout) ||
6410             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
6411                         cur_params.dot11MeshHoldingTimeout) ||
6412             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
6413                         cur_params.dot11MeshMaxPeerLinks) ||
6414             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
6415                        cur_params.dot11MeshMaxRetries) ||
6416             nla_put_u8(msg, NL80211_MESHCONF_TTL,
6417                        cur_params.dot11MeshTTL) ||
6418             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
6419                        cur_params.element_ttl) ||
6420             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
6421                        cur_params.auto_open_plinks) ||
6422             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
6423                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
6424             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
6425                        cur_params.dot11MeshHWMPmaxPREQretries) ||
6426             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
6427                         cur_params.path_refresh_time) ||
6428             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
6429                         cur_params.min_discovery_timeout) ||
6430             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
6431                         cur_params.dot11MeshHWMPactivePathTimeout) ||
6432             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
6433                         cur_params.dot11MeshHWMPpreqMinInterval) ||
6434             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
6435                         cur_params.dot11MeshHWMPperrMinInterval) ||
6436             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
6437                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
6438             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
6439                        cur_params.dot11MeshHWMPRootMode) ||
6440             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
6441                         cur_params.dot11MeshHWMPRannInterval) ||
6442             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
6443                        cur_params.dot11MeshGateAnnouncementProtocol) ||
6444             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
6445                        cur_params.dot11MeshForwarding) ||
6446             nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
6447                         cur_params.rssi_threshold) ||
6448             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
6449                         cur_params.ht_opmode) ||
6450             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6451                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
6452             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6453                         cur_params.dot11MeshHWMProotInterval) ||
6454             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6455                         cur_params.dot11MeshHWMPconfirmationInterval) ||
6456             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
6457                         cur_params.power_mode) ||
6458             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
6459                         cur_params.dot11MeshAwakeWindowDuration) ||
6460             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
6461                         cur_params.plink_timeout) ||
6462             nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE,
6463                        cur_params.dot11MeshConnectedToMeshGate))
6464                 goto nla_put_failure;
6465         nla_nest_end(msg, pinfoattr);
6466         genlmsg_end(msg, hdr);
6467         return genlmsg_reply(msg, info);
6468
6469  nla_put_failure:
6470  out:
6471         nlmsg_free(msg);
6472         return -ENOBUFS;
6473 }
6474
6475 static const struct nla_policy
6476 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
6477         [NL80211_MESHCONF_RETRY_TIMEOUT] =
6478                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
6479         [NL80211_MESHCONF_CONFIRM_TIMEOUT] =
6480                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
6481         [NL80211_MESHCONF_HOLDING_TIMEOUT] =
6482                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
6483         [NL80211_MESHCONF_MAX_PEER_LINKS] =
6484                 NLA_POLICY_RANGE(NLA_U16, 0, 255),
6485         [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
6486         [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
6487         [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
6488         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
6489         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
6490                 NLA_POLICY_RANGE(NLA_U32, 1, 255),
6491         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
6492         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
6493         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
6494         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
6495         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
6496                 NLA_POLICY_MIN(NLA_U16, 1),
6497         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
6498                 NLA_POLICY_MIN(NLA_U16, 1),
6499         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
6500                 NLA_POLICY_MIN(NLA_U16, 1),
6501         [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
6502         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
6503                 NLA_POLICY_MIN(NLA_U16, 1),
6504         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
6505         [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
6506         [NL80211_MESHCONF_RSSI_THRESHOLD] =
6507                 NLA_POLICY_RANGE(NLA_S32, -255, 0),
6508         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
6509         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
6510         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
6511                 NLA_POLICY_MIN(NLA_U16, 1),
6512         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
6513                 NLA_POLICY_MIN(NLA_U16, 1),
6514         [NL80211_MESHCONF_POWER_MODE] =
6515                 NLA_POLICY_RANGE(NLA_U32,
6516                                  NL80211_MESH_POWER_ACTIVE,
6517                                  NL80211_MESH_POWER_MAX),
6518         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
6519         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
6520         [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
6521 };
6522
6523 static const struct nla_policy
6524         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
6525         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
6526         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
6527         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
6528         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
6529         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
6530         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
6531         [NL80211_MESH_SETUP_IE] =
6532                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
6533                                        IEEE80211_MAX_DATA_LEN),
6534         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
6535 };
6536
6537 static int nl80211_parse_mesh_config(struct genl_info *info,
6538                                      struct mesh_config *cfg,
6539                                      u32 *mask_out)
6540 {
6541         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
6542         u32 mask = 0;
6543         u16 ht_opmode;
6544
6545 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn)       \
6546 do {                                                                    \
6547         if (tb[attr]) {                                                 \
6548                 cfg->param = fn(tb[attr]);                              \
6549                 mask |= BIT((attr) - 1);                                \
6550         }                                                               \
6551 } while (0)
6552
6553         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
6554                 return -EINVAL;
6555         if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack))
6556                 return -EINVAL;
6557
6558         /* This makes sure that there aren't more than 32 mesh config
6559          * parameters (otherwise our bitfield scheme would not work.) */
6560         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
6561
6562         /* Fill in the params struct */
6563         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
6564                                   NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
6565         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
6566                                   NL80211_MESHCONF_CONFIRM_TIMEOUT,
6567                                   nla_get_u16);
6568         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
6569                                   NL80211_MESHCONF_HOLDING_TIMEOUT,
6570                                   nla_get_u16);
6571         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
6572                                   NL80211_MESHCONF_MAX_PEER_LINKS,
6573                                   nla_get_u16);
6574         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
6575                                   NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
6576         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
6577                                   NL80211_MESHCONF_TTL, nla_get_u8);
6578         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
6579                                   NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
6580         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
6581                                   NL80211_MESHCONF_AUTO_OPEN_PLINKS,
6582                                   nla_get_u8);
6583         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
6584                                   mask,
6585                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
6586                                   nla_get_u32);
6587         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
6588                                   NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
6589                                   nla_get_u8);
6590         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
6591                                   NL80211_MESHCONF_PATH_REFRESH_TIME,
6592                                   nla_get_u32);
6593         if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
6594             (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
6595                 return -EINVAL;
6596         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
6597                                   NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
6598                                   nla_get_u16);
6599         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
6600                                   mask,
6601                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
6602                                   nla_get_u32);
6603         if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
6604             (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
6605              cfg->dot11MeshHWMPactivePathTimeout > 65535))
6606                 return -EINVAL;
6607         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
6608                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
6609                                   nla_get_u16);
6610         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
6611                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
6612                                   nla_get_u16);
6613         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6614                                   dot11MeshHWMPnetDiameterTraversalTime, mask,
6615                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
6616                                   nla_get_u16);
6617         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
6618                                   NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
6619         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
6620                                   NL80211_MESHCONF_HWMP_RANN_INTERVAL,
6621                                   nla_get_u16);
6622         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
6623                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
6624                                   nla_get_u8);
6625         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
6626                                   NL80211_MESHCONF_FORWARDING, nla_get_u8);
6627         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
6628                                   NL80211_MESHCONF_RSSI_THRESHOLD,
6629                                   nla_get_s32);
6630         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask,
6631                                   NL80211_MESHCONF_CONNECTED_TO_GATE,
6632                                   nla_get_u8);
6633         /*
6634          * Check HT operation mode based on
6635          * IEEE 802.11-2016 9.4.2.57 HT Operation element.
6636          */
6637         if (tb[NL80211_MESHCONF_HT_OPMODE]) {
6638                 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
6639
6640                 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
6641                                   IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
6642                                   IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
6643                         return -EINVAL;
6644
6645                 /* NON_HT_STA bit is reserved, but some programs set it */
6646                 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
6647
6648                 cfg->ht_opmode = ht_opmode;
6649                 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
6650         }
6651         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6652                                   dot11MeshHWMPactivePathToRootTimeout, mask,
6653                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6654                                   nla_get_u32);
6655         if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
6656             (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
6657              cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
6658                 return -EINVAL;
6659         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
6660                                   NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6661                                   nla_get_u16);
6662         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
6663                                   mask,
6664                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6665                                   nla_get_u16);
6666         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
6667                                   NL80211_MESHCONF_POWER_MODE, nla_get_u32);
6668         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
6669                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
6670         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
6671                                   NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
6672         if (mask_out)
6673                 *mask_out = mask;
6674
6675         return 0;
6676
6677 #undef FILL_IN_MESH_PARAM_IF_SET
6678 }
6679
6680 static int nl80211_parse_mesh_setup(struct genl_info *info,
6681                                      struct mesh_setup *setup)
6682 {
6683         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6684         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
6685
6686         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
6687                 return -EINVAL;
6688         if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack))
6689                 return -EINVAL;
6690
6691         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
6692                 setup->sync_method =
6693                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
6694                  IEEE80211_SYNC_METHOD_VENDOR :
6695                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
6696
6697         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
6698                 setup->path_sel_proto =
6699                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
6700                  IEEE80211_PATH_PROTOCOL_VENDOR :
6701                  IEEE80211_PATH_PROTOCOL_HWMP;
6702
6703         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
6704                 setup->path_metric =
6705                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
6706                  IEEE80211_PATH_METRIC_VENDOR :
6707                  IEEE80211_PATH_METRIC_AIRTIME;
6708
6709         if (tb[NL80211_MESH_SETUP_IE]) {
6710                 struct nlattr *ieattr =
6711                         tb[NL80211_MESH_SETUP_IE];
6712                 setup->ie = nla_data(ieattr);
6713                 setup->ie_len = nla_len(ieattr);
6714         }
6715         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
6716             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
6717                 return -EINVAL;
6718         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
6719         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
6720         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
6721         if (setup->is_secure)
6722                 setup->user_mpm = true;
6723
6724         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
6725                 if (!setup->user_mpm)
6726                         return -EINVAL;
6727                 setup->auth_id =
6728                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
6729         }
6730
6731         return 0;
6732 }
6733
6734 static int nl80211_update_mesh_config(struct sk_buff *skb,
6735                                       struct genl_info *info)
6736 {
6737         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6738         struct net_device *dev = info->user_ptr[1];
6739         struct wireless_dev *wdev = dev->ieee80211_ptr;
6740         struct mesh_config cfg;
6741         u32 mask;
6742         int err;
6743
6744         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6745                 return -EOPNOTSUPP;
6746
6747         if (!rdev->ops->update_mesh_config)
6748                 return -EOPNOTSUPP;
6749
6750         err = nl80211_parse_mesh_config(info, &cfg, &mask);
6751         if (err)
6752                 return err;
6753
6754         wdev_lock(wdev);
6755         if (!wdev->mesh_id_len)
6756                 err = -ENOLINK;
6757
6758         if (!err)
6759                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
6760
6761         wdev_unlock(wdev);
6762
6763         return err;
6764 }
6765
6766 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
6767                               struct sk_buff *msg)
6768 {
6769         struct nlattr *nl_reg_rules;
6770         unsigned int i;
6771
6772         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
6773             (regdom->dfs_region &&
6774              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
6775                 goto nla_put_failure;
6776
6777         nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES);
6778         if (!nl_reg_rules)
6779                 goto nla_put_failure;
6780
6781         for (i = 0; i < regdom->n_reg_rules; i++) {
6782                 struct nlattr *nl_reg_rule;
6783                 const struct ieee80211_reg_rule *reg_rule;
6784                 const struct ieee80211_freq_range *freq_range;
6785                 const struct ieee80211_power_rule *power_rule;
6786                 unsigned int max_bandwidth_khz;
6787
6788                 reg_rule = &regdom->reg_rules[i];
6789                 freq_range = &reg_rule->freq_range;
6790                 power_rule = &reg_rule->power_rule;
6791
6792                 nl_reg_rule = nla_nest_start_noflag(msg, i);
6793                 if (!nl_reg_rule)
6794                         goto nla_put_failure;
6795
6796                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
6797                 if (!max_bandwidth_khz)
6798                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
6799                                                                   reg_rule);
6800
6801                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
6802                                 reg_rule->flags) ||
6803                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
6804                                 freq_range->start_freq_khz) ||
6805                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
6806                                 freq_range->end_freq_khz) ||
6807                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
6808                                 max_bandwidth_khz) ||
6809                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
6810                                 power_rule->max_antenna_gain) ||
6811                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
6812                                 power_rule->max_eirp) ||
6813                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
6814                                 reg_rule->dfs_cac_ms))
6815                         goto nla_put_failure;
6816
6817                 nla_nest_end(msg, nl_reg_rule);
6818         }
6819
6820         nla_nest_end(msg, nl_reg_rules);
6821         return 0;
6822
6823 nla_put_failure:
6824         return -EMSGSIZE;
6825 }
6826
6827 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
6828 {
6829         const struct ieee80211_regdomain *regdom = NULL;
6830         struct cfg80211_registered_device *rdev;
6831         struct wiphy *wiphy = NULL;
6832         struct sk_buff *msg;
6833         void *hdr;
6834
6835         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6836         if (!msg)
6837                 return -ENOBUFS;
6838
6839         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6840                              NL80211_CMD_GET_REG);
6841         if (!hdr)
6842                 goto put_failure;
6843
6844         if (info->attrs[NL80211_ATTR_WIPHY]) {
6845                 bool self_managed;
6846
6847                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
6848                 if (IS_ERR(rdev)) {
6849                         nlmsg_free(msg);
6850                         return PTR_ERR(rdev);
6851                 }
6852
6853                 wiphy = &rdev->wiphy;
6854                 self_managed = wiphy->regulatory_flags &
6855                                REGULATORY_WIPHY_SELF_MANAGED;
6856                 regdom = get_wiphy_regdom(wiphy);
6857
6858                 /* a self-managed-reg device must have a private regdom */
6859                 if (WARN_ON(!regdom && self_managed)) {
6860                         nlmsg_free(msg);
6861                         return -EINVAL;
6862                 }
6863
6864                 if (regdom &&
6865                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6866                         goto nla_put_failure;
6867         }
6868
6869         if (!wiphy && reg_last_request_cell_base() &&
6870             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6871                         NL80211_USER_REG_HINT_CELL_BASE))
6872                 goto nla_put_failure;
6873
6874         rcu_read_lock();
6875
6876         if (!regdom)
6877                 regdom = rcu_dereference(cfg80211_regdomain);
6878
6879         if (nl80211_put_regdom(regdom, msg))
6880                 goto nla_put_failure_rcu;
6881
6882         rcu_read_unlock();
6883
6884         genlmsg_end(msg, hdr);
6885         return genlmsg_reply(msg, info);
6886
6887 nla_put_failure_rcu:
6888         rcu_read_unlock();
6889 nla_put_failure:
6890 put_failure:
6891         nlmsg_free(msg);
6892         return -EMSGSIZE;
6893 }
6894
6895 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
6896                                u32 seq, int flags, struct wiphy *wiphy,
6897                                const struct ieee80211_regdomain *regdom)
6898 {
6899         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6900                                    NL80211_CMD_GET_REG);
6901
6902         if (!hdr)
6903                 return -1;
6904
6905         genl_dump_check_consistent(cb, hdr);
6906
6907         if (nl80211_put_regdom(regdom, msg))
6908                 goto nla_put_failure;
6909
6910         if (!wiphy && reg_last_request_cell_base() &&
6911             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6912                         NL80211_USER_REG_HINT_CELL_BASE))
6913                 goto nla_put_failure;
6914
6915         if (wiphy &&
6916             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6917                 goto nla_put_failure;
6918
6919         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
6920             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
6921                 goto nla_put_failure;
6922
6923         genlmsg_end(msg, hdr);
6924         return 0;
6925
6926 nla_put_failure:
6927         genlmsg_cancel(msg, hdr);
6928         return -EMSGSIZE;
6929 }
6930
6931 static int nl80211_get_reg_dump(struct sk_buff *skb,
6932                                 struct netlink_callback *cb)
6933 {
6934         const struct ieee80211_regdomain *regdom = NULL;
6935         struct cfg80211_registered_device *rdev;
6936         int err, reg_idx, start = cb->args[2];
6937
6938         rtnl_lock();
6939
6940         if (cfg80211_regdomain && start == 0) {
6941                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6942                                           NLM_F_MULTI, NULL,
6943                                           rtnl_dereference(cfg80211_regdomain));
6944                 if (err < 0)
6945                         goto out_err;
6946         }
6947
6948         /* the global regdom is idx 0 */
6949         reg_idx = 1;
6950         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
6951                 regdom = get_wiphy_regdom(&rdev->wiphy);
6952                 if (!regdom)
6953                         continue;
6954
6955                 if (++reg_idx <= start)
6956                         continue;
6957
6958                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6959                                           NLM_F_MULTI, &rdev->wiphy, regdom);
6960                 if (err < 0) {
6961                         reg_idx--;
6962                         break;
6963                 }
6964         }
6965
6966         cb->args[2] = reg_idx;
6967         err = skb->len;
6968 out_err:
6969         rtnl_unlock();
6970         return err;
6971 }
6972
6973 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
6974 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
6975         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
6976         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
6977         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
6978         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
6979         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
6980         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
6981         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
6982 };
6983
6984 static int parse_reg_rule(struct nlattr *tb[],
6985         struct ieee80211_reg_rule *reg_rule)
6986 {
6987         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
6988         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
6989
6990         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
6991                 return -EINVAL;
6992         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
6993                 return -EINVAL;
6994         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
6995                 return -EINVAL;
6996         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
6997                 return -EINVAL;
6998         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
6999                 return -EINVAL;
7000
7001         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
7002
7003         freq_range->start_freq_khz =
7004                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
7005         freq_range->end_freq_khz =
7006                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
7007         freq_range->max_bandwidth_khz =
7008                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
7009
7010         power_rule->max_eirp =
7011                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
7012
7013         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
7014                 power_rule->max_antenna_gain =
7015                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
7016
7017         if (tb[NL80211_ATTR_DFS_CAC_TIME])
7018                 reg_rule->dfs_cac_ms =
7019                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
7020
7021         return 0;
7022 }
7023
7024 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
7025 {
7026         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
7027         struct nlattr *nl_reg_rule;
7028         char *alpha2;
7029         int rem_reg_rules, r;
7030         u32 num_rules = 0, rule_idx = 0;
7031         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
7032         struct ieee80211_regdomain *rd;
7033
7034         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
7035                 return -EINVAL;
7036
7037         if (!info->attrs[NL80211_ATTR_REG_RULES])
7038                 return -EINVAL;
7039
7040         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
7041
7042         if (info->attrs[NL80211_ATTR_DFS_REGION])
7043                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
7044
7045         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
7046                             rem_reg_rules) {
7047                 num_rules++;
7048                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
7049                         return -EINVAL;
7050         }
7051
7052         if (!reg_is_valid_request(alpha2))
7053                 return -EINVAL;
7054
7055         rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL);
7056         if (!rd)
7057                 return -ENOMEM;
7058
7059         rd->n_reg_rules = num_rules;
7060         rd->alpha2[0] = alpha2[0];
7061         rd->alpha2[1] = alpha2[1];
7062
7063         /*
7064          * Disable DFS master mode if the DFS region was
7065          * not supported or known on this kernel.
7066          */
7067         if (reg_supported_dfs_region(dfs_region))
7068                 rd->dfs_region = dfs_region;
7069
7070         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
7071                             rem_reg_rules) {
7072                 r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX,
7073                                                 nl_reg_rule, reg_rule_policy,
7074                                                 info->extack);
7075                 if (r)
7076                         goto bad_reg;
7077                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
7078                 if (r)
7079                         goto bad_reg;
7080
7081                 rule_idx++;
7082
7083                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
7084                         r = -EINVAL;
7085                         goto bad_reg;
7086                 }
7087         }
7088
7089         /* set_regdom takes ownership of rd */
7090         return set_regdom(rd, REGD_SOURCE_CRDA);
7091  bad_reg:
7092         kfree(rd);
7093         return r;
7094 }
7095 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
7096
7097 static int validate_scan_freqs(struct nlattr *freqs)
7098 {
7099         struct nlattr *attr1, *attr2;
7100         int n_channels = 0, tmp1, tmp2;
7101
7102         nla_for_each_nested(attr1, freqs, tmp1)
7103                 if (nla_len(attr1) != sizeof(u32))
7104                         return 0;
7105
7106         nla_for_each_nested(attr1, freqs, tmp1) {
7107                 n_channels++;
7108                 /*
7109                  * Some hardware has a limited channel list for
7110                  * scanning, and it is pretty much nonsensical
7111                  * to scan for a channel twice, so disallow that
7112                  * and don't require drivers to check that the
7113                  * channel list they get isn't longer than what
7114                  * they can scan, as long as they can scan all
7115                  * the channels they registered at once.
7116                  */
7117                 nla_for_each_nested(attr2, freqs, tmp2)
7118                         if (attr1 != attr2 &&
7119                             nla_get_u32(attr1) == nla_get_u32(attr2))
7120                                 return 0;
7121         }
7122
7123         return n_channels;
7124 }
7125
7126 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
7127 {
7128         return b < NUM_NL80211_BANDS && wiphy->bands[b];
7129 }
7130
7131 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
7132                             struct cfg80211_bss_selection *bss_select)
7133 {
7134         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
7135         struct nlattr *nest;
7136         int err;
7137         bool found = false;
7138         int i;
7139
7140         /* only process one nested attribute */
7141         nest = nla_data(nla);
7142         if (!nla_ok(nest, nla_len(nest)))
7143                 return -EINVAL;
7144
7145         err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX,
7146                                           nest, nl80211_bss_select_policy,
7147                                           NULL);
7148         if (err)
7149                 return err;
7150
7151         /* only one attribute may be given */
7152         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
7153                 if (attr[i]) {
7154                         if (found)
7155                                 return -EINVAL;
7156                         found = true;
7157                 }
7158         }
7159
7160         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
7161
7162         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
7163                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
7164
7165         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
7166                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
7167                 bss_select->param.band_pref =
7168                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
7169                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
7170                         return -EINVAL;
7171         }
7172
7173         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
7174                 struct nl80211_bss_select_rssi_adjust *adj_param;
7175
7176                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
7177                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
7178                 bss_select->param.adjust.band = adj_param->band;
7179                 bss_select->param.adjust.delta = adj_param->delta;
7180                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
7181                         return -EINVAL;
7182         }
7183
7184         /* user-space did not provide behaviour attribute */
7185         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
7186                 return -EINVAL;
7187
7188         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
7189                 return -EINVAL;
7190
7191         return 0;
7192 }
7193
7194 int nl80211_parse_random_mac(struct nlattr **attrs,
7195                              u8 *mac_addr, u8 *mac_addr_mask)
7196 {
7197         int i;
7198
7199         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
7200                 eth_zero_addr(mac_addr);
7201                 eth_zero_addr(mac_addr_mask);
7202                 mac_addr[0] = 0x2;
7203                 mac_addr_mask[0] = 0x3;
7204
7205                 return 0;
7206         }
7207
7208         /* need both or none */
7209         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
7210                 return -EINVAL;
7211
7212         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
7213         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
7214
7215         /* don't allow or configure an mcast address */
7216         if (!is_multicast_ether_addr(mac_addr_mask) ||
7217             is_multicast_ether_addr(mac_addr))
7218                 return -EINVAL;
7219
7220         /*
7221          * allow users to pass a MAC address that has bits set outside
7222          * of the mask, but don't bother drivers with having to deal
7223          * with such bits
7224          */
7225         for (i = 0; i < ETH_ALEN; i++)
7226                 mac_addr[i] &= mac_addr_mask[i];
7227
7228         return 0;
7229 }
7230
7231 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev)
7232 {
7233         ASSERT_WDEV_LOCK(wdev);
7234
7235         if (!cfg80211_beaconing_iface_active(wdev))
7236                 return true;
7237
7238         if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR))
7239                 return true;
7240
7241         return regulatory_pre_cac_allowed(wdev->wiphy);
7242 }
7243
7244 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
7245                                     enum nl80211_ext_feature_index feat)
7246 {
7247         if (!(flags & flag))
7248                 return true;
7249         if (wiphy_ext_feature_isset(wiphy, feat))
7250                 return true;
7251         return false;
7252 }
7253
7254 static int
7255 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
7256                          void *request, struct nlattr **attrs,
7257                          bool is_sched_scan)
7258 {
7259         u8 *mac_addr, *mac_addr_mask;
7260         u32 *flags;
7261         enum nl80211_feature_flags randomness_flag;
7262
7263         if (!attrs[NL80211_ATTR_SCAN_FLAGS])
7264                 return 0;
7265
7266         if (is_sched_scan) {
7267                 struct cfg80211_sched_scan_request *req = request;
7268
7269                 randomness_flag = wdev ?
7270                                   NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
7271                                   NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
7272                 flags = &req->flags;
7273                 mac_addr = req->mac_addr;
7274                 mac_addr_mask = req->mac_addr_mask;
7275         } else {
7276                 struct cfg80211_scan_request *req = request;
7277
7278                 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
7279                 flags = &req->flags;
7280                 mac_addr = req->mac_addr;
7281                 mac_addr_mask = req->mac_addr_mask;
7282         }
7283
7284         *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
7285
7286         if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
7287              !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
7288             !nl80211_check_scan_feat(wiphy, *flags,
7289                                      NL80211_SCAN_FLAG_LOW_SPAN,
7290                                      NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
7291             !nl80211_check_scan_feat(wiphy, *flags,
7292                                      NL80211_SCAN_FLAG_LOW_POWER,
7293                                      NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
7294             !nl80211_check_scan_feat(wiphy, *flags,
7295                                      NL80211_SCAN_FLAG_HIGH_ACCURACY,
7296                                      NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
7297             !nl80211_check_scan_feat(wiphy, *flags,
7298                                      NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
7299                                      NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
7300             !nl80211_check_scan_feat(wiphy, *flags,
7301                                      NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
7302                                      NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
7303             !nl80211_check_scan_feat(wiphy, *flags,
7304                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
7305                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
7306             !nl80211_check_scan_feat(wiphy, *flags,
7307                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
7308                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
7309             !nl80211_check_scan_feat(wiphy, *flags,
7310                                      NL80211_SCAN_FLAG_RANDOM_SN,
7311                                      NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
7312             !nl80211_check_scan_feat(wiphy, *flags,
7313                                      NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
7314                                      NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
7315                 return -EOPNOTSUPP;
7316
7317         if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
7318                 int err;
7319
7320                 if (!(wiphy->features & randomness_flag) ||
7321                     (wdev && wdev->current_bss))
7322                         return -EOPNOTSUPP;
7323
7324                 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
7325                 if (err)
7326                         return err;
7327         }
7328
7329         return 0;
7330 }
7331
7332 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
7333 {
7334         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7335         struct wireless_dev *wdev = info->user_ptr[1];
7336         struct cfg80211_scan_request *request;
7337         struct nlattr *attr;
7338         struct wiphy *wiphy;
7339         int err, tmp, n_ssids = 0, n_channels, i;
7340         size_t ie_len;
7341
7342         wiphy = &rdev->wiphy;
7343
7344         if (wdev->iftype == NL80211_IFTYPE_NAN)
7345                 return -EOPNOTSUPP;
7346
7347         if (!rdev->ops->scan)
7348                 return -EOPNOTSUPP;
7349
7350         if (rdev->scan_req || rdev->scan_msg) {
7351                 err = -EBUSY;
7352                 goto unlock;
7353         }
7354
7355         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7356                 n_channels = validate_scan_freqs(
7357                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7358                 if (!n_channels) {
7359                         err = -EINVAL;
7360                         goto unlock;
7361                 }
7362         } else {
7363                 n_channels = ieee80211_get_num_supported_channels(wiphy);
7364         }
7365
7366         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
7367                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
7368                         n_ssids++;
7369
7370         if (n_ssids > wiphy->max_scan_ssids) {
7371                 err = -EINVAL;
7372                 goto unlock;
7373         }
7374
7375         if (info->attrs[NL80211_ATTR_IE])
7376                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7377         else
7378                 ie_len = 0;
7379
7380         if (ie_len > wiphy->max_scan_ie_len) {
7381                 err = -EINVAL;
7382                 goto unlock;
7383         }
7384
7385         request = kzalloc(sizeof(*request)
7386                         + sizeof(*request->ssids) * n_ssids
7387                         + sizeof(*request->channels) * n_channels
7388                         + ie_len, GFP_KERNEL);
7389         if (!request) {
7390                 err = -ENOMEM;
7391                 goto unlock;
7392         }
7393
7394         if (n_ssids)
7395                 request->ssids = (void *)&request->channels[n_channels];
7396         request->n_ssids = n_ssids;
7397         if (ie_len) {
7398                 if (n_ssids)
7399                         request->ie = (void *)(request->ssids + n_ssids);
7400                 else
7401                         request->ie = (void *)(request->channels + n_channels);
7402         }
7403
7404         i = 0;
7405         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7406                 /* user specified, bail out if channel not found */
7407                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
7408                         struct ieee80211_channel *chan;
7409
7410                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7411
7412                         if (!chan) {
7413                                 err = -EINVAL;
7414                                 goto out_free;
7415                         }
7416
7417                         /* ignore disabled channels */
7418                         if (chan->flags & IEEE80211_CHAN_DISABLED)
7419                                 continue;
7420
7421                         request->channels[i] = chan;
7422                         i++;
7423                 }
7424         } else {
7425                 enum nl80211_band band;
7426
7427                 /* all channels */
7428                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7429                         int j;
7430
7431                         if (!wiphy->bands[band])
7432                                 continue;
7433                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7434                                 struct ieee80211_channel *chan;
7435
7436                                 chan = &wiphy->bands[band]->channels[j];
7437
7438                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
7439                                         continue;
7440
7441                                 request->channels[i] = chan;
7442                                 i++;
7443                         }
7444                 }
7445         }
7446
7447         if (!i) {
7448                 err = -EINVAL;
7449                 goto out_free;
7450         }
7451
7452         request->n_channels = i;
7453
7454         wdev_lock(wdev);
7455         if (!cfg80211_off_channel_oper_allowed(wdev)) {
7456                 struct ieee80211_channel *chan;
7457
7458                 if (request->n_channels != 1) {
7459                         wdev_unlock(wdev);
7460                         err = -EBUSY;
7461                         goto out_free;
7462                 }
7463
7464                 chan = request->channels[0];
7465                 if (chan->center_freq != wdev->chandef.chan->center_freq) {
7466                         wdev_unlock(wdev);
7467                         err = -EBUSY;
7468                         goto out_free;
7469                 }
7470         }
7471         wdev_unlock(wdev);
7472
7473         i = 0;
7474         if (n_ssids) {
7475                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
7476                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7477                                 err = -EINVAL;
7478                                 goto out_free;
7479                         }
7480                         request->ssids[i].ssid_len = nla_len(attr);
7481                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
7482                         i++;
7483                 }
7484         }
7485
7486         if (info->attrs[NL80211_ATTR_IE]) {
7487                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7488                 memcpy((void *)request->ie,
7489                        nla_data(info->attrs[NL80211_ATTR_IE]),
7490                        request->ie_len);
7491         }
7492
7493         for (i = 0; i < NUM_NL80211_BANDS; i++)
7494                 if (wiphy->bands[i])
7495                         request->rates[i] =
7496                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
7497
7498         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
7499                 nla_for_each_nested(attr,
7500                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
7501                                     tmp) {
7502                         enum nl80211_band band = nla_type(attr);
7503
7504                         if (band < 0 || band >= NUM_NL80211_BANDS) {
7505                                 err = -EINVAL;
7506                                 goto out_free;
7507                         }
7508
7509                         if (!wiphy->bands[band])
7510                                 continue;
7511
7512                         err = ieee80211_get_ratemask(wiphy->bands[band],
7513                                                      nla_data(attr),
7514                                                      nla_len(attr),
7515                                                      &request->rates[band]);
7516                         if (err)
7517                                 goto out_free;
7518                 }
7519         }
7520
7521         if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
7522                 if (!wiphy_ext_feature_isset(wiphy,
7523                                         NL80211_EXT_FEATURE_SET_SCAN_DWELL)) {
7524                         err = -EOPNOTSUPP;
7525                         goto out_free;
7526                 }
7527
7528                 request->duration =
7529                         nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
7530                 request->duration_mandatory =
7531                         nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
7532         }
7533
7534         err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
7535                                        false);
7536         if (err)
7537                 goto out_free;
7538
7539         request->no_cck =
7540                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7541
7542         /* Initial implementation used NL80211_ATTR_MAC to set the specific
7543          * BSSID to scan for. This was problematic because that same attribute
7544          * was already used for another purpose (local random MAC address). The
7545          * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
7546          * compatibility with older userspace components, also use the
7547          * NL80211_ATTR_MAC value here if it can be determined to be used for
7548          * the specific BSSID use case instead of the random MAC address
7549          * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
7550          */
7551         if (info->attrs[NL80211_ATTR_BSSID])
7552                 memcpy(request->bssid,
7553                        nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
7554         else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
7555                  info->attrs[NL80211_ATTR_MAC])
7556                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
7557                        ETH_ALEN);
7558         else
7559                 eth_broadcast_addr(request->bssid);
7560
7561         request->wdev = wdev;
7562         request->wiphy = &rdev->wiphy;
7563         request->scan_start = jiffies;
7564
7565         rdev->scan_req = request;
7566         err = rdev_scan(rdev, request);
7567
7568         if (!err) {
7569                 nl80211_send_scan_start(rdev, wdev);
7570                 if (wdev->netdev)
7571                         dev_hold(wdev->netdev);
7572         } else {
7573  out_free:
7574                 rdev->scan_req = NULL;
7575                 kfree(request);
7576         }
7577
7578  unlock:
7579         return err;
7580 }
7581
7582 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
7583 {
7584         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7585         struct wireless_dev *wdev = info->user_ptr[1];
7586
7587         if (!rdev->ops->abort_scan)
7588                 return -EOPNOTSUPP;
7589
7590         if (rdev->scan_msg)
7591                 return 0;
7592
7593         if (!rdev->scan_req)
7594                 return -ENOENT;
7595
7596         rdev_abort_scan(rdev, wdev);
7597         return 0;
7598 }
7599
7600 static int
7601 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
7602                                struct cfg80211_sched_scan_request *request,
7603                                struct nlattr **attrs)
7604 {
7605         int tmp, err, i = 0;
7606         struct nlattr *attr;
7607
7608         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7609                 u32 interval;
7610
7611                 /*
7612                  * If scan plans are not specified,
7613                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
7614                  * case one scan plan will be set with the specified scan
7615                  * interval and infinite number of iterations.
7616                  */
7617                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
7618                 if (!interval)
7619                         return -EINVAL;
7620
7621                 request->scan_plans[0].interval =
7622                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
7623                 if (!request->scan_plans[0].interval)
7624                         return -EINVAL;
7625
7626                 if (request->scan_plans[0].interval >
7627                     wiphy->max_sched_scan_plan_interval)
7628                         request->scan_plans[0].interval =
7629                                 wiphy->max_sched_scan_plan_interval;
7630
7631                 return 0;
7632         }
7633
7634         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
7635                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
7636
7637                 if (WARN_ON(i >= n_plans))
7638                         return -EINVAL;
7639
7640                 err = nla_parse_nested_deprecated(plan,
7641                                                   NL80211_SCHED_SCAN_PLAN_MAX,
7642                                                   attr, nl80211_plan_policy,
7643                                                   NULL);
7644                 if (err)
7645                         return err;
7646
7647                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
7648                         return -EINVAL;
7649
7650                 request->scan_plans[i].interval =
7651                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
7652                 if (!request->scan_plans[i].interval ||
7653                     request->scan_plans[i].interval >
7654                     wiphy->max_sched_scan_plan_interval)
7655                         return -EINVAL;
7656
7657                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
7658                         request->scan_plans[i].iterations =
7659                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
7660                         if (!request->scan_plans[i].iterations ||
7661                             (request->scan_plans[i].iterations >
7662                              wiphy->max_sched_scan_plan_iterations))
7663                                 return -EINVAL;
7664                 } else if (i < n_plans - 1) {
7665                         /*
7666                          * All scan plans but the last one must specify
7667                          * a finite number of iterations
7668                          */
7669                         return -EINVAL;
7670                 }
7671
7672                 i++;
7673         }
7674
7675         /*
7676          * The last scan plan must not specify the number of
7677          * iterations, it is supposed to run infinitely
7678          */
7679         if (request->scan_plans[n_plans - 1].iterations)
7680                 return  -EINVAL;
7681
7682         return 0;
7683 }
7684
7685 static int
7686 nl80211_parse_sched_scan_per_band_rssi(struct wiphy *wiphy,
7687                                        struct cfg80211_match_set *match_sets,
7688                                        struct nlattr *tb_band_rssi,
7689                                        s32 rssi_thold)
7690 {
7691         struct nlattr *attr;
7692         int i, tmp, ret = 0;
7693
7694         if (!wiphy_ext_feature_isset(wiphy,
7695                     NL80211_EXT_FEATURE_SCHED_SCAN_BAND_SPECIFIC_RSSI_THOLD)) {
7696                 if (tb_band_rssi)
7697                         ret = -EOPNOTSUPP;
7698                 else
7699                         for (i = 0; i < NUM_NL80211_BANDS; i++)
7700                                 match_sets->per_band_rssi_thold[i] =
7701                                         NL80211_SCAN_RSSI_THOLD_OFF;
7702                 return ret;
7703         }
7704
7705         for (i = 0; i < NUM_NL80211_BANDS; i++)
7706                 match_sets->per_band_rssi_thold[i] = rssi_thold;
7707
7708         nla_for_each_nested(attr, tb_band_rssi, tmp) {
7709                 enum nl80211_band band = nla_type(attr);
7710
7711                 if (band < 0 || band >= NUM_NL80211_BANDS)
7712                         return -EINVAL;
7713
7714                 match_sets->per_band_rssi_thold[band] = nla_get_s32(attr);
7715         }
7716
7717         return 0;
7718 }
7719
7720 static struct cfg80211_sched_scan_request *
7721 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
7722                          struct nlattr **attrs, int max_match_sets)
7723 {
7724         struct cfg80211_sched_scan_request *request;
7725         struct nlattr *attr;
7726         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
7727         enum nl80211_band band;
7728         size_t ie_len;
7729         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
7730         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
7731
7732         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7733                 n_channels = validate_scan_freqs(
7734                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7735                 if (!n_channels)
7736                         return ERR_PTR(-EINVAL);
7737         } else {
7738                 n_channels = ieee80211_get_num_supported_channels(wiphy);
7739         }
7740
7741         if (attrs[NL80211_ATTR_SCAN_SSIDS])
7742                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7743                                     tmp)
7744                         n_ssids++;
7745
7746         if (n_ssids > wiphy->max_sched_scan_ssids)
7747                 return ERR_PTR(-EINVAL);
7748
7749         /*
7750          * First, count the number of 'real' matchsets. Due to an issue with
7751          * the old implementation, matchsets containing only the RSSI attribute
7752          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
7753          * RSSI for all matchsets, rather than their own matchset for reporting
7754          * all APs with a strong RSSI. This is needed to be compatible with
7755          * older userspace that treated a matchset with only the RSSI as the
7756          * global RSSI for all other matchsets - if there are other matchsets.
7757          */
7758         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7759                 nla_for_each_nested(attr,
7760                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7761                                     tmp) {
7762                         struct nlattr *rssi;
7763
7764                         err = nla_parse_nested_deprecated(tb,
7765                                                           NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7766                                                           attr,
7767                                                           nl80211_match_policy,
7768                                                           NULL);
7769                         if (err)
7770                                 return ERR_PTR(err);
7771
7772                         /* SSID and BSSID are mutually exclusive */
7773                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
7774                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
7775                                 return ERR_PTR(-EINVAL);
7776
7777                         /* add other standalone attributes here */
7778                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
7779                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
7780                                 n_match_sets++;
7781                                 continue;
7782                         }
7783                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7784                         if (rssi)
7785                                 default_match_rssi = nla_get_s32(rssi);
7786                 }
7787         }
7788
7789         /* However, if there's no other matchset, add the RSSI one */
7790         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
7791                 n_match_sets = 1;
7792
7793         if (n_match_sets > max_match_sets)
7794                 return ERR_PTR(-EINVAL);
7795
7796         if (attrs[NL80211_ATTR_IE])
7797                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
7798         else
7799                 ie_len = 0;
7800
7801         if (ie_len > wiphy->max_sched_scan_ie_len)
7802                 return ERR_PTR(-EINVAL);
7803
7804         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7805                 /*
7806                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
7807                  * each scan plan already specifies its own interval
7808                  */
7809                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7810                         return ERR_PTR(-EINVAL);
7811
7812                 nla_for_each_nested(attr,
7813                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
7814                         n_plans++;
7815         } else {
7816                 /*
7817                  * The scan interval attribute is kept for backward
7818                  * compatibility. If no scan plans are specified and sched scan
7819                  * interval is specified, one scan plan will be set with this
7820                  * scan interval and infinite number of iterations.
7821                  */
7822                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7823                         return ERR_PTR(-EINVAL);
7824
7825                 n_plans = 1;
7826         }
7827
7828         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
7829                 return ERR_PTR(-EINVAL);
7830
7831         if (!wiphy_ext_feature_isset(
7832                     wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
7833             (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
7834              attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
7835                 return ERR_PTR(-EINVAL);
7836
7837         request = kzalloc(sizeof(*request)
7838                         + sizeof(*request->ssids) * n_ssids
7839                         + sizeof(*request->match_sets) * n_match_sets
7840                         + sizeof(*request->scan_plans) * n_plans
7841                         + sizeof(*request->channels) * n_channels
7842                         + ie_len, GFP_KERNEL);
7843         if (!request)
7844                 return ERR_PTR(-ENOMEM);
7845
7846         if (n_ssids)
7847                 request->ssids = (void *)&request->channels[n_channels];
7848         request->n_ssids = n_ssids;
7849         if (ie_len) {
7850                 if (n_ssids)
7851                         request->ie = (void *)(request->ssids + n_ssids);
7852                 else
7853                         request->ie = (void *)(request->channels + n_channels);
7854         }
7855
7856         if (n_match_sets) {
7857                 if (request->ie)
7858                         request->match_sets = (void *)(request->ie + ie_len);
7859                 else if (n_ssids)
7860                         request->match_sets =
7861                                 (void *)(request->ssids + n_ssids);
7862                 else
7863                         request->match_sets =
7864                                 (void *)(request->channels + n_channels);
7865         }
7866         request->n_match_sets = n_match_sets;
7867
7868         if (n_match_sets)
7869                 request->scan_plans = (void *)(request->match_sets +
7870                                                n_match_sets);
7871         else if (request->ie)
7872                 request->scan_plans = (void *)(request->ie + ie_len);
7873         else if (n_ssids)
7874                 request->scan_plans = (void *)(request->ssids + n_ssids);
7875         else
7876                 request->scan_plans = (void *)(request->channels + n_channels);
7877
7878         request->n_scan_plans = n_plans;
7879
7880         i = 0;
7881         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7882                 /* user specified, bail out if channel not found */
7883                 nla_for_each_nested(attr,
7884                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
7885                                     tmp) {
7886                         struct ieee80211_channel *chan;
7887
7888                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7889
7890                         if (!chan) {
7891                                 err = -EINVAL;
7892                                 goto out_free;
7893                         }
7894
7895                         /* ignore disabled channels */
7896                         if (chan->flags & IEEE80211_CHAN_DISABLED)
7897                                 continue;
7898
7899                         request->channels[i] = chan;
7900                         i++;
7901                 }
7902         } else {
7903                 /* all channels */
7904                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7905                         int j;
7906
7907                         if (!wiphy->bands[band])
7908                                 continue;
7909                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7910                                 struct ieee80211_channel *chan;
7911
7912                                 chan = &wiphy->bands[band]->channels[j];
7913
7914                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
7915                                         continue;
7916
7917                                 request->channels[i] = chan;
7918                                 i++;
7919                         }
7920                 }
7921         }
7922
7923         if (!i) {
7924                 err = -EINVAL;
7925                 goto out_free;
7926         }
7927
7928         request->n_channels = i;
7929
7930         i = 0;
7931         if (n_ssids) {
7932                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7933                                     tmp) {
7934                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7935                                 err = -EINVAL;
7936                                 goto out_free;
7937                         }
7938                         request->ssids[i].ssid_len = nla_len(attr);
7939                         memcpy(request->ssids[i].ssid, nla_data(attr),
7940                                nla_len(attr));
7941                         i++;
7942                 }
7943         }
7944
7945         i = 0;
7946         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7947                 nla_for_each_nested(attr,
7948                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7949                                     tmp) {
7950                         struct nlattr *ssid, *bssid, *rssi;
7951
7952                         err = nla_parse_nested_deprecated(tb,
7953                                                           NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7954                                                           attr,
7955                                                           nl80211_match_policy,
7956                                                           NULL);
7957                         if (err)
7958                                 goto out_free;
7959                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
7960                         bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
7961
7962                         if (!ssid && !bssid) {
7963                                 i++;
7964                                 continue;
7965                         }
7966
7967                         if (WARN_ON(i >= n_match_sets)) {
7968                                 /* this indicates a programming error,
7969                                  * the loop above should have verified
7970                                  * things properly
7971                                  */
7972                                 err = -EINVAL;
7973                                 goto out_free;
7974                         }
7975
7976                         if (ssid) {
7977                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
7978                                         err = -EINVAL;
7979                                         goto out_free;
7980                                 }
7981                                 memcpy(request->match_sets[i].ssid.ssid,
7982                                        nla_data(ssid), nla_len(ssid));
7983                                 request->match_sets[i].ssid.ssid_len =
7984                                         nla_len(ssid);
7985                         }
7986                         if (bssid) {
7987                                 if (nla_len(bssid) != ETH_ALEN) {
7988                                         err = -EINVAL;
7989                                         goto out_free;
7990                                 }
7991                                 memcpy(request->match_sets[i].bssid,
7992                                        nla_data(bssid), ETH_ALEN);
7993                         }
7994
7995                         /* special attribute - old implementation w/a */
7996                         request->match_sets[i].rssi_thold = default_match_rssi;
7997                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7998                         if (rssi)
7999                                 request->match_sets[i].rssi_thold =
8000                                         nla_get_s32(rssi);
8001
8002                         /* Parse per band RSSI attribute */
8003                         err = nl80211_parse_sched_scan_per_band_rssi(wiphy,
8004                                 &request->match_sets[i],
8005                                 tb[NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI],
8006                                 request->match_sets[i].rssi_thold);
8007                         if (err)
8008                                 goto out_free;
8009
8010                         i++;
8011                 }
8012
8013                 /* there was no other matchset, so the RSSI one is alone */
8014                 if (i == 0 && n_match_sets)
8015                         request->match_sets[0].rssi_thold = default_match_rssi;
8016
8017                 request->min_rssi_thold = INT_MAX;
8018                 for (i = 0; i < n_match_sets; i++)
8019                         request->min_rssi_thold =
8020                                 min(request->match_sets[i].rssi_thold,
8021                                     request->min_rssi_thold);
8022         } else {
8023                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
8024         }
8025
8026         if (ie_len) {
8027                 request->ie_len = ie_len;
8028                 memcpy((void *)request->ie,
8029                        nla_data(attrs[NL80211_ATTR_IE]),
8030                        request->ie_len);
8031         }
8032
8033         err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
8034         if (err)
8035                 goto out_free;
8036
8037         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
8038                 request->delay =
8039                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
8040
8041         if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
8042                 request->relative_rssi = nla_get_s8(
8043                         attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
8044                 request->relative_rssi_set = true;
8045         }
8046
8047         if (request->relative_rssi_set &&
8048             attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
8049                 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
8050
8051                 rssi_adjust = nla_data(
8052                         attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
8053                 request->rssi_adjust.band = rssi_adjust->band;
8054                 request->rssi_adjust.delta = rssi_adjust->delta;
8055                 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
8056                         err = -EINVAL;
8057                         goto out_free;
8058                 }
8059         }
8060
8061         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
8062         if (err)
8063                 goto out_free;
8064
8065         request->scan_start = jiffies;
8066
8067         return request;
8068
8069 out_free:
8070         kfree(request);
8071         return ERR_PTR(err);
8072 }
8073
8074 static int nl80211_start_sched_scan(struct sk_buff *skb,
8075                                     struct genl_info *info)
8076 {
8077         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8078         struct net_device *dev = info->user_ptr[1];
8079         struct wireless_dev *wdev = dev->ieee80211_ptr;
8080         struct cfg80211_sched_scan_request *sched_scan_req;
8081         bool want_multi;
8082         int err;
8083
8084         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
8085                 return -EOPNOTSUPP;
8086
8087         want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
8088         err = cfg80211_sched_scan_req_possible(rdev, want_multi);
8089         if (err)
8090                 return err;
8091
8092         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
8093                                                   info->attrs,
8094                                                   rdev->wiphy.max_match_sets);
8095
8096         err = PTR_ERR_OR_ZERO(sched_scan_req);
8097         if (err)
8098                 goto out_err;
8099
8100         /* leave request id zero for legacy request
8101          * or if driver does not support multi-scheduled scan
8102          */
8103         if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1) {
8104                 while (!sched_scan_req->reqid)
8105                         sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
8106         }
8107
8108         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
8109         if (err)
8110                 goto out_free;
8111
8112         sched_scan_req->dev = dev;
8113         sched_scan_req->wiphy = &rdev->wiphy;
8114
8115         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
8116                 sched_scan_req->owner_nlportid = info->snd_portid;
8117
8118         cfg80211_add_sched_scan_req(rdev, sched_scan_req);
8119
8120         nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
8121         return 0;
8122
8123 out_free:
8124         kfree(sched_scan_req);
8125 out_err:
8126         return err;
8127 }
8128
8129 static int nl80211_stop_sched_scan(struct sk_buff *skb,
8130                                    struct genl_info *info)
8131 {
8132         struct cfg80211_sched_scan_request *req;
8133         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8134         u64 cookie;
8135
8136         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
8137                 return -EOPNOTSUPP;
8138
8139         if (info->attrs[NL80211_ATTR_COOKIE]) {
8140                 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
8141                 return __cfg80211_stop_sched_scan(rdev, cookie, false);
8142         }
8143
8144         req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
8145                                      struct cfg80211_sched_scan_request,
8146                                      list);
8147         if (!req || req->reqid ||
8148             (req->owner_nlportid &&
8149              req->owner_nlportid != info->snd_portid))
8150                 return -ENOENT;
8151
8152         return cfg80211_stop_sched_scan_req(rdev, req, false);
8153 }
8154
8155 static int nl80211_start_radar_detection(struct sk_buff *skb,
8156                                          struct genl_info *info)
8157 {
8158         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8159         struct net_device *dev = info->user_ptr[1];
8160         struct wireless_dev *wdev = dev->ieee80211_ptr;
8161         struct wiphy *wiphy = wdev->wiphy;
8162         struct cfg80211_chan_def chandef;
8163         enum nl80211_dfs_regions dfs_region;
8164         unsigned int cac_time_ms;
8165         int err;
8166
8167         dfs_region = reg_get_dfs_region(wiphy);
8168         if (dfs_region == NL80211_DFS_UNSET)
8169                 return -EINVAL;
8170
8171         err = nl80211_parse_chandef(rdev, info, &chandef);
8172         if (err)
8173                 return err;
8174
8175         if (netif_carrier_ok(dev))
8176                 return -EBUSY;
8177
8178         if (wdev->cac_started)
8179                 return -EBUSY;
8180
8181         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
8182         if (err < 0)
8183                 return err;
8184
8185         if (err == 0)
8186                 return -EINVAL;
8187
8188         if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
8189                 return -EINVAL;
8190
8191         /* CAC start is offloaded to HW and can't be started manually */
8192         if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
8193                 return -EOPNOTSUPP;
8194
8195         if (!rdev->ops->start_radar_detection)
8196                 return -EOPNOTSUPP;
8197
8198         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
8199         if (WARN_ON(!cac_time_ms))
8200                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
8201
8202         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
8203         if (!err) {
8204                 wdev->chandef = chandef;
8205                 wdev->cac_started = true;
8206                 wdev->cac_start_time = jiffies;
8207                 wdev->cac_time_ms = cac_time_ms;
8208         }
8209         return err;
8210 }
8211
8212 static int nl80211_notify_radar_detection(struct sk_buff *skb,
8213                                           struct genl_info *info)
8214 {
8215         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8216         struct net_device *dev = info->user_ptr[1];
8217         struct wireless_dev *wdev = dev->ieee80211_ptr;
8218         struct wiphy *wiphy = wdev->wiphy;
8219         struct cfg80211_chan_def chandef;
8220         enum nl80211_dfs_regions dfs_region;
8221         int err;
8222
8223         dfs_region = reg_get_dfs_region(wiphy);
8224         if (dfs_region == NL80211_DFS_UNSET) {
8225                 GENL_SET_ERR_MSG(info,
8226                                  "DFS Region is not set. Unexpected Radar indication");
8227                 return -EINVAL;
8228         }
8229
8230         err = nl80211_parse_chandef(rdev, info, &chandef);
8231         if (err) {
8232                 GENL_SET_ERR_MSG(info, "Unable to extract chandef info");
8233                 return err;
8234         }
8235
8236         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
8237         if (err < 0) {
8238                 GENL_SET_ERR_MSG(info, "chandef is invalid");
8239                 return err;
8240         }
8241
8242         if (err == 0) {
8243                 GENL_SET_ERR_MSG(info,
8244                                  "Unexpected Radar indication for chandef/iftype");
8245                 return -EINVAL;
8246         }
8247
8248         /* Do not process this notification if radar is already detected
8249          * by kernel on this channel, and return success.
8250          */
8251         if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE)
8252                 return 0;
8253
8254         cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE);
8255
8256         cfg80211_sched_dfs_chan_update(rdev);
8257
8258         rdev->radar_chandef = chandef;
8259
8260         /* Propagate this notification to other radios as well */
8261         queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
8262
8263         return 0;
8264 }
8265
8266 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
8267 {
8268         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8269         struct net_device *dev = info->user_ptr[1];
8270         struct wireless_dev *wdev = dev->ieee80211_ptr;
8271         struct cfg80211_csa_settings params;
8272         /* csa_attrs is defined static to avoid waste of stack size - this
8273          * function is called under RTNL lock, so this should not be a problem.
8274          */
8275         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
8276         int err;
8277         bool need_new_beacon = false;
8278         bool need_handle_dfs_flag = true;
8279         int len, i;
8280         u32 cs_count;
8281
8282         if (!rdev->ops->channel_switch ||
8283             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
8284                 return -EOPNOTSUPP;
8285
8286         switch (dev->ieee80211_ptr->iftype) {
8287         case NL80211_IFTYPE_AP:
8288         case NL80211_IFTYPE_P2P_GO:
8289                 need_new_beacon = true;
8290                 /* For all modes except AP the handle_dfs flag needs to be
8291                  * supplied to tell the kernel that userspace will handle radar
8292                  * events when they happen. Otherwise a switch to a channel
8293                  * requiring DFS will be rejected.
8294                  */
8295                 need_handle_dfs_flag = false;
8296
8297                 /* useless if AP is not running */
8298                 if (!wdev->beacon_interval)
8299                         return -ENOTCONN;
8300                 break;
8301         case NL80211_IFTYPE_ADHOC:
8302                 if (!wdev->ssid_len)
8303                         return -ENOTCONN;
8304                 break;
8305         case NL80211_IFTYPE_MESH_POINT:
8306                 if (!wdev->mesh_id_len)
8307                         return -ENOTCONN;
8308                 break;
8309         default:
8310                 return -EOPNOTSUPP;
8311         }
8312
8313         memset(&params, 0, sizeof(params));
8314         params.beacon_csa.ftm_responder = -1;
8315
8316         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
8317             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
8318                 return -EINVAL;
8319
8320         /* only important for AP, IBSS and mesh create IEs internally */
8321         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
8322                 return -EINVAL;
8323
8324         /* Even though the attribute is u32, the specification says
8325          * u8, so let's make sure we don't overflow.
8326          */
8327         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
8328         if (cs_count > 255)
8329                 return -EINVAL;
8330
8331         params.count = cs_count;
8332
8333         if (!need_new_beacon)
8334                 goto skip_beacons;
8335
8336         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_after);
8337         if (err)
8338                 return err;
8339
8340         err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
8341                                           info->attrs[NL80211_ATTR_CSA_IES],
8342                                           nl80211_policy, info->extack);
8343         if (err)
8344                 return err;
8345
8346         err = nl80211_parse_beacon(rdev, csa_attrs, &params.beacon_csa);
8347         if (err)
8348                 return err;
8349
8350         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
8351                 return -EINVAL;
8352
8353         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
8354         if (!len || (len % sizeof(u16)))
8355                 return -EINVAL;
8356
8357         params.n_counter_offsets_beacon = len / sizeof(u16);
8358         if (rdev->wiphy.max_num_csa_counters &&
8359             (params.n_counter_offsets_beacon >
8360              rdev->wiphy.max_num_csa_counters))
8361                 return -EINVAL;
8362
8363         params.counter_offsets_beacon =
8364                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
8365
8366         /* sanity checks - counters should fit and be the same */
8367         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
8368                 u16 offset = params.counter_offsets_beacon[i];
8369
8370                 if (offset >= params.beacon_csa.tail_len)
8371                         return -EINVAL;
8372
8373                 if (params.beacon_csa.tail[offset] != params.count)
8374                         return -EINVAL;
8375         }
8376
8377         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
8378                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
8379                 if (!len || (len % sizeof(u16)))
8380                         return -EINVAL;
8381
8382                 params.n_counter_offsets_presp = len / sizeof(u16);
8383                 if (rdev->wiphy.max_num_csa_counters &&
8384                     (params.n_counter_offsets_presp >
8385                      rdev->wiphy.max_num_csa_counters))
8386                         return -EINVAL;
8387
8388                 params.counter_offsets_presp =
8389                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
8390
8391                 /* sanity checks - counters should fit and be the same */
8392                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
8393                         u16 offset = params.counter_offsets_presp[i];
8394
8395                         if (offset >= params.beacon_csa.probe_resp_len)
8396                                 return -EINVAL;
8397
8398                         if (params.beacon_csa.probe_resp[offset] !=
8399                             params.count)
8400                                 return -EINVAL;
8401                 }
8402         }
8403
8404 skip_beacons:
8405         err = nl80211_parse_chandef(rdev, info, &params.chandef);
8406         if (err)
8407                 return err;
8408
8409         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
8410                                            wdev->iftype))
8411                 return -EINVAL;
8412
8413         err = cfg80211_chandef_dfs_required(wdev->wiphy,
8414                                             &params.chandef,
8415                                             wdev->iftype);
8416         if (err < 0)
8417                 return err;
8418
8419         if (err > 0) {
8420                 params.radar_required = true;
8421                 if (need_handle_dfs_flag &&
8422                     !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
8423                         return -EINVAL;
8424                 }
8425         }
8426
8427         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
8428                 params.block_tx = true;
8429
8430         wdev_lock(wdev);
8431         err = rdev_channel_switch(rdev, dev, &params);
8432         wdev_unlock(wdev);
8433
8434         return err;
8435 }
8436
8437 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
8438                             u32 seq, int flags,
8439                             struct cfg80211_registered_device *rdev,
8440                             struct wireless_dev *wdev,
8441                             struct cfg80211_internal_bss *intbss)
8442 {
8443         struct cfg80211_bss *res = &intbss->pub;
8444         const struct cfg80211_bss_ies *ies;
8445         void *hdr;
8446         struct nlattr *bss;
8447
8448         ASSERT_WDEV_LOCK(wdev);
8449
8450         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
8451                              NL80211_CMD_NEW_SCAN_RESULTS);
8452         if (!hdr)
8453                 return -1;
8454
8455         genl_dump_check_consistent(cb, hdr);
8456
8457         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
8458                 goto nla_put_failure;
8459         if (wdev->netdev &&
8460             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
8461                 goto nla_put_failure;
8462         if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
8463                               NL80211_ATTR_PAD))
8464                 goto nla_put_failure;
8465
8466         bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS);
8467         if (!bss)
8468                 goto nla_put_failure;
8469         if ((!is_zero_ether_addr(res->bssid) &&
8470              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
8471                 goto nla_put_failure;
8472
8473         rcu_read_lock();
8474         /* indicate whether we have probe response data or not */
8475         if (rcu_access_pointer(res->proberesp_ies) &&
8476             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
8477                 goto fail_unlock_rcu;
8478
8479         /* this pointer prefers to be pointed to probe response data
8480          * but is always valid
8481          */
8482         ies = rcu_dereference(res->ies);
8483         if (ies) {
8484                 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
8485                                       NL80211_BSS_PAD))
8486                         goto fail_unlock_rcu;
8487                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
8488                                         ies->len, ies->data))
8489                         goto fail_unlock_rcu;
8490         }
8491
8492         /* and this pointer is always (unless driver didn't know) beacon data */
8493         ies = rcu_dereference(res->beacon_ies);
8494         if (ies && ies->from_beacon) {
8495                 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
8496                                       NL80211_BSS_PAD))
8497                         goto fail_unlock_rcu;
8498                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
8499                                         ies->len, ies->data))
8500                         goto fail_unlock_rcu;
8501         }
8502         rcu_read_unlock();
8503
8504         if (res->beacon_interval &&
8505             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
8506                 goto nla_put_failure;
8507         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
8508             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
8509             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
8510             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
8511                         jiffies_to_msecs(jiffies - intbss->ts)))
8512                 goto nla_put_failure;
8513
8514         if (intbss->parent_tsf &&
8515             (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
8516                                intbss->parent_tsf, NL80211_BSS_PAD) ||
8517              nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
8518                      intbss->parent_bssid)))
8519                 goto nla_put_failure;
8520
8521         if (intbss->ts_boottime &&
8522             nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
8523                               intbss->ts_boottime, NL80211_BSS_PAD))
8524                 goto nla_put_failure;
8525
8526         if (!nl80211_put_signal(msg, intbss->pub.chains,
8527                                 intbss->pub.chain_signal,
8528                                 NL80211_BSS_CHAIN_SIGNAL))
8529                 goto nla_put_failure;
8530
8531         switch (rdev->wiphy.signal_type) {
8532         case CFG80211_SIGNAL_TYPE_MBM:
8533                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
8534                         goto nla_put_failure;
8535                 break;
8536         case CFG80211_SIGNAL_TYPE_UNSPEC:
8537                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
8538                         goto nla_put_failure;
8539                 break;
8540         default:
8541                 break;
8542         }
8543
8544         switch (wdev->iftype) {
8545         case NL80211_IFTYPE_P2P_CLIENT:
8546         case NL80211_IFTYPE_STATION:
8547                 if (intbss == wdev->current_bss &&
8548                     nla_put_u32(msg, NL80211_BSS_STATUS,
8549                                 NL80211_BSS_STATUS_ASSOCIATED))
8550                         goto nla_put_failure;
8551                 break;
8552         case NL80211_IFTYPE_ADHOC:
8553                 if (intbss == wdev->current_bss &&
8554                     nla_put_u32(msg, NL80211_BSS_STATUS,
8555                                 NL80211_BSS_STATUS_IBSS_JOINED))
8556                         goto nla_put_failure;
8557                 break;
8558         default:
8559                 break;
8560         }
8561
8562         nla_nest_end(msg, bss);
8563
8564         genlmsg_end(msg, hdr);
8565         return 0;
8566
8567  fail_unlock_rcu:
8568         rcu_read_unlock();
8569  nla_put_failure:
8570         genlmsg_cancel(msg, hdr);
8571         return -EMSGSIZE;
8572 }
8573
8574 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
8575 {
8576         struct cfg80211_registered_device *rdev;
8577         struct cfg80211_internal_bss *scan;
8578         struct wireless_dev *wdev;
8579         int start = cb->args[2], idx = 0;
8580         int err;
8581
8582         rtnl_lock();
8583         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
8584         if (err) {
8585                 rtnl_unlock();
8586                 return err;
8587         }
8588
8589         wdev_lock(wdev);
8590         spin_lock_bh(&rdev->bss_lock);
8591
8592         /*
8593          * dump_scan will be called multiple times to break up the scan results
8594          * into multiple messages.  It is unlikely that any more bss-es will be
8595          * expired after the first call, so only call only call this on the
8596          * first dump_scan invocation.
8597          */
8598         if (start == 0)
8599                 cfg80211_bss_expire(rdev);
8600
8601         cb->seq = rdev->bss_generation;
8602
8603         list_for_each_entry(scan, &rdev->bss_list, list) {
8604                 if (++idx <= start)
8605                         continue;
8606                 if (nl80211_send_bss(skb, cb,
8607                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8608                                 rdev, wdev, scan) < 0) {
8609                         idx--;
8610                         break;
8611                 }
8612         }
8613
8614         spin_unlock_bh(&rdev->bss_lock);
8615         wdev_unlock(wdev);
8616
8617         cb->args[2] = idx;
8618         rtnl_unlock();
8619
8620         return skb->len;
8621 }
8622
8623 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
8624                                int flags, struct net_device *dev,
8625                                bool allow_radio_stats,
8626                                struct survey_info *survey)
8627 {
8628         void *hdr;
8629         struct nlattr *infoattr;
8630
8631         /* skip radio stats if userspace didn't request them */
8632         if (!survey->channel && !allow_radio_stats)
8633                 return 0;
8634
8635         hdr = nl80211hdr_put(msg, portid, seq, flags,
8636                              NL80211_CMD_NEW_SURVEY_RESULTS);
8637         if (!hdr)
8638                 return -ENOMEM;
8639
8640         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
8641                 goto nla_put_failure;
8642
8643         infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO);
8644         if (!infoattr)
8645                 goto nla_put_failure;
8646
8647         if (survey->channel &&
8648             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
8649                         survey->channel->center_freq))
8650                 goto nla_put_failure;
8651
8652         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
8653             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
8654                 goto nla_put_failure;
8655         if ((survey->filled & SURVEY_INFO_IN_USE) &&
8656             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
8657                 goto nla_put_failure;
8658         if ((survey->filled & SURVEY_INFO_TIME) &&
8659             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
8660                         survey->time, NL80211_SURVEY_INFO_PAD))
8661                 goto nla_put_failure;
8662         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
8663             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
8664                               survey->time_busy, NL80211_SURVEY_INFO_PAD))
8665                 goto nla_put_failure;
8666         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
8667             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
8668                               survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
8669                 goto nla_put_failure;
8670         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
8671             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
8672                               survey->time_rx, NL80211_SURVEY_INFO_PAD))
8673                 goto nla_put_failure;
8674         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
8675             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
8676                               survey->time_tx, NL80211_SURVEY_INFO_PAD))
8677                 goto nla_put_failure;
8678         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
8679             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
8680                               survey->time_scan, NL80211_SURVEY_INFO_PAD))
8681                 goto nla_put_failure;
8682
8683         nla_nest_end(msg, infoattr);
8684
8685         genlmsg_end(msg, hdr);
8686         return 0;
8687
8688  nla_put_failure:
8689         genlmsg_cancel(msg, hdr);
8690         return -EMSGSIZE;
8691 }
8692
8693 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
8694 {
8695         struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
8696         struct survey_info survey;
8697         struct cfg80211_registered_device *rdev;
8698         struct wireless_dev *wdev;
8699         int survey_idx = cb->args[2];
8700         int res;
8701         bool radio_stats;
8702
8703         rtnl_lock();
8704         res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
8705         if (res)
8706                 goto out_err;
8707
8708         /* prepare_wdev_dump parsed the attributes */
8709         radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
8710
8711         if (!wdev->netdev) {
8712                 res = -EINVAL;
8713                 goto out_err;
8714         }
8715
8716         if (!rdev->ops->dump_survey) {
8717                 res = -EOPNOTSUPP;
8718                 goto out_err;
8719         }
8720
8721         while (1) {
8722                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
8723                 if (res == -ENOENT)
8724                         break;
8725                 if (res)
8726                         goto out_err;
8727
8728                 /* don't send disabled channels, but do send non-channel data */
8729                 if (survey.channel &&
8730                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
8731                         survey_idx++;
8732                         continue;
8733                 }
8734
8735                 if (nl80211_send_survey(skb,
8736                                 NETLINK_CB(cb->skb).portid,
8737                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8738                                 wdev->netdev, radio_stats, &survey) < 0)
8739                         goto out;
8740                 survey_idx++;
8741         }
8742
8743  out:
8744         cb->args[2] = survey_idx;
8745         res = skb->len;
8746  out_err:
8747         rtnl_unlock();
8748         return res;
8749 }
8750
8751 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
8752 {
8753         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
8754                                   NL80211_WPA_VERSION_2));
8755 }
8756
8757 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
8758 {
8759         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8760         struct net_device *dev = info->user_ptr[1];
8761         struct ieee80211_channel *chan;
8762         const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL;
8763         int err, ssid_len, ie_len = 0, auth_data_len = 0;
8764         enum nl80211_auth_type auth_type;
8765         struct key_parse key;
8766         bool local_state_change;
8767
8768         if (!info->attrs[NL80211_ATTR_MAC])
8769                 return -EINVAL;
8770
8771         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
8772                 return -EINVAL;
8773
8774         if (!info->attrs[NL80211_ATTR_SSID])
8775                 return -EINVAL;
8776
8777         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
8778                 return -EINVAL;
8779
8780         err = nl80211_parse_key(info, &key);
8781         if (err)
8782                 return err;
8783
8784         if (key.idx >= 0) {
8785                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
8786                         return -EINVAL;
8787                 if (!key.p.key || !key.p.key_len)
8788                         return -EINVAL;
8789                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
8790                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
8791                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
8792                      key.p.key_len != WLAN_KEY_LEN_WEP104))
8793                         return -EINVAL;
8794                 if (key.idx > 3)
8795                         return -EINVAL;
8796         } else {
8797                 key.p.key_len = 0;
8798                 key.p.key = NULL;
8799         }
8800
8801         if (key.idx >= 0) {
8802                 int i;
8803                 bool ok = false;
8804
8805                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
8806                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
8807                                 ok = true;
8808                                 break;
8809                         }
8810                 }
8811                 if (!ok)
8812                         return -EINVAL;
8813         }
8814
8815         if (!rdev->ops->auth)
8816                 return -EOPNOTSUPP;
8817
8818         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8819             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8820                 return -EOPNOTSUPP;
8821
8822         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8823         chan = nl80211_get_valid_chan(&rdev->wiphy,
8824                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8825         if (!chan)
8826                 return -EINVAL;
8827
8828         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8829         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8830
8831         if (info->attrs[NL80211_ATTR_IE]) {
8832                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8833                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8834         }
8835
8836         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8837         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
8838                 return -EINVAL;
8839
8840         if ((auth_type == NL80211_AUTHTYPE_SAE ||
8841              auth_type == NL80211_AUTHTYPE_FILS_SK ||
8842              auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
8843              auth_type == NL80211_AUTHTYPE_FILS_PK) &&
8844             !info->attrs[NL80211_ATTR_AUTH_DATA])
8845                 return -EINVAL;
8846
8847         if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
8848                 if (auth_type != NL80211_AUTHTYPE_SAE &&
8849                     auth_type != NL80211_AUTHTYPE_FILS_SK &&
8850                     auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
8851                     auth_type != NL80211_AUTHTYPE_FILS_PK)
8852                         return -EINVAL;
8853                 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
8854                 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
8855                 /* need to include at least Auth Transaction and Status Code */
8856                 if (auth_data_len < 4)
8857                         return -EINVAL;
8858         }
8859
8860         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8861
8862         /*
8863          * Since we no longer track auth state, ignore
8864          * requests to only change local state.
8865          */
8866         if (local_state_change)
8867                 return 0;
8868
8869         wdev_lock(dev->ieee80211_ptr);
8870         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
8871                                  ssid, ssid_len, ie, ie_len,
8872                                  key.p.key, key.p.key_len, key.idx,
8873                                  auth_data, auth_data_len);
8874         wdev_unlock(dev->ieee80211_ptr);
8875         return err;
8876 }
8877
8878 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
8879                                      struct genl_info *info)
8880 {
8881         if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8882                 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
8883                 return -EINVAL;
8884         }
8885
8886         if (!rdev->ops->tx_control_port ||
8887             !wiphy_ext_feature_isset(&rdev->wiphy,
8888                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
8889                 return -EOPNOTSUPP;
8890
8891         return 0;
8892 }
8893
8894 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
8895                                    struct genl_info *info,
8896                                    struct cfg80211_crypto_settings *settings,
8897                                    int cipher_limit)
8898 {
8899         memset(settings, 0, sizeof(*settings));
8900
8901         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
8902
8903         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
8904                 u16 proto;
8905
8906                 proto = nla_get_u16(
8907                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
8908                 settings->control_port_ethertype = cpu_to_be16(proto);
8909                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
8910                     proto != ETH_P_PAE)
8911                         return -EINVAL;
8912                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
8913                         settings->control_port_no_encrypt = true;
8914         } else
8915                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
8916
8917         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
8918                 int r = validate_pae_over_nl80211(rdev, info);
8919
8920                 if (r < 0)
8921                         return r;
8922
8923                 settings->control_port_over_nl80211 = true;
8924         }
8925
8926         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
8927                 void *data;
8928                 int len, i;
8929
8930                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8931                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8932                 settings->n_ciphers_pairwise = len / sizeof(u32);
8933
8934                 if (len % sizeof(u32))
8935                         return -EINVAL;
8936
8937                 if (settings->n_ciphers_pairwise > cipher_limit)
8938                         return -EINVAL;
8939
8940                 memcpy(settings->ciphers_pairwise, data, len);
8941
8942                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
8943                         if (!cfg80211_supported_cipher_suite(
8944                                         &rdev->wiphy,
8945                                         settings->ciphers_pairwise[i]))
8946                                 return -EINVAL;
8947         }
8948
8949         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
8950                 settings->cipher_group =
8951                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
8952                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
8953                                                      settings->cipher_group))
8954                         return -EINVAL;
8955         }
8956
8957         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
8958                 settings->wpa_versions =
8959                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
8960                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
8961                         return -EINVAL;
8962         }
8963
8964         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
8965                 void *data;
8966                 int len;
8967
8968                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
8969                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
8970                 settings->n_akm_suites = len / sizeof(u32);
8971
8972                 if (len % sizeof(u32))
8973                         return -EINVAL;
8974
8975                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
8976                         return -EINVAL;
8977
8978                 memcpy(settings->akm_suites, data, len);
8979         }
8980
8981         if (info->attrs[NL80211_ATTR_PMK]) {
8982                 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
8983                         return -EINVAL;
8984                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8985                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK))
8986                         return -EINVAL;
8987                 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
8988         }
8989
8990         return 0;
8991 }
8992
8993 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
8994 {
8995         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8996         struct net_device *dev = info->user_ptr[1];
8997         struct ieee80211_channel *chan;
8998         struct cfg80211_assoc_request req = {};
8999         const u8 *bssid, *ssid;
9000         int err, ssid_len = 0;
9001
9002         if (dev->ieee80211_ptr->conn_owner_nlportid &&
9003             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9004                 return -EPERM;
9005
9006         if (!info->attrs[NL80211_ATTR_MAC] ||
9007             !info->attrs[NL80211_ATTR_SSID] ||
9008             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
9009                 return -EINVAL;
9010
9011         if (!rdev->ops->assoc)
9012                 return -EOPNOTSUPP;
9013
9014         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9015             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9016                 return -EOPNOTSUPP;
9017
9018         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9019
9020         chan = nl80211_get_valid_chan(&rdev->wiphy,
9021                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
9022         if (!chan)
9023                 return -EINVAL;
9024
9025         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9026         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9027
9028         if (info->attrs[NL80211_ATTR_IE]) {
9029                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9030                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9031         }
9032
9033         if (info->attrs[NL80211_ATTR_USE_MFP]) {
9034                 enum nl80211_mfp mfp =
9035                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
9036                 if (mfp == NL80211_MFP_REQUIRED)
9037                         req.use_mfp = true;
9038                 else if (mfp != NL80211_MFP_NO)
9039                         return -EINVAL;
9040         }
9041
9042         if (info->attrs[NL80211_ATTR_PREV_BSSID])
9043                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
9044
9045         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
9046                 req.flags |= ASSOC_REQ_DISABLE_HT;
9047
9048         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9049                 memcpy(&req.ht_capa_mask,
9050                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
9051                        sizeof(req.ht_capa_mask));
9052
9053         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9054                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9055                         return -EINVAL;
9056                 memcpy(&req.ht_capa,
9057                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9058                        sizeof(req.ht_capa));
9059         }
9060
9061         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
9062                 req.flags |= ASSOC_REQ_DISABLE_VHT;
9063
9064         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
9065                 memcpy(&req.vht_capa_mask,
9066                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
9067                        sizeof(req.vht_capa_mask));
9068
9069         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
9070                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
9071                         return -EINVAL;
9072                 memcpy(&req.vht_capa,
9073                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
9074                        sizeof(req.vht_capa));
9075         }
9076
9077         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
9078                 if (!((rdev->wiphy.features &
9079                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
9080                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
9081                     !wiphy_ext_feature_isset(&rdev->wiphy,
9082                                              NL80211_EXT_FEATURE_RRM))
9083                         return -EINVAL;
9084                 req.flags |= ASSOC_REQ_USE_RRM;
9085         }
9086
9087         if (info->attrs[NL80211_ATTR_FILS_KEK]) {
9088                 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
9089                 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
9090                 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
9091                         return -EINVAL;
9092                 req.fils_nonces =
9093                         nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
9094         }
9095
9096         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
9097         if (!err) {
9098                 wdev_lock(dev->ieee80211_ptr);
9099
9100                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
9101                                           ssid, ssid_len, &req);
9102
9103                 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9104                         dev->ieee80211_ptr->conn_owner_nlportid =
9105                                 info->snd_portid;
9106                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
9107                                bssid, ETH_ALEN);
9108                 }
9109
9110                 wdev_unlock(dev->ieee80211_ptr);
9111         }
9112
9113         return err;
9114 }
9115
9116 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
9117 {
9118         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9119         struct net_device *dev = info->user_ptr[1];
9120         const u8 *ie = NULL, *bssid;
9121         int ie_len = 0, err;
9122         u16 reason_code;
9123         bool local_state_change;
9124
9125         if (dev->ieee80211_ptr->conn_owner_nlportid &&
9126             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9127                 return -EPERM;
9128
9129         if (!info->attrs[NL80211_ATTR_MAC])
9130                 return -EINVAL;
9131
9132         if (!info->attrs[NL80211_ATTR_REASON_CODE])
9133                 return -EINVAL;
9134
9135         if (!rdev->ops->deauth)
9136                 return -EOPNOTSUPP;
9137
9138         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9139             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9140                 return -EOPNOTSUPP;
9141
9142         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9143
9144         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9145         if (reason_code == 0) {
9146                 /* Reason Code 0 is reserved */
9147                 return -EINVAL;
9148         }
9149
9150         if (info->attrs[NL80211_ATTR_IE]) {
9151                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9152                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9153         }
9154
9155         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
9156
9157         wdev_lock(dev->ieee80211_ptr);
9158         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
9159                                    local_state_change);
9160         wdev_unlock(dev->ieee80211_ptr);
9161         return err;
9162 }
9163
9164 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
9165 {
9166         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9167         struct net_device *dev = info->user_ptr[1];
9168         const u8 *ie = NULL, *bssid;
9169         int ie_len = 0, err;
9170         u16 reason_code;
9171         bool local_state_change;
9172
9173         if (dev->ieee80211_ptr->conn_owner_nlportid &&
9174             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9175                 return -EPERM;
9176
9177         if (!info->attrs[NL80211_ATTR_MAC])
9178                 return -EINVAL;
9179
9180         if (!info->attrs[NL80211_ATTR_REASON_CODE])
9181                 return -EINVAL;
9182
9183         if (!rdev->ops->disassoc)
9184                 return -EOPNOTSUPP;
9185
9186         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9187             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9188                 return -EOPNOTSUPP;
9189
9190         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9191
9192         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9193         if (reason_code == 0) {
9194                 /* Reason Code 0 is reserved */
9195                 return -EINVAL;
9196         }
9197
9198         if (info->attrs[NL80211_ATTR_IE]) {
9199                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9200                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9201         }
9202
9203         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
9204
9205         wdev_lock(dev->ieee80211_ptr);
9206         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
9207                                      local_state_change);
9208         wdev_unlock(dev->ieee80211_ptr);
9209         return err;
9210 }
9211
9212 static bool
9213 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
9214                          int mcast_rate[NUM_NL80211_BANDS],
9215                          int rateval)
9216 {
9217         struct wiphy *wiphy = &rdev->wiphy;
9218         bool found = false;
9219         int band, i;
9220
9221         for (band = 0; band < NUM_NL80211_BANDS; band++) {
9222                 struct ieee80211_supported_band *sband;
9223
9224                 sband = wiphy->bands[band];
9225                 if (!sband)
9226                         continue;
9227
9228                 for (i = 0; i < sband->n_bitrates; i++) {
9229                         if (sband->bitrates[i].bitrate == rateval) {
9230                                 mcast_rate[band] = i + 1;
9231                                 found = true;
9232                                 break;
9233                         }
9234                 }
9235         }
9236
9237         return found;
9238 }
9239
9240 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
9241 {
9242         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9243         struct net_device *dev = info->user_ptr[1];
9244         struct cfg80211_ibss_params ibss;
9245         struct wiphy *wiphy;
9246         struct cfg80211_cached_keys *connkeys = NULL;
9247         int err;
9248
9249         memset(&ibss, 0, sizeof(ibss));
9250
9251         if (!info->attrs[NL80211_ATTR_SSID] ||
9252             !nla_len(info->attrs[NL80211_ATTR_SSID]))
9253                 return -EINVAL;
9254
9255         ibss.beacon_interval = 100;
9256
9257         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
9258                 ibss.beacon_interval =
9259                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
9260
9261         err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
9262                                            ibss.beacon_interval);
9263         if (err)
9264                 return err;
9265
9266         if (!rdev->ops->join_ibss)
9267                 return -EOPNOTSUPP;
9268
9269         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
9270                 return -EOPNOTSUPP;
9271
9272         wiphy = &rdev->wiphy;
9273
9274         if (info->attrs[NL80211_ATTR_MAC]) {
9275                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9276
9277                 if (!is_valid_ether_addr(ibss.bssid))
9278                         return -EINVAL;
9279         }
9280         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9281         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9282
9283         if (info->attrs[NL80211_ATTR_IE]) {
9284                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9285                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9286         }
9287
9288         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
9289         if (err)
9290                 return err;
9291
9292         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
9293                                      NL80211_IFTYPE_ADHOC))
9294                 return -EINVAL;
9295
9296         switch (ibss.chandef.width) {
9297         case NL80211_CHAN_WIDTH_5:
9298         case NL80211_CHAN_WIDTH_10:
9299         case NL80211_CHAN_WIDTH_20_NOHT:
9300                 break;
9301         case NL80211_CHAN_WIDTH_20:
9302         case NL80211_CHAN_WIDTH_40:
9303                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
9304                         return -EINVAL;
9305                 break;
9306         case NL80211_CHAN_WIDTH_80:
9307         case NL80211_CHAN_WIDTH_80P80:
9308         case NL80211_CHAN_WIDTH_160:
9309                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
9310                         return -EINVAL;
9311                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
9312                                              NL80211_EXT_FEATURE_VHT_IBSS))
9313                         return -EINVAL;
9314                 break;
9315         default:
9316                 return -EINVAL;
9317         }
9318
9319         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
9320         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
9321
9322         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
9323                 u8 *rates =
9324                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9325                 int n_rates =
9326                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9327                 struct ieee80211_supported_band *sband =
9328                         wiphy->bands[ibss.chandef.chan->band];
9329
9330                 err = ieee80211_get_ratemask(sband, rates, n_rates,
9331                                              &ibss.basic_rates);
9332                 if (err)
9333                         return err;
9334         }
9335
9336         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9337                 memcpy(&ibss.ht_capa_mask,
9338                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
9339                        sizeof(ibss.ht_capa_mask));
9340
9341         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9342                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9343                         return -EINVAL;
9344                 memcpy(&ibss.ht_capa,
9345                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9346                        sizeof(ibss.ht_capa));
9347         }
9348
9349         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
9350             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
9351                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
9352                 return -EINVAL;
9353
9354         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
9355                 bool no_ht = false;
9356
9357                 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
9358                 if (IS_ERR(connkeys))
9359                         return PTR_ERR(connkeys);
9360
9361                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
9362                     no_ht) {
9363                         kzfree(connkeys);
9364                         return -EINVAL;
9365                 }
9366         }
9367
9368         ibss.control_port =
9369                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
9370
9371         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
9372                 int r = validate_pae_over_nl80211(rdev, info);
9373
9374                 if (r < 0) {
9375                         kzfree(connkeys);
9376                         return r;
9377                 }
9378
9379                 ibss.control_port_over_nl80211 = true;
9380         }
9381
9382         ibss.userspace_handles_dfs =
9383                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
9384
9385         wdev_lock(dev->ieee80211_ptr);
9386         err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
9387         if (err)
9388                 kzfree(connkeys);
9389         else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
9390                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
9391         wdev_unlock(dev->ieee80211_ptr);
9392
9393         return err;
9394 }
9395
9396 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
9397 {
9398         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9399         struct net_device *dev = info->user_ptr[1];
9400
9401         if (!rdev->ops->leave_ibss)
9402                 return -EOPNOTSUPP;
9403
9404         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
9405                 return -EOPNOTSUPP;
9406
9407         return cfg80211_leave_ibss(rdev, dev, false);
9408 }
9409
9410 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
9411 {
9412         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9413         struct net_device *dev = info->user_ptr[1];
9414         int mcast_rate[NUM_NL80211_BANDS];
9415         u32 nla_rate;
9416         int err;
9417
9418         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
9419             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
9420             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
9421                 return -EOPNOTSUPP;
9422
9423         if (!rdev->ops->set_mcast_rate)
9424                 return -EOPNOTSUPP;
9425
9426         memset(mcast_rate, 0, sizeof(mcast_rate));
9427
9428         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
9429                 return -EINVAL;
9430
9431         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
9432         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
9433                 return -EINVAL;
9434
9435         err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
9436
9437         return err;
9438 }
9439
9440 static struct sk_buff *
9441 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
9442                             struct wireless_dev *wdev, int approxlen,
9443                             u32 portid, u32 seq, enum nl80211_commands cmd,
9444                             enum nl80211_attrs attr,
9445                             const struct nl80211_vendor_cmd_info *info,
9446                             gfp_t gfp)
9447 {
9448         struct sk_buff *skb;
9449         void *hdr;
9450         struct nlattr *data;
9451
9452         skb = nlmsg_new(approxlen + 100, gfp);
9453         if (!skb)
9454                 return NULL;
9455
9456         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
9457         if (!hdr) {
9458                 kfree_skb(skb);
9459                 return NULL;
9460         }
9461
9462         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
9463                 goto nla_put_failure;
9464
9465         if (info) {
9466                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
9467                                 info->vendor_id))
9468                         goto nla_put_failure;
9469                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
9470                                 info->subcmd))
9471                         goto nla_put_failure;
9472         }
9473
9474         if (wdev) {
9475                 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
9476                                       wdev_id(wdev), NL80211_ATTR_PAD))
9477                         goto nla_put_failure;
9478                 if (wdev->netdev &&
9479                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
9480                                 wdev->netdev->ifindex))
9481                         goto nla_put_failure;
9482         }
9483
9484         data = nla_nest_start_noflag(skb, attr);
9485         if (!data)
9486                 goto nla_put_failure;
9487
9488         ((void **)skb->cb)[0] = rdev;
9489         ((void **)skb->cb)[1] = hdr;
9490         ((void **)skb->cb)[2] = data;
9491
9492         return skb;
9493
9494  nla_put_failure:
9495         kfree_skb(skb);
9496         return NULL;
9497 }
9498
9499 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
9500                                            struct wireless_dev *wdev,
9501                                            enum nl80211_commands cmd,
9502                                            enum nl80211_attrs attr,
9503                                            unsigned int portid,
9504                                            int vendor_event_idx,
9505                                            int approxlen, gfp_t gfp)
9506 {
9507         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
9508         const struct nl80211_vendor_cmd_info *info;
9509
9510         switch (cmd) {
9511         case NL80211_CMD_TESTMODE:
9512                 if (WARN_ON(vendor_event_idx != -1))
9513                         return NULL;
9514                 info = NULL;
9515                 break;
9516         case NL80211_CMD_VENDOR:
9517                 if (WARN_ON(vendor_event_idx < 0 ||
9518                             vendor_event_idx >= wiphy->n_vendor_events))
9519                         return NULL;
9520                 info = &wiphy->vendor_events[vendor_event_idx];
9521                 break;
9522         default:
9523                 WARN_ON(1);
9524                 return NULL;
9525         }
9526
9527         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0,
9528                                            cmd, attr, info, gfp);
9529 }
9530 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
9531
9532 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
9533 {
9534         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
9535         void *hdr = ((void **)skb->cb)[1];
9536         struct nlmsghdr *nlhdr = nlmsg_hdr(skb);
9537         struct nlattr *data = ((void **)skb->cb)[2];
9538         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
9539
9540         /* clear CB data for netlink core to own from now on */
9541         memset(skb->cb, 0, sizeof(skb->cb));
9542
9543         nla_nest_end(skb, data);
9544         genlmsg_end(skb, hdr);
9545
9546         if (nlhdr->nlmsg_pid) {
9547                 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb,
9548                                 nlhdr->nlmsg_pid);
9549         } else {
9550                 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
9551                         mcgrp = NL80211_MCGRP_VENDOR;
9552
9553                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
9554                                         skb, 0, mcgrp, gfp);
9555         }
9556 }
9557 EXPORT_SYMBOL(__cfg80211_send_event_skb);
9558
9559 #ifdef CONFIG_NL80211_TESTMODE
9560 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
9561 {
9562         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9563         struct wireless_dev *wdev =
9564                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
9565         int err;
9566
9567         if (!rdev->ops->testmode_cmd)
9568                 return -EOPNOTSUPP;
9569
9570         if (IS_ERR(wdev)) {
9571                 err = PTR_ERR(wdev);
9572                 if (err != -EINVAL)
9573                         return err;
9574                 wdev = NULL;
9575         } else if (wdev->wiphy != &rdev->wiphy) {
9576                 return -EINVAL;
9577         }
9578
9579         if (!info->attrs[NL80211_ATTR_TESTDATA])
9580                 return -EINVAL;
9581
9582         rdev->cur_cmd_info = info;
9583         err = rdev_testmode_cmd(rdev, wdev,
9584                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
9585                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
9586         rdev->cur_cmd_info = NULL;
9587
9588         return err;
9589 }
9590
9591 static int nl80211_testmode_dump(struct sk_buff *skb,
9592                                  struct netlink_callback *cb)
9593 {
9594         struct cfg80211_registered_device *rdev;
9595         int err;
9596         long phy_idx;
9597         void *data = NULL;
9598         int data_len = 0;
9599
9600         rtnl_lock();
9601
9602         if (cb->args[0]) {
9603                 /*
9604                  * 0 is a valid index, but not valid for args[0],
9605                  * so we need to offset by 1.
9606                  */
9607                 phy_idx = cb->args[0] - 1;
9608
9609                 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
9610                 if (!rdev) {
9611                         err = -ENOENT;
9612                         goto out_err;
9613                 }
9614         } else {
9615                 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
9616
9617                 err = nlmsg_parse_deprecated(cb->nlh,
9618                                              GENL_HDRLEN + nl80211_fam.hdrsize,
9619                                              attrbuf, nl80211_fam.maxattr,
9620                                              nl80211_policy, NULL);
9621                 if (err)
9622                         goto out_err;
9623
9624                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
9625                 if (IS_ERR(rdev)) {
9626                         err = PTR_ERR(rdev);
9627                         goto out_err;
9628                 }
9629                 phy_idx = rdev->wiphy_idx;
9630
9631                 if (attrbuf[NL80211_ATTR_TESTDATA])
9632                         cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
9633         }
9634
9635         if (cb->args[1]) {
9636                 data = nla_data((void *)cb->args[1]);
9637                 data_len = nla_len((void *)cb->args[1]);
9638         }
9639
9640         if (!rdev->ops->testmode_dump) {
9641                 err = -EOPNOTSUPP;
9642                 goto out_err;
9643         }
9644
9645         while (1) {
9646                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
9647                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
9648                                            NL80211_CMD_TESTMODE);
9649                 struct nlattr *tmdata;
9650
9651                 if (!hdr)
9652                         break;
9653
9654                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
9655                         genlmsg_cancel(skb, hdr);
9656                         break;
9657                 }
9658
9659                 tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA);
9660                 if (!tmdata) {
9661                         genlmsg_cancel(skb, hdr);
9662                         break;
9663                 }
9664                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
9665                 nla_nest_end(skb, tmdata);
9666
9667                 if (err == -ENOBUFS || err == -ENOENT) {
9668                         genlmsg_cancel(skb, hdr);
9669                         break;
9670                 } else if (err) {
9671                         genlmsg_cancel(skb, hdr);
9672                         goto out_err;
9673                 }
9674
9675                 genlmsg_end(skb, hdr);
9676         }
9677
9678         err = skb->len;
9679         /* see above */
9680         cb->args[0] = phy_idx + 1;
9681  out_err:
9682         rtnl_unlock();
9683         return err;
9684 }
9685 #endif
9686
9687 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
9688 {
9689         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9690         struct net_device *dev = info->user_ptr[1];
9691         struct cfg80211_connect_params connect;
9692         struct wiphy *wiphy;
9693         struct cfg80211_cached_keys *connkeys = NULL;
9694         int err;
9695
9696         memset(&connect, 0, sizeof(connect));
9697
9698         if (!info->attrs[NL80211_ATTR_SSID] ||
9699             !nla_len(info->attrs[NL80211_ATTR_SSID]))
9700                 return -EINVAL;
9701
9702         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
9703                 connect.auth_type =
9704                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9705                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
9706                                              NL80211_CMD_CONNECT))
9707                         return -EINVAL;
9708         } else
9709                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
9710
9711         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
9712
9713         if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
9714             !wiphy_ext_feature_isset(&rdev->wiphy,
9715                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
9716                 return -EINVAL;
9717         connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
9718
9719         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
9720                                       NL80211_MAX_NR_CIPHER_SUITES);
9721         if (err)
9722                 return err;
9723
9724         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9725             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9726                 return -EOPNOTSUPP;
9727
9728         wiphy = &rdev->wiphy;
9729
9730         connect.bg_scan_period = -1;
9731         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
9732                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
9733                 connect.bg_scan_period =
9734                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
9735         }
9736
9737         if (info->attrs[NL80211_ATTR_MAC])
9738                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9739         else if (info->attrs[NL80211_ATTR_MAC_HINT])
9740                 connect.bssid_hint =
9741                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
9742         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9743         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9744
9745         if (info->attrs[NL80211_ATTR_IE]) {
9746                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9747                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9748         }
9749
9750         if (info->attrs[NL80211_ATTR_USE_MFP]) {
9751                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
9752                 if (connect.mfp == NL80211_MFP_OPTIONAL &&
9753                     !wiphy_ext_feature_isset(&rdev->wiphy,
9754                                              NL80211_EXT_FEATURE_MFP_OPTIONAL))
9755                         return -EOPNOTSUPP;
9756         } else {
9757                 connect.mfp = NL80211_MFP_NO;
9758         }
9759
9760         if (info->attrs[NL80211_ATTR_PREV_BSSID])
9761                 connect.prev_bssid =
9762                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
9763
9764         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9765                 connect.channel = nl80211_get_valid_chan(
9766                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
9767                 if (!connect.channel)
9768                         return -EINVAL;
9769         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
9770                 connect.channel_hint = nl80211_get_valid_chan(
9771                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
9772                 if (!connect.channel_hint)
9773                         return -EINVAL;
9774         }
9775
9776         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
9777                 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
9778                 if (IS_ERR(connkeys))
9779                         return PTR_ERR(connkeys);
9780         }
9781
9782         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
9783                 connect.flags |= ASSOC_REQ_DISABLE_HT;
9784
9785         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9786                 memcpy(&connect.ht_capa_mask,
9787                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
9788                        sizeof(connect.ht_capa_mask));
9789
9790         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9791                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
9792                         kzfree(connkeys);
9793                         return -EINVAL;
9794                 }
9795                 memcpy(&connect.ht_capa,
9796                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9797                        sizeof(connect.ht_capa));
9798         }
9799
9800         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
9801                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
9802
9803         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
9804                 memcpy(&connect.vht_capa_mask,
9805                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
9806                        sizeof(connect.vht_capa_mask));
9807
9808         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
9809                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
9810                         kzfree(connkeys);
9811                         return -EINVAL;
9812                 }
9813                 memcpy(&connect.vht_capa,
9814                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
9815                        sizeof(connect.vht_capa));
9816         }
9817
9818         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
9819                 if (!((rdev->wiphy.features &
9820                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
9821                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
9822                     !wiphy_ext_feature_isset(&rdev->wiphy,
9823                                              NL80211_EXT_FEATURE_RRM)) {
9824                         kzfree(connkeys);
9825                         return -EINVAL;
9826                 }
9827                 connect.flags |= ASSOC_REQ_USE_RRM;
9828         }
9829
9830         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
9831         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
9832                 kzfree(connkeys);
9833                 return -EOPNOTSUPP;
9834         }
9835
9836         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
9837                 /* bss selection makes no sense if bssid is set */
9838                 if (connect.bssid) {
9839                         kzfree(connkeys);
9840                         return -EINVAL;
9841                 }
9842
9843                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
9844                                        wiphy, &connect.bss_select);
9845                 if (err) {
9846                         kzfree(connkeys);
9847                         return err;
9848                 }
9849         }
9850
9851         if (wiphy_ext_feature_isset(&rdev->wiphy,
9852                                     NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
9853             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
9854             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
9855             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
9856             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9857                 connect.fils_erp_username =
9858                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9859                 connect.fils_erp_username_len =
9860                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9861                 connect.fils_erp_realm =
9862                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9863                 connect.fils_erp_realm_len =
9864                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9865                 connect.fils_erp_next_seq_num =
9866                         nla_get_u16(
9867                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
9868                 connect.fils_erp_rrk =
9869                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9870                 connect.fils_erp_rrk_len =
9871                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9872         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
9873                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
9874                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
9875                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9876                 kzfree(connkeys);
9877                 return -EINVAL;
9878         }
9879
9880         if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
9881                 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9882                         kzfree(connkeys);
9883                         GENL_SET_ERR_MSG(info,
9884                                          "external auth requires connection ownership");
9885                         return -EINVAL;
9886                 }
9887                 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
9888         }
9889
9890         wdev_lock(dev->ieee80211_ptr);
9891
9892         err = cfg80211_connect(rdev, dev, &connect, connkeys,
9893                                connect.prev_bssid);
9894         if (err)
9895                 kzfree(connkeys);
9896
9897         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9898                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
9899                 if (connect.bssid)
9900                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
9901                                connect.bssid, ETH_ALEN);
9902                 else
9903                         memset(dev->ieee80211_ptr->disconnect_bssid,
9904                                0, ETH_ALEN);
9905         }
9906
9907         wdev_unlock(dev->ieee80211_ptr);
9908
9909         return err;
9910 }
9911
9912 static int nl80211_update_connect_params(struct sk_buff *skb,
9913                                          struct genl_info *info)
9914 {
9915         struct cfg80211_connect_params connect = {};
9916         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9917         struct net_device *dev = info->user_ptr[1];
9918         struct wireless_dev *wdev = dev->ieee80211_ptr;
9919         bool fils_sk_offload;
9920         u32 auth_type;
9921         u32 changed = 0;
9922         int ret;
9923
9924         if (!rdev->ops->update_connect_params)
9925                 return -EOPNOTSUPP;
9926
9927         if (info->attrs[NL80211_ATTR_IE]) {
9928                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9929                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9930                 changed |= UPDATE_ASSOC_IES;
9931         }
9932
9933         fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
9934                                                   NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
9935
9936         /*
9937          * when driver supports fils-sk offload all attributes must be
9938          * provided. So the else covers "fils-sk-not-all" and
9939          * "no-fils-sk-any".
9940          */
9941         if (fils_sk_offload &&
9942             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
9943             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
9944             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
9945             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9946                 connect.fils_erp_username =
9947                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9948                 connect.fils_erp_username_len =
9949                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9950                 connect.fils_erp_realm =
9951                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9952                 connect.fils_erp_realm_len =
9953                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9954                 connect.fils_erp_next_seq_num =
9955                         nla_get_u16(
9956                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
9957                 connect.fils_erp_rrk =
9958                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9959                 connect.fils_erp_rrk_len =
9960                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9961                 changed |= UPDATE_FILS_ERP_INFO;
9962         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
9963                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
9964                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
9965                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9966                 return -EINVAL;
9967         }
9968
9969         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
9970                 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9971                 if (!nl80211_valid_auth_type(rdev, auth_type,
9972                                              NL80211_CMD_CONNECT))
9973                         return -EINVAL;
9974
9975                 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
9976                     fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
9977                         return -EINVAL;
9978
9979                 connect.auth_type = auth_type;
9980                 changed |= UPDATE_AUTH_TYPE;
9981         }
9982
9983         wdev_lock(dev->ieee80211_ptr);
9984         if (!wdev->current_bss)
9985                 ret = -ENOLINK;
9986         else
9987                 ret = rdev_update_connect_params(rdev, dev, &connect, changed);
9988         wdev_unlock(dev->ieee80211_ptr);
9989
9990         return ret;
9991 }
9992
9993 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
9994 {
9995         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9996         struct net_device *dev = info->user_ptr[1];
9997         u16 reason;
9998         int ret;
9999
10000         if (dev->ieee80211_ptr->conn_owner_nlportid &&
10001             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
10002                 return -EPERM;
10003
10004         if (!info->attrs[NL80211_ATTR_REASON_CODE])
10005                 reason = WLAN_REASON_DEAUTH_LEAVING;
10006         else
10007                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
10008
10009         if (reason == 0)
10010                 return -EINVAL;
10011
10012         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10013             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10014                 return -EOPNOTSUPP;
10015
10016         wdev_lock(dev->ieee80211_ptr);
10017         ret = cfg80211_disconnect(rdev, dev, reason, true);
10018         wdev_unlock(dev->ieee80211_ptr);
10019         return ret;
10020 }
10021
10022 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
10023 {
10024         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10025         struct net *net;
10026         int err;
10027
10028         if (info->attrs[NL80211_ATTR_PID]) {
10029                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
10030
10031                 net = get_net_ns_by_pid(pid);
10032         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
10033                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
10034
10035                 net = get_net_ns_by_fd(fd);
10036         } else {
10037                 return -EINVAL;
10038         }
10039
10040         if (IS_ERR(net))
10041                 return PTR_ERR(net);
10042
10043         err = 0;
10044
10045         /* check if anything to do */
10046         if (!net_eq(wiphy_net(&rdev->wiphy), net))
10047                 err = cfg80211_switch_netns(rdev, net);
10048
10049         put_net(net);
10050         return err;
10051 }
10052
10053 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
10054 {
10055         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10056         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
10057                         struct cfg80211_pmksa *pmksa) = NULL;
10058         struct net_device *dev = info->user_ptr[1];
10059         struct cfg80211_pmksa pmksa;
10060
10061         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
10062
10063         if (!info->attrs[NL80211_ATTR_PMKID])
10064                 return -EINVAL;
10065
10066         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
10067
10068         if (info->attrs[NL80211_ATTR_MAC]) {
10069                 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10070         } else if (info->attrs[NL80211_ATTR_SSID] &&
10071                    info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
10072                    (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
10073                     info->attrs[NL80211_ATTR_PMK])) {
10074                 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10075                 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10076                 pmksa.cache_id =
10077                         nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
10078         } else {
10079                 return -EINVAL;
10080         }
10081         if (info->attrs[NL80211_ATTR_PMK]) {
10082                 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
10083                 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
10084         }
10085
10086         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10087             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
10088             !(dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP &&
10089               wiphy_ext_feature_isset(&rdev->wiphy,
10090                                       NL80211_EXT_FEATURE_AP_PMKSA_CACHING)))
10091                 return -EOPNOTSUPP;
10092
10093         switch (info->genlhdr->cmd) {
10094         case NL80211_CMD_SET_PMKSA:
10095                 rdev_ops = rdev->ops->set_pmksa;
10096                 break;
10097         case NL80211_CMD_DEL_PMKSA:
10098                 rdev_ops = rdev->ops->del_pmksa;
10099                 break;
10100         default:
10101                 WARN_ON(1);
10102                 break;
10103         }
10104
10105         if (!rdev_ops)
10106                 return -EOPNOTSUPP;
10107
10108         return rdev_ops(&rdev->wiphy, dev, &pmksa);
10109 }
10110
10111 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
10112 {
10113         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10114         struct net_device *dev = info->user_ptr[1];
10115
10116         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10117             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10118                 return -EOPNOTSUPP;
10119
10120         if (!rdev->ops->flush_pmksa)
10121                 return -EOPNOTSUPP;
10122
10123         return rdev_flush_pmksa(rdev, dev);
10124 }
10125
10126 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
10127 {
10128         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10129         struct net_device *dev = info->user_ptr[1];
10130         u8 action_code, dialog_token;
10131         u32 peer_capability = 0;
10132         u16 status_code;
10133         u8 *peer;
10134         bool initiator;
10135
10136         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
10137             !rdev->ops->tdls_mgmt)
10138                 return -EOPNOTSUPP;
10139
10140         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
10141             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
10142             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
10143             !info->attrs[NL80211_ATTR_IE] ||
10144             !info->attrs[NL80211_ATTR_MAC])
10145                 return -EINVAL;
10146
10147         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10148         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
10149         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
10150         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
10151         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
10152         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
10153                 peer_capability =
10154                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
10155
10156         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
10157                               dialog_token, status_code, peer_capability,
10158                               initiator,
10159                               nla_data(info->attrs[NL80211_ATTR_IE]),
10160                               nla_len(info->attrs[NL80211_ATTR_IE]));
10161 }
10162
10163 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
10164 {
10165         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10166         struct net_device *dev = info->user_ptr[1];
10167         enum nl80211_tdls_operation operation;
10168         u8 *peer;
10169
10170         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
10171             !rdev->ops->tdls_oper)
10172                 return -EOPNOTSUPP;
10173
10174         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
10175             !info->attrs[NL80211_ATTR_MAC])
10176                 return -EINVAL;
10177
10178         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
10179         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10180
10181         return rdev_tdls_oper(rdev, dev, peer, operation);
10182 }
10183
10184 static int nl80211_remain_on_channel(struct sk_buff *skb,
10185                                      struct genl_info *info)
10186 {
10187         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10188         struct wireless_dev *wdev = info->user_ptr[1];
10189         struct cfg80211_chan_def chandef;
10190         const struct cfg80211_chan_def *compat_chandef;
10191         struct sk_buff *msg;
10192         void *hdr;
10193         u64 cookie;
10194         u32 duration;
10195         int err;
10196
10197         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
10198             !info->attrs[NL80211_ATTR_DURATION])
10199                 return -EINVAL;
10200
10201         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
10202
10203         if (!rdev->ops->remain_on_channel ||
10204             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
10205                 return -EOPNOTSUPP;
10206
10207         /*
10208          * We should be on that channel for at least a minimum amount of
10209          * time (10ms) but no longer than the driver supports.
10210          */
10211         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
10212             duration > rdev->wiphy.max_remain_on_channel_duration)
10213                 return -EINVAL;
10214
10215         err = nl80211_parse_chandef(rdev, info, &chandef);
10216         if (err)
10217                 return err;
10218
10219         wdev_lock(wdev);
10220         if (!cfg80211_off_channel_oper_allowed(wdev) &&
10221             !cfg80211_chandef_identical(&wdev->chandef, &chandef)) {
10222                 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef,
10223                                                              &chandef);
10224                 if (compat_chandef != &chandef) {
10225                         wdev_unlock(wdev);
10226                         return -EBUSY;
10227                 }
10228         }
10229         wdev_unlock(wdev);
10230
10231         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10232         if (!msg)
10233                 return -ENOMEM;
10234
10235         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10236                              NL80211_CMD_REMAIN_ON_CHANNEL);
10237         if (!hdr) {
10238                 err = -ENOBUFS;
10239                 goto free_msg;
10240         }
10241
10242         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
10243                                      duration, &cookie);
10244
10245         if (err)
10246                 goto free_msg;
10247
10248         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
10249                               NL80211_ATTR_PAD))
10250                 goto nla_put_failure;
10251
10252         genlmsg_end(msg, hdr);
10253
10254         return genlmsg_reply(msg, info);
10255
10256  nla_put_failure:
10257         err = -ENOBUFS;
10258  free_msg:
10259         nlmsg_free(msg);
10260         return err;
10261 }
10262
10263 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
10264                                             struct genl_info *info)
10265 {
10266         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10267         struct wireless_dev *wdev = info->user_ptr[1];
10268         u64 cookie;
10269
10270         if (!info->attrs[NL80211_ATTR_COOKIE])
10271                 return -EINVAL;
10272
10273         if (!rdev->ops->cancel_remain_on_channel)
10274                 return -EOPNOTSUPP;
10275
10276         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
10277
10278         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
10279 }
10280
10281 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
10282                                        struct genl_info *info)
10283 {
10284         struct cfg80211_bitrate_mask mask;
10285         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10286         struct net_device *dev = info->user_ptr[1];
10287         int err;
10288
10289         if (!rdev->ops->set_bitrate_mask)
10290                 return -EOPNOTSUPP;
10291
10292         err = nl80211_parse_tx_bitrate_mask(info, &mask);
10293         if (err)
10294                 return err;
10295
10296         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
10297 }
10298
10299 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
10300 {
10301         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10302         struct wireless_dev *wdev = info->user_ptr[1];
10303         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
10304
10305         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
10306                 return -EINVAL;
10307
10308         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
10309                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
10310
10311         switch (wdev->iftype) {
10312         case NL80211_IFTYPE_STATION:
10313         case NL80211_IFTYPE_ADHOC:
10314         case NL80211_IFTYPE_P2P_CLIENT:
10315         case NL80211_IFTYPE_AP:
10316         case NL80211_IFTYPE_AP_VLAN:
10317         case NL80211_IFTYPE_MESH_POINT:
10318         case NL80211_IFTYPE_P2P_GO:
10319         case NL80211_IFTYPE_P2P_DEVICE:
10320                 break;
10321         case NL80211_IFTYPE_NAN:
10322         default:
10323                 return -EOPNOTSUPP;
10324         }
10325
10326         /* not much point in registering if we can't reply */
10327         if (!rdev->ops->mgmt_tx)
10328                 return -EOPNOTSUPP;
10329
10330         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
10331                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
10332                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
10333 }
10334
10335 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
10336 {
10337         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10338         struct wireless_dev *wdev = info->user_ptr[1];
10339         struct cfg80211_chan_def chandef;
10340         int err;
10341         void *hdr = NULL;
10342         u64 cookie;
10343         struct sk_buff *msg = NULL;
10344         struct cfg80211_mgmt_tx_params params = {
10345                 .dont_wait_for_ack =
10346                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
10347         };
10348
10349         if (!info->attrs[NL80211_ATTR_FRAME])
10350                 return -EINVAL;
10351
10352         if (!rdev->ops->mgmt_tx)
10353                 return -EOPNOTSUPP;
10354
10355         switch (wdev->iftype) {
10356         case NL80211_IFTYPE_P2P_DEVICE:
10357                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
10358                         return -EINVAL;
10359         case NL80211_IFTYPE_STATION:
10360         case NL80211_IFTYPE_ADHOC:
10361         case NL80211_IFTYPE_P2P_CLIENT:
10362         case NL80211_IFTYPE_AP:
10363         case NL80211_IFTYPE_AP_VLAN:
10364         case NL80211_IFTYPE_MESH_POINT:
10365         case NL80211_IFTYPE_P2P_GO:
10366                 break;
10367         case NL80211_IFTYPE_NAN:
10368         default:
10369                 return -EOPNOTSUPP;
10370         }
10371
10372         if (info->attrs[NL80211_ATTR_DURATION]) {
10373                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
10374                         return -EINVAL;
10375                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
10376
10377                 /*
10378                  * We should wait on the channel for at least a minimum amount
10379                  * of time (10ms) but no longer than the driver supports.
10380                  */
10381                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
10382                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
10383                         return -EINVAL;
10384         }
10385
10386         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
10387
10388         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
10389                 return -EINVAL;
10390
10391         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
10392
10393         /* get the channel if any has been specified, otherwise pass NULL to
10394          * the driver. The latter will use the current one
10395          */
10396         chandef.chan = NULL;
10397         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
10398                 err = nl80211_parse_chandef(rdev, info, &chandef);
10399                 if (err)
10400                         return err;
10401         }
10402
10403         if (!chandef.chan && params.offchan)
10404                 return -EINVAL;
10405
10406         wdev_lock(wdev);
10407         if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) {
10408                 wdev_unlock(wdev);
10409                 return -EBUSY;
10410         }
10411         wdev_unlock(wdev);
10412
10413         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
10414         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
10415
10416         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
10417                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
10418                 int i;
10419
10420                 if (len % sizeof(u16))
10421                         return -EINVAL;
10422
10423                 params.n_csa_offsets = len / sizeof(u16);
10424                 params.csa_offsets =
10425                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
10426
10427                 /* check that all the offsets fit the frame */
10428                 for (i = 0; i < params.n_csa_offsets; i++) {
10429                         if (params.csa_offsets[i] >= params.len)
10430                                 return -EINVAL;
10431                 }
10432         }
10433
10434         if (!params.dont_wait_for_ack) {
10435                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10436                 if (!msg)
10437                         return -ENOMEM;
10438
10439                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10440                                      NL80211_CMD_FRAME);
10441                 if (!hdr) {
10442                         err = -ENOBUFS;
10443                         goto free_msg;
10444                 }
10445         }
10446
10447         params.chan = chandef.chan;
10448         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
10449         if (err)
10450                 goto free_msg;
10451
10452         if (msg) {
10453                 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
10454                                       NL80211_ATTR_PAD))
10455                         goto nla_put_failure;
10456
10457                 genlmsg_end(msg, hdr);
10458                 return genlmsg_reply(msg, info);
10459         }
10460
10461         return 0;
10462
10463  nla_put_failure:
10464         err = -ENOBUFS;
10465  free_msg:
10466         nlmsg_free(msg);
10467         return err;
10468 }
10469
10470 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
10471 {
10472         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10473         struct wireless_dev *wdev = info->user_ptr[1];
10474         u64 cookie;
10475
10476         if (!info->attrs[NL80211_ATTR_COOKIE])
10477                 return -EINVAL;
10478
10479         if (!rdev->ops->mgmt_tx_cancel_wait)
10480                 return -EOPNOTSUPP;
10481
10482         switch (wdev->iftype) {
10483         case NL80211_IFTYPE_STATION:
10484         case NL80211_IFTYPE_ADHOC:
10485         case NL80211_IFTYPE_P2P_CLIENT:
10486         case NL80211_IFTYPE_AP:
10487         case NL80211_IFTYPE_AP_VLAN:
10488         case NL80211_IFTYPE_P2P_GO:
10489         case NL80211_IFTYPE_P2P_DEVICE:
10490                 break;
10491         case NL80211_IFTYPE_NAN:
10492         default:
10493                 return -EOPNOTSUPP;
10494         }
10495
10496         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
10497
10498         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
10499 }
10500
10501 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
10502 {
10503         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10504         struct wireless_dev *wdev;
10505         struct net_device *dev = info->user_ptr[1];
10506         u8 ps_state;
10507         bool state;
10508         int err;
10509
10510         if (!info->attrs[NL80211_ATTR_PS_STATE])
10511                 return -EINVAL;
10512
10513         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
10514
10515         wdev = dev->ieee80211_ptr;
10516
10517         if (!rdev->ops->set_power_mgmt)
10518                 return -EOPNOTSUPP;
10519
10520         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
10521
10522         if (state == wdev->ps)
10523                 return 0;
10524
10525         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
10526         if (!err)
10527                 wdev->ps = state;
10528         return err;
10529 }
10530
10531 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
10532 {
10533         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10534         enum nl80211_ps_state ps_state;
10535         struct wireless_dev *wdev;
10536         struct net_device *dev = info->user_ptr[1];
10537         struct sk_buff *msg;
10538         void *hdr;
10539         int err;
10540
10541         wdev = dev->ieee80211_ptr;
10542
10543         if (!rdev->ops->set_power_mgmt)
10544                 return -EOPNOTSUPP;
10545
10546         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10547         if (!msg)
10548                 return -ENOMEM;
10549
10550         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10551                              NL80211_CMD_GET_POWER_SAVE);
10552         if (!hdr) {
10553                 err = -ENOBUFS;
10554                 goto free_msg;
10555         }
10556
10557         if (wdev->ps)
10558                 ps_state = NL80211_PS_ENABLED;
10559         else
10560                 ps_state = NL80211_PS_DISABLED;
10561
10562         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
10563                 goto nla_put_failure;
10564
10565         genlmsg_end(msg, hdr);
10566         return genlmsg_reply(msg, info);
10567
10568  nla_put_failure:
10569         err = -ENOBUFS;
10570  free_msg:
10571         nlmsg_free(msg);
10572         return err;
10573 }
10574
10575 static const struct nla_policy
10576 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
10577         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
10578         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
10579         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
10580         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
10581         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
10582         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
10583         [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
10584 };
10585
10586 static int nl80211_set_cqm_txe(struct genl_info *info,
10587                                u32 rate, u32 pkts, u32 intvl)
10588 {
10589         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10590         struct net_device *dev = info->user_ptr[1];
10591         struct wireless_dev *wdev = dev->ieee80211_ptr;
10592
10593         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
10594                 return -EINVAL;
10595
10596         if (!rdev->ops->set_cqm_txe_config)
10597                 return -EOPNOTSUPP;
10598
10599         if (wdev->iftype != NL80211_IFTYPE_STATION &&
10600             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
10601                 return -EOPNOTSUPP;
10602
10603         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
10604 }
10605
10606 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
10607                                     struct net_device *dev)
10608 {
10609         struct wireless_dev *wdev = dev->ieee80211_ptr;
10610         s32 last, low, high;
10611         u32 hyst;
10612         int i, n, low_index;
10613         int err;
10614
10615         /* RSSI reporting disabled? */
10616         if (!wdev->cqm_config)
10617                 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
10618
10619         /*
10620          * Obtain current RSSI value if possible, if not and no RSSI threshold
10621          * event has been received yet, we should receive an event after a
10622          * connection is established and enough beacons received to calculate
10623          * the average.
10624          */
10625         if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss &&
10626             rdev->ops->get_station) {
10627                 struct station_info sinfo = {};
10628                 u8 *mac_addr;
10629
10630                 mac_addr = wdev->current_bss->pub.bssid;
10631
10632                 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
10633                 if (err)
10634                         return err;
10635
10636                 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
10637                         wdev->cqm_config->last_rssi_event_value =
10638                                 (s8) sinfo.rx_beacon_signal_avg;
10639         }
10640
10641         last = wdev->cqm_config->last_rssi_event_value;
10642         hyst = wdev->cqm_config->rssi_hyst;
10643         n = wdev->cqm_config->n_rssi_thresholds;
10644
10645         for (i = 0; i < n; i++)
10646                 if (last < wdev->cqm_config->rssi_thresholds[i])
10647                         break;
10648
10649         low_index = i - 1;
10650         if (low_index >= 0) {
10651                 low_index = array_index_nospec(low_index, n);
10652                 low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;
10653         } else {
10654                 low = S32_MIN;
10655         }
10656         if (i < n) {
10657                 i = array_index_nospec(i, n);
10658                 high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;
10659         } else {
10660                 high = S32_MAX;
10661         }
10662
10663         return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
10664 }
10665
10666 static int nl80211_set_cqm_rssi(struct genl_info *info,
10667                                 const s32 *thresholds, int n_thresholds,
10668                                 u32 hysteresis)
10669 {
10670         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10671         struct net_device *dev = info->user_ptr[1];
10672         struct wireless_dev *wdev = dev->ieee80211_ptr;
10673         int i, err;
10674         s32 prev = S32_MIN;
10675
10676         /* Check all values negative and sorted */
10677         for (i = 0; i < n_thresholds; i++) {
10678                 if (thresholds[i] > 0 || thresholds[i] <= prev)
10679                         return -EINVAL;
10680
10681                 prev = thresholds[i];
10682         }
10683
10684         if (wdev->iftype != NL80211_IFTYPE_STATION &&
10685             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
10686                 return -EOPNOTSUPP;
10687
10688         wdev_lock(wdev);
10689         cfg80211_cqm_config_free(wdev);
10690         wdev_unlock(wdev);
10691
10692         if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
10693                 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
10694                         return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
10695
10696                 return rdev_set_cqm_rssi_config(rdev, dev,
10697                                                 thresholds[0], hysteresis);
10698         }
10699
10700         if (!wiphy_ext_feature_isset(&rdev->wiphy,
10701                                      NL80211_EXT_FEATURE_CQM_RSSI_LIST))
10702                 return -EOPNOTSUPP;
10703
10704         if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
10705                 n_thresholds = 0;
10706
10707         wdev_lock(wdev);
10708         if (n_thresholds) {
10709                 struct cfg80211_cqm_config *cqm_config;
10710
10711                 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) +
10712                                      n_thresholds * sizeof(s32), GFP_KERNEL);
10713                 if (!cqm_config) {
10714                         err = -ENOMEM;
10715                         goto unlock;
10716                 }
10717
10718                 cqm_config->rssi_hyst = hysteresis;
10719                 cqm_config->n_rssi_thresholds = n_thresholds;
10720                 memcpy(cqm_config->rssi_thresholds, thresholds,
10721                        n_thresholds * sizeof(s32));
10722
10723                 wdev->cqm_config = cqm_config;
10724         }
10725
10726         err = cfg80211_cqm_rssi_update(rdev, dev);
10727
10728 unlock:
10729         wdev_unlock(wdev);
10730
10731         return err;
10732 }
10733
10734 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
10735 {
10736         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
10737         struct nlattr *cqm;
10738         int err;
10739
10740         cqm = info->attrs[NL80211_ATTR_CQM];
10741         if (!cqm)
10742                 return -EINVAL;
10743
10744         err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm,
10745                                           nl80211_attr_cqm_policy,
10746                                           info->extack);
10747         if (err)
10748                 return err;
10749
10750         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
10751             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
10752                 const s32 *thresholds =
10753                         nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
10754                 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
10755                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
10756
10757                 if (len % 4)
10758                         return -EINVAL;
10759
10760                 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
10761                                             hysteresis);
10762         }
10763
10764         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
10765             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
10766             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
10767                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
10768                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
10769                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
10770
10771                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
10772         }
10773
10774         return -EINVAL;
10775 }
10776
10777 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
10778 {
10779         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10780         struct net_device *dev = info->user_ptr[1];
10781         struct ocb_setup setup = {};
10782         int err;
10783
10784         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
10785         if (err)
10786                 return err;
10787
10788         return cfg80211_join_ocb(rdev, dev, &setup);
10789 }
10790
10791 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
10792 {
10793         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10794         struct net_device *dev = info->user_ptr[1];
10795
10796         return cfg80211_leave_ocb(rdev, dev);
10797 }
10798
10799 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
10800 {
10801         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10802         struct net_device *dev = info->user_ptr[1];
10803         struct mesh_config cfg;
10804         struct mesh_setup setup;
10805         int err;
10806
10807         /* start with default */
10808         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
10809         memcpy(&setup, &default_mesh_setup, sizeof(setup));
10810
10811         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
10812                 /* and parse parameters if given */
10813                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
10814                 if (err)
10815                         return err;
10816         }
10817
10818         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
10819             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
10820                 return -EINVAL;
10821
10822         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
10823         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
10824
10825         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
10826             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
10827                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
10828                         return -EINVAL;
10829
10830         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
10831                 setup.beacon_interval =
10832                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
10833
10834                 err = cfg80211_validate_beacon_int(rdev,
10835                                                    NL80211_IFTYPE_MESH_POINT,
10836                                                    setup.beacon_interval);
10837                 if (err)
10838                         return err;
10839         }
10840
10841         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
10842                 setup.dtim_period =
10843                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
10844                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
10845                         return -EINVAL;
10846         }
10847
10848         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
10849                 /* parse additional setup parameters if given */
10850                 err = nl80211_parse_mesh_setup(info, &setup);
10851                 if (err)
10852                         return err;
10853         }
10854
10855         if (setup.user_mpm)
10856                 cfg.auto_open_plinks = false;
10857
10858         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
10859                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
10860                 if (err)
10861                         return err;
10862         } else {
10863                 /* __cfg80211_join_mesh() will sort it out */
10864                 setup.chandef.chan = NULL;
10865         }
10866
10867         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
10868                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10869                 int n_rates =
10870                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10871                 struct ieee80211_supported_band *sband;
10872
10873                 if (!setup.chandef.chan)
10874                         return -EINVAL;
10875
10876                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
10877
10878                 err = ieee80211_get_ratemask(sband, rates, n_rates,
10879                                              &setup.basic_rates);
10880                 if (err)
10881                         return err;
10882         }
10883
10884         if (info->attrs[NL80211_ATTR_TX_RATES]) {
10885                 err = nl80211_parse_tx_bitrate_mask(info, &setup.beacon_rate);
10886                 if (err)
10887                         return err;
10888
10889                 if (!setup.chandef.chan)
10890                         return -EINVAL;
10891
10892                 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
10893                                               &setup.beacon_rate);
10894                 if (err)
10895                         return err;
10896         }
10897
10898         setup.userspace_handles_dfs =
10899                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
10900
10901         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
10902                 int r = validate_pae_over_nl80211(rdev, info);
10903
10904                 if (r < 0)
10905                         return r;
10906
10907                 setup.control_port_over_nl80211 = true;
10908         }
10909
10910         wdev_lock(dev->ieee80211_ptr);
10911         err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
10912         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
10913                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
10914         wdev_unlock(dev->ieee80211_ptr);
10915
10916         return err;
10917 }
10918
10919 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
10920 {
10921         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10922         struct net_device *dev = info->user_ptr[1];
10923
10924         return cfg80211_leave_mesh(rdev, dev);
10925 }
10926
10927 #ifdef CONFIG_PM
10928 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
10929                                         struct cfg80211_registered_device *rdev)
10930 {
10931         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
10932         struct nlattr *nl_pats, *nl_pat;
10933         int i, pat_len;
10934
10935         if (!wowlan->n_patterns)
10936                 return 0;
10937
10938         nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
10939         if (!nl_pats)
10940                 return -ENOBUFS;
10941
10942         for (i = 0; i < wowlan->n_patterns; i++) {
10943                 nl_pat = nla_nest_start_noflag(msg, i + 1);
10944                 if (!nl_pat)
10945                         return -ENOBUFS;
10946                 pat_len = wowlan->patterns[i].pattern_len;
10947                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
10948                             wowlan->patterns[i].mask) ||
10949                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
10950                             wowlan->patterns[i].pattern) ||
10951                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
10952                                 wowlan->patterns[i].pkt_offset))
10953                         return -ENOBUFS;
10954                 nla_nest_end(msg, nl_pat);
10955         }
10956         nla_nest_end(msg, nl_pats);
10957
10958         return 0;
10959 }
10960
10961 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
10962                                    struct cfg80211_wowlan_tcp *tcp)
10963 {
10964         struct nlattr *nl_tcp;
10965
10966         if (!tcp)
10967                 return 0;
10968
10969         nl_tcp = nla_nest_start_noflag(msg,
10970                                        NL80211_WOWLAN_TRIG_TCP_CONNECTION);
10971         if (!nl_tcp)
10972                 return -ENOBUFS;
10973
10974         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
10975             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
10976             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
10977             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
10978             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
10979             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
10980                     tcp->payload_len, tcp->payload) ||
10981             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
10982                         tcp->data_interval) ||
10983             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
10984                     tcp->wake_len, tcp->wake_data) ||
10985             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
10986                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
10987                 return -ENOBUFS;
10988
10989         if (tcp->payload_seq.len &&
10990             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
10991                     sizeof(tcp->payload_seq), &tcp->payload_seq))
10992                 return -ENOBUFS;
10993
10994         if (tcp->payload_tok.len &&
10995             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
10996                     sizeof(tcp->payload_tok) + tcp->tokens_size,
10997                     &tcp->payload_tok))
10998                 return -ENOBUFS;
10999
11000         nla_nest_end(msg, nl_tcp);
11001
11002         return 0;
11003 }
11004
11005 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
11006                                   struct cfg80211_sched_scan_request *req)
11007 {
11008         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
11009         int i;
11010
11011         if (!req)
11012                 return 0;
11013
11014         nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
11015         if (!nd)
11016                 return -ENOBUFS;
11017
11018         if (req->n_scan_plans == 1 &&
11019             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
11020                         req->scan_plans[0].interval * 1000))
11021                 return -ENOBUFS;
11022
11023         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
11024                 return -ENOBUFS;
11025
11026         if (req->relative_rssi_set) {
11027                 struct nl80211_bss_select_rssi_adjust rssi_adjust;
11028
11029                 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
11030                                req->relative_rssi))
11031                         return -ENOBUFS;
11032
11033                 rssi_adjust.band = req->rssi_adjust.band;
11034                 rssi_adjust.delta = req->rssi_adjust.delta;
11035                 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
11036                             sizeof(rssi_adjust), &rssi_adjust))
11037                         return -ENOBUFS;
11038         }
11039
11040         freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
11041         if (!freqs)
11042                 return -ENOBUFS;
11043
11044         for (i = 0; i < req->n_channels; i++) {
11045                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
11046                         return -ENOBUFS;
11047         }
11048
11049         nla_nest_end(msg, freqs);
11050
11051         if (req->n_match_sets) {
11052                 matches = nla_nest_start_noflag(msg,
11053                                                 NL80211_ATTR_SCHED_SCAN_MATCH);
11054                 if (!matches)
11055                         return -ENOBUFS;
11056
11057                 for (i = 0; i < req->n_match_sets; i++) {
11058                         match = nla_nest_start_noflag(msg, i);
11059                         if (!match)
11060                                 return -ENOBUFS;
11061
11062                         if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
11063                                     req->match_sets[i].ssid.ssid_len,
11064                                     req->match_sets[i].ssid.ssid))
11065                                 return -ENOBUFS;
11066                         nla_nest_end(msg, match);
11067                 }
11068                 nla_nest_end(msg, matches);
11069         }
11070
11071         scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
11072         if (!scan_plans)
11073                 return -ENOBUFS;
11074
11075         for (i = 0; i < req->n_scan_plans; i++) {
11076                 scan_plan = nla_nest_start_noflag(msg, i + 1);
11077                 if (!scan_plan)
11078                         return -ENOBUFS;
11079
11080                 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
11081                                 req->scan_plans[i].interval) ||
11082                     (req->scan_plans[i].iterations &&
11083                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
11084                                  req->scan_plans[i].iterations)))
11085                         return -ENOBUFS;
11086                 nla_nest_end(msg, scan_plan);
11087         }
11088         nla_nest_end(msg, scan_plans);
11089
11090         nla_nest_end(msg, nd);
11091
11092         return 0;
11093 }
11094
11095 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
11096 {
11097         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11098         struct sk_buff *msg;
11099         void *hdr;
11100         u32 size = NLMSG_DEFAULT_SIZE;
11101
11102         if (!rdev->wiphy.wowlan)
11103                 return -EOPNOTSUPP;
11104
11105         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
11106                 /* adjust size to have room for all the data */
11107                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
11108                         rdev->wiphy.wowlan_config->tcp->payload_len +
11109                         rdev->wiphy.wowlan_config->tcp->wake_len +
11110                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
11111         }
11112
11113         msg = nlmsg_new(size, GFP_KERNEL);
11114         if (!msg)
11115                 return -ENOMEM;
11116
11117         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11118                              NL80211_CMD_GET_WOWLAN);
11119         if (!hdr)
11120                 goto nla_put_failure;
11121
11122         if (rdev->wiphy.wowlan_config) {
11123                 struct nlattr *nl_wowlan;
11124
11125                 nl_wowlan = nla_nest_start_noflag(msg,
11126                                                   NL80211_ATTR_WOWLAN_TRIGGERS);
11127                 if (!nl_wowlan)
11128                         goto nla_put_failure;
11129
11130                 if ((rdev->wiphy.wowlan_config->any &&
11131                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
11132                     (rdev->wiphy.wowlan_config->disconnect &&
11133                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
11134                     (rdev->wiphy.wowlan_config->magic_pkt &&
11135                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
11136                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
11137                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
11138                     (rdev->wiphy.wowlan_config->eap_identity_req &&
11139                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
11140                     (rdev->wiphy.wowlan_config->four_way_handshake &&
11141                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
11142                     (rdev->wiphy.wowlan_config->rfkill_release &&
11143                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
11144                         goto nla_put_failure;
11145
11146                 if (nl80211_send_wowlan_patterns(msg, rdev))
11147                         goto nla_put_failure;
11148
11149                 if (nl80211_send_wowlan_tcp(msg,
11150                                             rdev->wiphy.wowlan_config->tcp))
11151                         goto nla_put_failure;
11152
11153                 if (nl80211_send_wowlan_nd(
11154                             msg,
11155                             rdev->wiphy.wowlan_config->nd_config))
11156                         goto nla_put_failure;
11157
11158                 nla_nest_end(msg, nl_wowlan);
11159         }
11160
11161         genlmsg_end(msg, hdr);
11162         return genlmsg_reply(msg, info);
11163
11164 nla_put_failure:
11165         nlmsg_free(msg);
11166         return -ENOBUFS;
11167 }
11168
11169 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
11170                                     struct nlattr *attr,
11171                                     struct cfg80211_wowlan *trig)
11172 {
11173         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
11174         struct cfg80211_wowlan_tcp *cfg;
11175         struct nl80211_wowlan_tcp_data_token *tok = NULL;
11176         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
11177         u32 size;
11178         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
11179         int err, port;
11180
11181         if (!rdev->wiphy.wowlan->tcp)
11182                 return -EINVAL;
11183
11184         err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr,
11185                                           nl80211_wowlan_tcp_policy, NULL);
11186         if (err)
11187                 return err;
11188
11189         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
11190             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
11191             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
11192             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
11193             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
11194             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
11195             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
11196             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
11197                 return -EINVAL;
11198
11199         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
11200         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
11201                 return -EINVAL;
11202
11203         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
11204                         rdev->wiphy.wowlan->tcp->data_interval_max ||
11205             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
11206                 return -EINVAL;
11207
11208         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
11209         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
11210                 return -EINVAL;
11211
11212         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
11213         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
11214                 return -EINVAL;
11215
11216         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
11217                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
11218
11219                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
11220                 tokens_size = tokln - sizeof(*tok);
11221
11222                 if (!tok->len || tokens_size % tok->len)
11223                         return -EINVAL;
11224                 if (!rdev->wiphy.wowlan->tcp->tok)
11225                         return -EINVAL;
11226                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
11227                         return -EINVAL;
11228                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
11229                         return -EINVAL;
11230                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
11231                         return -EINVAL;
11232                 if (tok->offset + tok->len > data_size)
11233                         return -EINVAL;
11234         }
11235
11236         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
11237                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
11238                 if (!rdev->wiphy.wowlan->tcp->seq)
11239                         return -EINVAL;
11240                 if (seq->len == 0 || seq->len > 4)
11241                         return -EINVAL;
11242                 if (seq->len + seq->offset > data_size)
11243                         return -EINVAL;
11244         }
11245
11246         size = sizeof(*cfg);
11247         size += data_size;
11248         size += wake_size + wake_mask_size;
11249         size += tokens_size;
11250
11251         cfg = kzalloc(size, GFP_KERNEL);
11252         if (!cfg)
11253                 return -ENOMEM;
11254         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
11255         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
11256         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
11257                ETH_ALEN);
11258         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
11259                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
11260         else
11261                 port = 0;
11262 #ifdef CONFIG_INET
11263         /* allocate a socket and port for it and use it */
11264         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
11265                             IPPROTO_TCP, &cfg->sock, 1);
11266         if (err) {
11267                 kfree(cfg);
11268                 return err;
11269         }
11270         if (inet_csk_get_port(cfg->sock->sk, port)) {
11271                 sock_release(cfg->sock);
11272                 kfree(cfg);
11273                 return -EADDRINUSE;
11274         }
11275         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
11276 #else
11277         if (!port) {
11278                 kfree(cfg);
11279                 return -EINVAL;
11280         }
11281         cfg->src_port = port;
11282 #endif
11283
11284         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
11285         cfg->payload_len = data_size;
11286         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
11287         memcpy((void *)cfg->payload,
11288                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
11289                data_size);
11290         if (seq)
11291                 cfg->payload_seq = *seq;
11292         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
11293         cfg->wake_len = wake_size;
11294         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
11295         memcpy((void *)cfg->wake_data,
11296                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
11297                wake_size);
11298         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
11299                          data_size + wake_size;
11300         memcpy((void *)cfg->wake_mask,
11301                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
11302                wake_mask_size);
11303         if (tok) {
11304                 cfg->tokens_size = tokens_size;
11305                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
11306         }
11307
11308         trig->tcp = cfg;
11309
11310         return 0;
11311 }
11312
11313 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
11314                                    const struct wiphy_wowlan_support *wowlan,
11315                                    struct nlattr *attr,
11316                                    struct cfg80211_wowlan *trig)
11317 {
11318         struct nlattr **tb;
11319         int err;
11320
11321         tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
11322         if (!tb)
11323                 return -ENOMEM;
11324
11325         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
11326                 err = -EOPNOTSUPP;
11327                 goto out;
11328         }
11329
11330         err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr,
11331                                           nl80211_policy, NULL);
11332         if (err)
11333                 goto out;
11334
11335         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
11336                                                    wowlan->max_nd_match_sets);
11337         err = PTR_ERR_OR_ZERO(trig->nd_config);
11338         if (err)
11339                 trig->nd_config = NULL;
11340
11341 out:
11342         kfree(tb);
11343         return err;
11344 }
11345
11346 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
11347 {
11348         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11349         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
11350         struct cfg80211_wowlan new_triggers = {};
11351         struct cfg80211_wowlan *ntrig;
11352         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
11353         int err, i;
11354         bool prev_enabled = rdev->wiphy.wowlan_config;
11355         bool regular = false;
11356
11357         if (!wowlan)
11358                 return -EOPNOTSUPP;
11359
11360         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
11361                 cfg80211_rdev_free_wowlan(rdev);
11362                 rdev->wiphy.wowlan_config = NULL;
11363                 goto set_wakeup;
11364         }
11365
11366         err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG,
11367                                           info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
11368                                           nl80211_wowlan_policy, info->extack);
11369         if (err)
11370                 return err;
11371
11372         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
11373                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
11374                         return -EINVAL;
11375                 new_triggers.any = true;
11376         }
11377
11378         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
11379                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
11380                         return -EINVAL;
11381                 new_triggers.disconnect = true;
11382                 regular = true;
11383         }
11384
11385         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
11386                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
11387                         return -EINVAL;
11388                 new_triggers.magic_pkt = true;
11389                 regular = true;
11390         }
11391
11392         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
11393                 return -EINVAL;
11394
11395         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
11396                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
11397                         return -EINVAL;
11398                 new_triggers.gtk_rekey_failure = true;
11399                 regular = true;
11400         }
11401
11402         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
11403                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
11404                         return -EINVAL;
11405                 new_triggers.eap_identity_req = true;
11406                 regular = true;
11407         }
11408
11409         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
11410                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
11411                         return -EINVAL;
11412                 new_triggers.four_way_handshake = true;
11413                 regular = true;
11414         }
11415
11416         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
11417                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
11418                         return -EINVAL;
11419                 new_triggers.rfkill_release = true;
11420                 regular = true;
11421         }
11422
11423         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
11424                 struct nlattr *pat;
11425                 int n_patterns = 0;
11426                 int rem, pat_len, mask_len, pkt_offset;
11427                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
11428
11429                 regular = true;
11430
11431                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
11432                                     rem)
11433                         n_patterns++;
11434                 if (n_patterns > wowlan->n_patterns)
11435                         return -EINVAL;
11436
11437                 new_triggers.patterns = kcalloc(n_patterns,
11438                                                 sizeof(new_triggers.patterns[0]),
11439                                                 GFP_KERNEL);
11440                 if (!new_triggers.patterns)
11441                         return -ENOMEM;
11442
11443                 new_triggers.n_patterns = n_patterns;
11444                 i = 0;
11445
11446                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
11447                                     rem) {
11448                         u8 *mask_pat;
11449
11450                         err = nla_parse_nested_deprecated(pat_tb,
11451                                                           MAX_NL80211_PKTPAT,
11452                                                           pat,
11453                                                           nl80211_packet_pattern_policy,
11454                                                           info->extack);
11455                         if (err)
11456                                 goto error;
11457
11458                         err = -EINVAL;
11459                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
11460                             !pat_tb[NL80211_PKTPAT_PATTERN])
11461                                 goto error;
11462                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
11463                         mask_len = DIV_ROUND_UP(pat_len, 8);
11464                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
11465                                 goto error;
11466                         if (pat_len > wowlan->pattern_max_len ||
11467                             pat_len < wowlan->pattern_min_len)
11468                                 goto error;
11469
11470                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
11471                                 pkt_offset = 0;
11472                         else
11473                                 pkt_offset = nla_get_u32(
11474                                         pat_tb[NL80211_PKTPAT_OFFSET]);
11475                         if (pkt_offset > wowlan->max_pkt_offset)
11476                                 goto error;
11477                         new_triggers.patterns[i].pkt_offset = pkt_offset;
11478
11479                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
11480                         if (!mask_pat) {
11481                                 err = -ENOMEM;
11482                                 goto error;
11483                         }
11484                         new_triggers.patterns[i].mask = mask_pat;
11485                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
11486                                mask_len);
11487                         mask_pat += mask_len;
11488                         new_triggers.patterns[i].pattern = mask_pat;
11489                         new_triggers.patterns[i].pattern_len = pat_len;
11490                         memcpy(mask_pat,
11491                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
11492                                pat_len);
11493                         i++;
11494                 }
11495         }
11496
11497         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
11498                 regular = true;
11499                 err = nl80211_parse_wowlan_tcp(
11500                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
11501                         &new_triggers);
11502                 if (err)
11503                         goto error;
11504         }
11505
11506         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
11507                 regular = true;
11508                 err = nl80211_parse_wowlan_nd(
11509                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
11510                         &new_triggers);
11511                 if (err)
11512                         goto error;
11513         }
11514
11515         /* The 'any' trigger means the device continues operating more or less
11516          * as in its normal operation mode and wakes up the host on most of the
11517          * normal interrupts (like packet RX, ...)
11518          * It therefore makes little sense to combine with the more constrained
11519          * wakeup trigger modes.
11520          */
11521         if (new_triggers.any && regular) {
11522                 err = -EINVAL;
11523                 goto error;
11524         }
11525
11526         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
11527         if (!ntrig) {
11528                 err = -ENOMEM;
11529                 goto error;
11530         }
11531         cfg80211_rdev_free_wowlan(rdev);
11532         rdev->wiphy.wowlan_config = ntrig;
11533
11534  set_wakeup:
11535         if (rdev->ops->set_wakeup &&
11536             prev_enabled != !!rdev->wiphy.wowlan_config)
11537                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
11538
11539         return 0;
11540  error:
11541         for (i = 0; i < new_triggers.n_patterns; i++)
11542                 kfree(new_triggers.patterns[i].mask);
11543         kfree(new_triggers.patterns);
11544         if (new_triggers.tcp && new_triggers.tcp->sock)
11545                 sock_release(new_triggers.tcp->sock);
11546         kfree(new_triggers.tcp);
11547         kfree(new_triggers.nd_config);
11548         return err;
11549 }
11550 #endif
11551
11552 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
11553                                        struct cfg80211_registered_device *rdev)
11554 {
11555         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
11556         int i, j, pat_len;
11557         struct cfg80211_coalesce_rules *rule;
11558
11559         if (!rdev->coalesce->n_rules)
11560                 return 0;
11561
11562         nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE);
11563         if (!nl_rules)
11564                 return -ENOBUFS;
11565
11566         for (i = 0; i < rdev->coalesce->n_rules; i++) {
11567                 nl_rule = nla_nest_start_noflag(msg, i + 1);
11568                 if (!nl_rule)
11569                         return -ENOBUFS;
11570
11571                 rule = &rdev->coalesce->rules[i];
11572                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
11573                                 rule->delay))
11574                         return -ENOBUFS;
11575
11576                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
11577                                 rule->condition))
11578                         return -ENOBUFS;
11579
11580                 nl_pats = nla_nest_start_noflag(msg,
11581                                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
11582                 if (!nl_pats)
11583                         return -ENOBUFS;
11584
11585                 for (j = 0; j < rule->n_patterns; j++) {
11586                         nl_pat = nla_nest_start_noflag(msg, j + 1);
11587                         if (!nl_pat)
11588                                 return -ENOBUFS;
11589                         pat_len = rule->patterns[j].pattern_len;
11590                         if (nla_put(msg, NL80211_PKTPAT_MASK,
11591                                     DIV_ROUND_UP(pat_len, 8),
11592                                     rule->patterns[j].mask) ||
11593                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
11594                                     rule->patterns[j].pattern) ||
11595                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
11596                                         rule->patterns[j].pkt_offset))
11597                                 return -ENOBUFS;
11598                         nla_nest_end(msg, nl_pat);
11599                 }
11600                 nla_nest_end(msg, nl_pats);
11601                 nla_nest_end(msg, nl_rule);
11602         }
11603         nla_nest_end(msg, nl_rules);
11604
11605         return 0;
11606 }
11607
11608 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
11609 {
11610         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11611         struct sk_buff *msg;
11612         void *hdr;
11613
11614         if (!rdev->wiphy.coalesce)
11615                 return -EOPNOTSUPP;
11616
11617         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11618         if (!msg)
11619                 return -ENOMEM;
11620
11621         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11622                              NL80211_CMD_GET_COALESCE);
11623         if (!hdr)
11624                 goto nla_put_failure;
11625
11626         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
11627                 goto nla_put_failure;
11628
11629         genlmsg_end(msg, hdr);
11630         return genlmsg_reply(msg, info);
11631
11632 nla_put_failure:
11633         nlmsg_free(msg);
11634         return -ENOBUFS;
11635 }
11636
11637 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
11638 {
11639         struct cfg80211_coalesce *coalesce = rdev->coalesce;
11640         int i, j;
11641         struct cfg80211_coalesce_rules *rule;
11642
11643         if (!coalesce)
11644                 return;
11645
11646         for (i = 0; i < coalesce->n_rules; i++) {
11647                 rule = &coalesce->rules[i];
11648                 for (j = 0; j < rule->n_patterns; j++)
11649                         kfree(rule->patterns[j].mask);
11650                 kfree(rule->patterns);
11651         }
11652         kfree(coalesce->rules);
11653         kfree(coalesce);
11654         rdev->coalesce = NULL;
11655 }
11656
11657 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
11658                                        struct nlattr *rule,
11659                                        struct cfg80211_coalesce_rules *new_rule)
11660 {
11661         int err, i;
11662         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
11663         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
11664         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
11665         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
11666
11667         err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX,
11668                                           rule, nl80211_coalesce_policy, NULL);
11669         if (err)
11670                 return err;
11671
11672         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
11673                 new_rule->delay =
11674                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
11675         if (new_rule->delay > coalesce->max_delay)
11676                 return -EINVAL;
11677
11678         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
11679                 new_rule->condition =
11680                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
11681
11682         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
11683                 return -EINVAL;
11684
11685         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
11686                             rem)
11687                 n_patterns++;
11688         if (n_patterns > coalesce->n_patterns)
11689                 return -EINVAL;
11690
11691         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
11692                                      GFP_KERNEL);
11693         if (!new_rule->patterns)
11694                 return -ENOMEM;
11695
11696         new_rule->n_patterns = n_patterns;
11697         i = 0;
11698
11699         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
11700                             rem) {
11701                 u8 *mask_pat;
11702
11703                 err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT,
11704                                                   pat,
11705                                                   nl80211_packet_pattern_policy,
11706                                                   NULL);
11707                 if (err)
11708                         return err;
11709
11710                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
11711                     !pat_tb[NL80211_PKTPAT_PATTERN])
11712                         return -EINVAL;
11713                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
11714                 mask_len = DIV_ROUND_UP(pat_len, 8);
11715                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
11716                         return -EINVAL;
11717                 if (pat_len > coalesce->pattern_max_len ||
11718                     pat_len < coalesce->pattern_min_len)
11719                         return -EINVAL;
11720
11721                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
11722                         pkt_offset = 0;
11723                 else
11724                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
11725                 if (pkt_offset > coalesce->max_pkt_offset)
11726                         return -EINVAL;
11727                 new_rule->patterns[i].pkt_offset = pkt_offset;
11728
11729                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
11730                 if (!mask_pat)
11731                         return -ENOMEM;
11732
11733                 new_rule->patterns[i].mask = mask_pat;
11734                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
11735                        mask_len);
11736
11737                 mask_pat += mask_len;
11738                 new_rule->patterns[i].pattern = mask_pat;
11739                 new_rule->patterns[i].pattern_len = pat_len;
11740                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
11741                        pat_len);
11742                 i++;
11743         }
11744
11745         return 0;
11746 }
11747
11748 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
11749 {
11750         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11751         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
11752         struct cfg80211_coalesce new_coalesce = {};
11753         struct cfg80211_coalesce *n_coalesce;
11754         int err, rem_rule, n_rules = 0, i, j;
11755         struct nlattr *rule;
11756         struct cfg80211_coalesce_rules *tmp_rule;
11757
11758         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
11759                 return -EOPNOTSUPP;
11760
11761         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
11762                 cfg80211_rdev_free_coalesce(rdev);
11763                 rdev_set_coalesce(rdev, NULL);
11764                 return 0;
11765         }
11766
11767         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
11768                             rem_rule)
11769                 n_rules++;
11770         if (n_rules > coalesce->n_rules)
11771                 return -EINVAL;
11772
11773         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
11774                                      GFP_KERNEL);
11775         if (!new_coalesce.rules)
11776                 return -ENOMEM;
11777
11778         new_coalesce.n_rules = n_rules;
11779         i = 0;
11780
11781         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
11782                             rem_rule) {
11783                 err = nl80211_parse_coalesce_rule(rdev, rule,
11784                                                   &new_coalesce.rules[i]);
11785                 if (err)
11786                         goto error;
11787
11788                 i++;
11789         }
11790
11791         err = rdev_set_coalesce(rdev, &new_coalesce);
11792         if (err)
11793                 goto error;
11794
11795         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
11796         if (!n_coalesce) {
11797                 err = -ENOMEM;
11798                 goto error;
11799         }
11800         cfg80211_rdev_free_coalesce(rdev);
11801         rdev->coalesce = n_coalesce;
11802
11803         return 0;
11804 error:
11805         for (i = 0; i < new_coalesce.n_rules; i++) {
11806                 tmp_rule = &new_coalesce.rules[i];
11807                 for (j = 0; j < tmp_rule->n_patterns; j++)
11808                         kfree(tmp_rule->patterns[j].mask);
11809                 kfree(tmp_rule->patterns);
11810         }
11811         kfree(new_coalesce.rules);
11812
11813         return err;
11814 }
11815
11816 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
11817 {
11818         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11819         struct net_device *dev = info->user_ptr[1];
11820         struct wireless_dev *wdev = dev->ieee80211_ptr;
11821         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
11822         struct cfg80211_gtk_rekey_data rekey_data;
11823         int err;
11824
11825         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
11826                 return -EINVAL;
11827
11828         err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA,
11829                                           info->attrs[NL80211_ATTR_REKEY_DATA],
11830                                           nl80211_rekey_policy, info->extack);
11831         if (err)
11832                 return err;
11833
11834         if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
11835             !tb[NL80211_REKEY_DATA_KCK])
11836                 return -EINVAL;
11837         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
11838                 return -ERANGE;
11839         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
11840                 return -ERANGE;
11841         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
11842                 return -ERANGE;
11843
11844         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
11845         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
11846         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
11847
11848         wdev_lock(wdev);
11849         if (!wdev->current_bss) {
11850                 err = -ENOTCONN;
11851                 goto out;
11852         }
11853
11854         if (!rdev->ops->set_rekey_data) {
11855                 err = -EOPNOTSUPP;
11856                 goto out;
11857         }
11858
11859         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
11860  out:
11861         wdev_unlock(wdev);
11862         return err;
11863 }
11864
11865 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
11866                                              struct genl_info *info)
11867 {
11868         struct net_device *dev = info->user_ptr[1];
11869         struct wireless_dev *wdev = dev->ieee80211_ptr;
11870
11871         if (wdev->iftype != NL80211_IFTYPE_AP &&
11872             wdev->iftype != NL80211_IFTYPE_P2P_GO)
11873                 return -EINVAL;
11874
11875         if (wdev->ap_unexpected_nlportid)
11876                 return -EBUSY;
11877
11878         wdev->ap_unexpected_nlportid = info->snd_portid;
11879         return 0;
11880 }
11881
11882 static int nl80211_probe_client(struct sk_buff *skb,
11883                                 struct genl_info *info)
11884 {
11885         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11886         struct net_device *dev = info->user_ptr[1];
11887         struct wireless_dev *wdev = dev->ieee80211_ptr;
11888         struct sk_buff *msg;
11889         void *hdr;
11890         const u8 *addr;
11891         u64 cookie;
11892         int err;
11893
11894         if (wdev->iftype != NL80211_IFTYPE_AP &&
11895             wdev->iftype != NL80211_IFTYPE_P2P_GO)
11896                 return -EOPNOTSUPP;
11897
11898         if (!info->attrs[NL80211_ATTR_MAC])
11899                 return -EINVAL;
11900
11901         if (!rdev->ops->probe_client)
11902                 return -EOPNOTSUPP;
11903
11904         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11905         if (!msg)
11906                 return -ENOMEM;
11907
11908         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11909                              NL80211_CMD_PROBE_CLIENT);
11910         if (!hdr) {
11911                 err = -ENOBUFS;
11912                 goto free_msg;
11913         }
11914
11915         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
11916
11917         err = rdev_probe_client(rdev, dev, addr, &cookie);
11918         if (err)
11919                 goto free_msg;
11920
11921         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11922                               NL80211_ATTR_PAD))
11923                 goto nla_put_failure;
11924
11925         genlmsg_end(msg, hdr);
11926
11927         return genlmsg_reply(msg, info);
11928
11929  nla_put_failure:
11930         err = -ENOBUFS;
11931  free_msg:
11932         nlmsg_free(msg);
11933         return err;
11934 }
11935
11936 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
11937 {
11938         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11939         struct cfg80211_beacon_registration *reg, *nreg;
11940         int rv;
11941
11942         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
11943                 return -EOPNOTSUPP;
11944
11945         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
11946         if (!nreg)
11947                 return -ENOMEM;
11948
11949         /* First, check if already registered. */
11950         spin_lock_bh(&rdev->beacon_registrations_lock);
11951         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
11952                 if (reg->nlportid == info->snd_portid) {
11953                         rv = -EALREADY;
11954                         goto out_err;
11955                 }
11956         }
11957         /* Add it to the list */
11958         nreg->nlportid = info->snd_portid;
11959         list_add(&nreg->list, &rdev->beacon_registrations);
11960
11961         spin_unlock_bh(&rdev->beacon_registrations_lock);
11962
11963         return 0;
11964 out_err:
11965         spin_unlock_bh(&rdev->beacon_registrations_lock);
11966         kfree(nreg);
11967         return rv;
11968 }
11969
11970 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
11971 {
11972         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11973         struct wireless_dev *wdev = info->user_ptr[1];
11974         int err;
11975
11976         if (!rdev->ops->start_p2p_device)
11977                 return -EOPNOTSUPP;
11978
11979         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11980                 return -EOPNOTSUPP;
11981
11982         if (wdev_running(wdev))
11983                 return 0;
11984
11985         if (rfkill_blocked(rdev->rfkill))
11986                 return -ERFKILL;
11987
11988         err = rdev_start_p2p_device(rdev, wdev);
11989         if (err)
11990                 return err;
11991
11992         wdev->is_running = true;
11993         rdev->opencount++;
11994
11995         return 0;
11996 }
11997
11998 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
11999 {
12000         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12001         struct wireless_dev *wdev = info->user_ptr[1];
12002
12003         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
12004                 return -EOPNOTSUPP;
12005
12006         if (!rdev->ops->stop_p2p_device)
12007                 return -EOPNOTSUPP;
12008
12009         cfg80211_stop_p2p_device(rdev, wdev);
12010
12011         return 0;
12012 }
12013
12014 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
12015 {
12016         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12017         struct wireless_dev *wdev = info->user_ptr[1];
12018         struct cfg80211_nan_conf conf = {};
12019         int err;
12020
12021         if (wdev->iftype != NL80211_IFTYPE_NAN)
12022                 return -EOPNOTSUPP;
12023
12024         if (wdev_running(wdev))
12025                 return -EEXIST;
12026
12027         if (rfkill_blocked(rdev->rfkill))
12028                 return -ERFKILL;
12029
12030         if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
12031                 return -EINVAL;
12032
12033         conf.master_pref =
12034                 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
12035
12036         if (info->attrs[NL80211_ATTR_BANDS]) {
12037                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
12038
12039                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
12040                         return -EOPNOTSUPP;
12041
12042                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
12043                         return -EINVAL;
12044
12045                 conf.bands = bands;
12046         }
12047
12048         err = rdev_start_nan(rdev, wdev, &conf);
12049         if (err)
12050                 return err;
12051
12052         wdev->is_running = true;
12053         rdev->opencount++;
12054
12055         return 0;
12056 }
12057
12058 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
12059 {
12060         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12061         struct wireless_dev *wdev = info->user_ptr[1];
12062
12063         if (wdev->iftype != NL80211_IFTYPE_NAN)
12064                 return -EOPNOTSUPP;
12065
12066         cfg80211_stop_nan(rdev, wdev);
12067
12068         return 0;
12069 }
12070
12071 static int validate_nan_filter(struct nlattr *filter_attr)
12072 {
12073         struct nlattr *attr;
12074         int len = 0, n_entries = 0, rem;
12075
12076         nla_for_each_nested(attr, filter_attr, rem) {
12077                 len += nla_len(attr);
12078                 n_entries++;
12079         }
12080
12081         if (len >= U8_MAX)
12082                 return -EINVAL;
12083
12084         return n_entries;
12085 }
12086
12087 static int handle_nan_filter(struct nlattr *attr_filter,
12088                              struct cfg80211_nan_func *func,
12089                              bool tx)
12090 {
12091         struct nlattr *attr;
12092         int n_entries, rem, i;
12093         struct cfg80211_nan_func_filter *filter;
12094
12095         n_entries = validate_nan_filter(attr_filter);
12096         if (n_entries < 0)
12097                 return n_entries;
12098
12099         BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
12100
12101         filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
12102         if (!filter)
12103                 return -ENOMEM;
12104
12105         i = 0;
12106         nla_for_each_nested(attr, attr_filter, rem) {
12107                 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
12108                 filter[i].len = nla_len(attr);
12109                 i++;
12110         }
12111         if (tx) {
12112                 func->num_tx_filters = n_entries;
12113                 func->tx_filters = filter;
12114         } else {
12115                 func->num_rx_filters = n_entries;
12116                 func->rx_filters = filter;
12117         }
12118
12119         return 0;
12120 }
12121
12122 static int nl80211_nan_add_func(struct sk_buff *skb,
12123                                 struct genl_info *info)
12124 {
12125         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12126         struct wireless_dev *wdev = info->user_ptr[1];
12127         struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
12128         struct cfg80211_nan_func *func;
12129         struct sk_buff *msg = NULL;
12130         void *hdr = NULL;
12131         int err = 0;
12132
12133         if (wdev->iftype != NL80211_IFTYPE_NAN)
12134                 return -EOPNOTSUPP;
12135
12136         if (!wdev_running(wdev))
12137                 return -ENOTCONN;
12138
12139         if (!info->attrs[NL80211_ATTR_NAN_FUNC])
12140                 return -EINVAL;
12141
12142         err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX,
12143                                           info->attrs[NL80211_ATTR_NAN_FUNC],
12144                                           nl80211_nan_func_policy,
12145                                           info->extack);
12146         if (err)
12147                 return err;
12148
12149         func = kzalloc(sizeof(*func), GFP_KERNEL);
12150         if (!func)
12151                 return -ENOMEM;
12152
12153         func->cookie = cfg80211_assign_cookie(rdev);
12154
12155         if (!tb[NL80211_NAN_FUNC_TYPE] ||
12156             nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]) > NL80211_NAN_FUNC_MAX_TYPE) {
12157                 err = -EINVAL;
12158                 goto out;
12159         }
12160
12161
12162         func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
12163
12164         if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
12165                 err = -EINVAL;
12166                 goto out;
12167         }
12168
12169         memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
12170                sizeof(func->service_id));
12171
12172         func->close_range =
12173                 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
12174
12175         if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
12176                 func->serv_spec_info_len =
12177                         nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
12178                 func->serv_spec_info =
12179                         kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
12180                                 func->serv_spec_info_len,
12181                                 GFP_KERNEL);
12182                 if (!func->serv_spec_info) {
12183                         err = -ENOMEM;
12184                         goto out;
12185                 }
12186         }
12187
12188         if (tb[NL80211_NAN_FUNC_TTL])
12189                 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
12190
12191         switch (func->type) {
12192         case NL80211_NAN_FUNC_PUBLISH:
12193                 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
12194                         err = -EINVAL;
12195                         goto out;
12196                 }
12197
12198                 func->publish_type =
12199                         nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
12200                 func->publish_bcast =
12201                         nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
12202
12203                 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
12204                         func->publish_bcast) {
12205                         err = -EINVAL;
12206                         goto out;
12207                 }
12208                 break;
12209         case NL80211_NAN_FUNC_SUBSCRIBE:
12210                 func->subscribe_active =
12211                         nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
12212                 break;
12213         case NL80211_NAN_FUNC_FOLLOW_UP:
12214                 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
12215                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
12216                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
12217                         err = -EINVAL;
12218                         goto out;
12219                 }
12220
12221                 func->followup_id =
12222                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
12223                 func->followup_reqid =
12224                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
12225                 memcpy(func->followup_dest.addr,
12226                        nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
12227                        sizeof(func->followup_dest.addr));
12228                 if (func->ttl) {
12229                         err = -EINVAL;
12230                         goto out;
12231                 }
12232                 break;
12233         default:
12234                 err = -EINVAL;
12235                 goto out;
12236         }
12237
12238         if (tb[NL80211_NAN_FUNC_SRF]) {
12239                 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
12240
12241                 err = nla_parse_nested_deprecated(srf_tb,
12242                                                   NL80211_NAN_SRF_ATTR_MAX,
12243                                                   tb[NL80211_NAN_FUNC_SRF],
12244                                                   nl80211_nan_srf_policy,
12245                                                   info->extack);
12246                 if (err)
12247                         goto out;
12248
12249                 func->srf_include =
12250                         nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
12251
12252                 if (srf_tb[NL80211_NAN_SRF_BF]) {
12253                         if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
12254                             !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
12255                                 err = -EINVAL;
12256                                 goto out;
12257                         }
12258
12259                         func->srf_bf_len =
12260                                 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
12261                         func->srf_bf =
12262                                 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
12263                                         func->srf_bf_len, GFP_KERNEL);
12264                         if (!func->srf_bf) {
12265                                 err = -ENOMEM;
12266                                 goto out;
12267                         }
12268
12269                         func->srf_bf_idx =
12270                                 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
12271                 } else {
12272                         struct nlattr *attr, *mac_attr =
12273                                 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
12274                         int n_entries, rem, i = 0;
12275
12276                         if (!mac_attr) {
12277                                 err = -EINVAL;
12278                                 goto out;
12279                         }
12280
12281                         n_entries = validate_acl_mac_addrs(mac_attr);
12282                         if (n_entries <= 0) {
12283                                 err = -EINVAL;
12284                                 goto out;
12285                         }
12286
12287                         func->srf_num_macs = n_entries;
12288                         func->srf_macs =
12289                                 kcalloc(n_entries, sizeof(*func->srf_macs),
12290                                         GFP_KERNEL);
12291                         if (!func->srf_macs) {
12292                                 err = -ENOMEM;
12293                                 goto out;
12294                         }
12295
12296                         nla_for_each_nested(attr, mac_attr, rem)
12297                                 memcpy(func->srf_macs[i++].addr, nla_data(attr),
12298                                        sizeof(*func->srf_macs));
12299                 }
12300         }
12301
12302         if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
12303                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
12304                                         func, true);
12305                 if (err)
12306                         goto out;
12307         }
12308
12309         if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
12310                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
12311                                         func, false);
12312                 if (err)
12313                         goto out;
12314         }
12315
12316         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12317         if (!msg) {
12318                 err = -ENOMEM;
12319                 goto out;
12320         }
12321
12322         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12323                              NL80211_CMD_ADD_NAN_FUNCTION);
12324         /* This can't really happen - we just allocated 4KB */
12325         if (WARN_ON(!hdr)) {
12326                 err = -ENOMEM;
12327                 goto out;
12328         }
12329
12330         err = rdev_add_nan_func(rdev, wdev, func);
12331 out:
12332         if (err < 0) {
12333                 cfg80211_free_nan_func(func);
12334                 nlmsg_free(msg);
12335                 return err;
12336         }
12337
12338         /* propagate the instance id and cookie to userspace  */
12339         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
12340                               NL80211_ATTR_PAD))
12341                 goto nla_put_failure;
12342
12343         func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
12344         if (!func_attr)
12345                 goto nla_put_failure;
12346
12347         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
12348                        func->instance_id))
12349                 goto nla_put_failure;
12350
12351         nla_nest_end(msg, func_attr);
12352
12353         genlmsg_end(msg, hdr);
12354         return genlmsg_reply(msg, info);
12355
12356 nla_put_failure:
12357         nlmsg_free(msg);
12358         return -ENOBUFS;
12359 }
12360
12361 static int nl80211_nan_del_func(struct sk_buff *skb,
12362                                struct genl_info *info)
12363 {
12364         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12365         struct wireless_dev *wdev = info->user_ptr[1];
12366         u64 cookie;
12367
12368         if (wdev->iftype != NL80211_IFTYPE_NAN)
12369                 return -EOPNOTSUPP;
12370
12371         if (!wdev_running(wdev))
12372                 return -ENOTCONN;
12373
12374         if (!info->attrs[NL80211_ATTR_COOKIE])
12375                 return -EINVAL;
12376
12377         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12378
12379         rdev_del_nan_func(rdev, wdev, cookie);
12380
12381         return 0;
12382 }
12383
12384 static int nl80211_nan_change_config(struct sk_buff *skb,
12385                                      struct genl_info *info)
12386 {
12387         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12388         struct wireless_dev *wdev = info->user_ptr[1];
12389         struct cfg80211_nan_conf conf = {};
12390         u32 changed = 0;
12391
12392         if (wdev->iftype != NL80211_IFTYPE_NAN)
12393                 return -EOPNOTSUPP;
12394
12395         if (!wdev_running(wdev))
12396                 return -ENOTCONN;
12397
12398         if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
12399                 conf.master_pref =
12400                         nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
12401                 if (conf.master_pref <= 1 || conf.master_pref == 255)
12402                         return -EINVAL;
12403
12404                 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
12405         }
12406
12407         if (info->attrs[NL80211_ATTR_BANDS]) {
12408                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
12409
12410                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
12411                         return -EOPNOTSUPP;
12412
12413                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
12414                         return -EINVAL;
12415
12416                 conf.bands = bands;
12417                 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
12418         }
12419
12420         if (!changed)
12421                 return -EINVAL;
12422
12423         return rdev_nan_change_conf(rdev, wdev, &conf, changed);
12424 }
12425
12426 void cfg80211_nan_match(struct wireless_dev *wdev,
12427                         struct cfg80211_nan_match_params *match, gfp_t gfp)
12428 {
12429         struct wiphy *wiphy = wdev->wiphy;
12430         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12431         struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
12432         struct sk_buff *msg;
12433         void *hdr;
12434
12435         if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
12436                 return;
12437
12438         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12439         if (!msg)
12440                 return;
12441
12442         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
12443         if (!hdr) {
12444                 nlmsg_free(msg);
12445                 return;
12446         }
12447
12448         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12449             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12450                                          wdev->netdev->ifindex)) ||
12451             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12452                               NL80211_ATTR_PAD))
12453                 goto nla_put_failure;
12454
12455         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
12456                               NL80211_ATTR_PAD) ||
12457             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
12458                 goto nla_put_failure;
12459
12460         match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH);
12461         if (!match_attr)
12462                 goto nla_put_failure;
12463
12464         local_func_attr = nla_nest_start_noflag(msg,
12465                                                 NL80211_NAN_MATCH_FUNC_LOCAL);
12466         if (!local_func_attr)
12467                 goto nla_put_failure;
12468
12469         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
12470                 goto nla_put_failure;
12471
12472         nla_nest_end(msg, local_func_attr);
12473
12474         peer_func_attr = nla_nest_start_noflag(msg,
12475                                                NL80211_NAN_MATCH_FUNC_PEER);
12476         if (!peer_func_attr)
12477                 goto nla_put_failure;
12478
12479         if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
12480             nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
12481                 goto nla_put_failure;
12482
12483         if (match->info && match->info_len &&
12484             nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
12485                     match->info))
12486                 goto nla_put_failure;
12487
12488         nla_nest_end(msg, peer_func_attr);
12489         nla_nest_end(msg, match_attr);
12490         genlmsg_end(msg, hdr);
12491
12492         if (!wdev->owner_nlportid)
12493                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12494                                         msg, 0, NL80211_MCGRP_NAN, gfp);
12495         else
12496                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
12497                                 wdev->owner_nlportid);
12498
12499         return;
12500
12501 nla_put_failure:
12502         nlmsg_free(msg);
12503 }
12504 EXPORT_SYMBOL(cfg80211_nan_match);
12505
12506 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
12507                                   u8 inst_id,
12508                                   enum nl80211_nan_func_term_reason reason,
12509                                   u64 cookie, gfp_t gfp)
12510 {
12511         struct wiphy *wiphy = wdev->wiphy;
12512         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12513         struct sk_buff *msg;
12514         struct nlattr *func_attr;
12515         void *hdr;
12516
12517         if (WARN_ON(!inst_id))
12518                 return;
12519
12520         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12521         if (!msg)
12522                 return;
12523
12524         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
12525         if (!hdr) {
12526                 nlmsg_free(msg);
12527                 return;
12528         }
12529
12530         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12531             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12532                                          wdev->netdev->ifindex)) ||
12533             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12534                               NL80211_ATTR_PAD))
12535                 goto nla_put_failure;
12536
12537         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12538                               NL80211_ATTR_PAD))
12539                 goto nla_put_failure;
12540
12541         func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
12542         if (!func_attr)
12543                 goto nla_put_failure;
12544
12545         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
12546             nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
12547                 goto nla_put_failure;
12548
12549         nla_nest_end(msg, func_attr);
12550         genlmsg_end(msg, hdr);
12551
12552         if (!wdev->owner_nlportid)
12553                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12554                                         msg, 0, NL80211_MCGRP_NAN, gfp);
12555         else
12556                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
12557                                 wdev->owner_nlportid);
12558
12559         return;
12560
12561 nla_put_failure:
12562         nlmsg_free(msg);
12563 }
12564 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
12565
12566 static int nl80211_get_protocol_features(struct sk_buff *skb,
12567                                          struct genl_info *info)
12568 {
12569         void *hdr;
12570         struct sk_buff *msg;
12571
12572         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12573         if (!msg)
12574                 return -ENOMEM;
12575
12576         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12577                              NL80211_CMD_GET_PROTOCOL_FEATURES);
12578         if (!hdr)
12579                 goto nla_put_failure;
12580
12581         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
12582                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
12583                 goto nla_put_failure;
12584
12585         genlmsg_end(msg, hdr);
12586         return genlmsg_reply(msg, info);
12587
12588  nla_put_failure:
12589         kfree_skb(msg);
12590         return -ENOBUFS;
12591 }
12592
12593 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
12594 {
12595         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12596         struct cfg80211_update_ft_ies_params ft_params;
12597         struct net_device *dev = info->user_ptr[1];
12598
12599         if (!rdev->ops->update_ft_ies)
12600                 return -EOPNOTSUPP;
12601
12602         if (!info->attrs[NL80211_ATTR_MDID] ||
12603             !info->attrs[NL80211_ATTR_IE])
12604                 return -EINVAL;
12605
12606         memset(&ft_params, 0, sizeof(ft_params));
12607         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
12608         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12609         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12610
12611         return rdev_update_ft_ies(rdev, dev, &ft_params);
12612 }
12613
12614 static int nl80211_crit_protocol_start(struct sk_buff *skb,
12615                                        struct genl_info *info)
12616 {
12617         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12618         struct wireless_dev *wdev = info->user_ptr[1];
12619         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
12620         u16 duration;
12621         int ret;
12622
12623         if (!rdev->ops->crit_proto_start)
12624                 return -EOPNOTSUPP;
12625
12626         if (WARN_ON(!rdev->ops->crit_proto_stop))
12627                 return -EINVAL;
12628
12629         if (rdev->crit_proto_nlportid)
12630                 return -EBUSY;
12631
12632         /* determine protocol if provided */
12633         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
12634                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
12635
12636         if (proto >= NUM_NL80211_CRIT_PROTO)
12637                 return -EINVAL;
12638
12639         /* timeout must be provided */
12640         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
12641                 return -EINVAL;
12642
12643         duration =
12644                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
12645
12646         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
12647                 return -ERANGE;
12648
12649         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
12650         if (!ret)
12651                 rdev->crit_proto_nlportid = info->snd_portid;
12652
12653         return ret;
12654 }
12655
12656 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
12657                                       struct genl_info *info)
12658 {
12659         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12660         struct wireless_dev *wdev = info->user_ptr[1];
12661
12662         if (!rdev->ops->crit_proto_stop)
12663                 return -EOPNOTSUPP;
12664
12665         if (rdev->crit_proto_nlportid) {
12666                 rdev->crit_proto_nlportid = 0;
12667                 rdev_crit_proto_stop(rdev, wdev);
12668         }
12669         return 0;
12670 }
12671
12672 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
12673 {
12674         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12675         struct wireless_dev *wdev =
12676                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
12677         int i, err;
12678         u32 vid, subcmd;
12679
12680         if (!rdev->wiphy.vendor_commands)
12681                 return -EOPNOTSUPP;
12682
12683         if (IS_ERR(wdev)) {
12684                 err = PTR_ERR(wdev);
12685                 if (err != -EINVAL)
12686                         return err;
12687                 wdev = NULL;
12688         } else if (wdev->wiphy != &rdev->wiphy) {
12689                 return -EINVAL;
12690         }
12691
12692         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
12693             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
12694                 return -EINVAL;
12695
12696         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
12697         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
12698         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
12699                 const struct wiphy_vendor_command *vcmd;
12700                 void *data = NULL;
12701                 int len = 0;
12702
12703                 vcmd = &rdev->wiphy.vendor_commands[i];
12704
12705                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
12706                         continue;
12707
12708                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
12709                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
12710                         if (!wdev)
12711                                 return -EINVAL;
12712                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
12713                             !wdev->netdev)
12714                                 return -EINVAL;
12715
12716                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
12717                                 if (!wdev_running(wdev))
12718                                         return -ENETDOWN;
12719                         }
12720
12721                         if (!vcmd->doit)
12722                                 return -EOPNOTSUPP;
12723                 } else {
12724                         wdev = NULL;
12725                 }
12726
12727                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
12728                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
12729                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
12730                 }
12731
12732                 rdev->cur_cmd_info = info;
12733                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
12734                                                           data, len);
12735                 rdev->cur_cmd_info = NULL;
12736                 return err;
12737         }
12738
12739         return -EOPNOTSUPP;
12740 }
12741
12742 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
12743                                        struct netlink_callback *cb,
12744                                        struct cfg80211_registered_device **rdev,
12745                                        struct wireless_dev **wdev)
12746 {
12747         struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
12748         u32 vid, subcmd;
12749         unsigned int i;
12750         int vcmd_idx = -1;
12751         int err;
12752         void *data = NULL;
12753         unsigned int data_len = 0;
12754
12755         if (cb->args[0]) {
12756                 /* subtract the 1 again here */
12757                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
12758                 struct wireless_dev *tmp;
12759
12760                 if (!wiphy)
12761                         return -ENODEV;
12762                 *rdev = wiphy_to_rdev(wiphy);
12763                 *wdev = NULL;
12764
12765                 if (cb->args[1]) {
12766                         list_for_each_entry(tmp, &wiphy->wdev_list, list) {
12767                                 if (tmp->identifier == cb->args[1] - 1) {
12768                                         *wdev = tmp;
12769                                         break;
12770                                 }
12771                         }
12772                 }
12773
12774                 /* keep rtnl locked in successful case */
12775                 return 0;
12776         }
12777
12778         err = nlmsg_parse_deprecated(cb->nlh,
12779                                      GENL_HDRLEN + nl80211_fam.hdrsize,
12780                                      attrbuf, nl80211_fam.maxattr,
12781                                      nl80211_policy, NULL);
12782         if (err)
12783                 return err;
12784
12785         if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
12786             !attrbuf[NL80211_ATTR_VENDOR_SUBCMD])
12787                 return -EINVAL;
12788
12789         *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf);
12790         if (IS_ERR(*wdev))
12791                 *wdev = NULL;
12792
12793         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
12794         if (IS_ERR(*rdev))
12795                 return PTR_ERR(*rdev);
12796
12797         vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
12798         subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
12799
12800         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
12801                 const struct wiphy_vendor_command *vcmd;
12802
12803                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
12804
12805                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
12806                         continue;
12807
12808                 if (!vcmd->dumpit)
12809                         return -EOPNOTSUPP;
12810
12811                 vcmd_idx = i;
12812                 break;
12813         }
12814
12815         if (vcmd_idx < 0)
12816                 return -EOPNOTSUPP;
12817
12818         if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
12819                 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
12820                 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
12821         }
12822
12823         /* 0 is the first index - add 1 to parse only once */
12824         cb->args[0] = (*rdev)->wiphy_idx + 1;
12825         /* add 1 to know if it was NULL */
12826         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
12827         cb->args[2] = vcmd_idx;
12828         cb->args[3] = (unsigned long)data;
12829         cb->args[4] = data_len;
12830
12831         /* keep rtnl locked in successful case */
12832         return 0;
12833 }
12834
12835 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
12836                                    struct netlink_callback *cb)
12837 {
12838         struct cfg80211_registered_device *rdev;
12839         struct wireless_dev *wdev;
12840         unsigned int vcmd_idx;
12841         const struct wiphy_vendor_command *vcmd;
12842         void *data;
12843         int data_len;
12844         int err;
12845         struct nlattr *vendor_data;
12846
12847         rtnl_lock();
12848         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
12849         if (err)
12850                 goto out;
12851
12852         vcmd_idx = cb->args[2];
12853         data = (void *)cb->args[3];
12854         data_len = cb->args[4];
12855         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
12856
12857         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
12858                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
12859                 if (!wdev) {
12860                         err = -EINVAL;
12861                         goto out;
12862                 }
12863                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
12864                     !wdev->netdev) {
12865                         err = -EINVAL;
12866                         goto out;
12867                 }
12868
12869                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
12870                         if (!wdev_running(wdev)) {
12871                                 err = -ENETDOWN;
12872                                 goto out;
12873                         }
12874                 }
12875         }
12876
12877         while (1) {
12878                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
12879                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
12880                                            NL80211_CMD_VENDOR);
12881                 if (!hdr)
12882                         break;
12883
12884                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12885                     (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
12886                                                wdev_id(wdev),
12887                                                NL80211_ATTR_PAD))) {
12888                         genlmsg_cancel(skb, hdr);
12889                         break;
12890                 }
12891
12892                 vendor_data = nla_nest_start_noflag(skb,
12893                                                     NL80211_ATTR_VENDOR_DATA);
12894                 if (!vendor_data) {
12895                         genlmsg_cancel(skb, hdr);
12896                         break;
12897                 }
12898
12899                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
12900                                    (unsigned long *)&cb->args[5]);
12901                 nla_nest_end(skb, vendor_data);
12902
12903                 if (err == -ENOBUFS || err == -ENOENT) {
12904                         genlmsg_cancel(skb, hdr);
12905                         break;
12906                 } else if (err) {
12907                         genlmsg_cancel(skb, hdr);
12908                         goto out;
12909                 }
12910
12911                 genlmsg_end(skb, hdr);
12912         }
12913
12914         err = skb->len;
12915  out:
12916         rtnl_unlock();
12917         return err;
12918 }
12919
12920 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
12921                                            enum nl80211_commands cmd,
12922                                            enum nl80211_attrs attr,
12923                                            int approxlen)
12924 {
12925         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12926
12927         if (WARN_ON(!rdev->cur_cmd_info))
12928                 return NULL;
12929
12930         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
12931                                            rdev->cur_cmd_info->snd_portid,
12932                                            rdev->cur_cmd_info->snd_seq,
12933                                            cmd, attr, NULL, GFP_KERNEL);
12934 }
12935 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
12936
12937 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
12938 {
12939         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
12940         void *hdr = ((void **)skb->cb)[1];
12941         struct nlattr *data = ((void **)skb->cb)[2];
12942
12943         /* clear CB data for netlink core to own from now on */
12944         memset(skb->cb, 0, sizeof(skb->cb));
12945
12946         if (WARN_ON(!rdev->cur_cmd_info)) {
12947                 kfree_skb(skb);
12948                 return -EINVAL;
12949         }
12950
12951         nla_nest_end(skb, data);
12952         genlmsg_end(skb, hdr);
12953         return genlmsg_reply(skb, rdev->cur_cmd_info);
12954 }
12955 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
12956
12957 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy)
12958 {
12959         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12960
12961         if (WARN_ON(!rdev->cur_cmd_info))
12962                 return 0;
12963
12964         return rdev->cur_cmd_info->snd_portid;
12965 }
12966 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender);
12967
12968 static int nl80211_set_qos_map(struct sk_buff *skb,
12969                                struct genl_info *info)
12970 {
12971         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12972         struct cfg80211_qos_map *qos_map = NULL;
12973         struct net_device *dev = info->user_ptr[1];
12974         u8 *pos, len, num_des, des_len, des;
12975         int ret;
12976
12977         if (!rdev->ops->set_qos_map)
12978                 return -EOPNOTSUPP;
12979
12980         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
12981                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
12982                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
12983
12984                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
12985                     len > IEEE80211_QOS_MAP_LEN_MAX)
12986                         return -EINVAL;
12987
12988                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
12989                 if (!qos_map)
12990                         return -ENOMEM;
12991
12992                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
12993                 if (num_des) {
12994                         des_len = num_des *
12995                                 sizeof(struct cfg80211_dscp_exception);
12996                         memcpy(qos_map->dscp_exception, pos, des_len);
12997                         qos_map->num_des = num_des;
12998                         for (des = 0; des < num_des; des++) {
12999                                 if (qos_map->dscp_exception[des].up > 7) {
13000                                         kfree(qos_map);
13001                                         return -EINVAL;
13002                                 }
13003                         }
13004                         pos += des_len;
13005                 }
13006                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
13007         }
13008
13009         wdev_lock(dev->ieee80211_ptr);
13010         ret = nl80211_key_allowed(dev->ieee80211_ptr);
13011         if (!ret)
13012                 ret = rdev_set_qos_map(rdev, dev, qos_map);
13013         wdev_unlock(dev->ieee80211_ptr);
13014
13015         kfree(qos_map);
13016         return ret;
13017 }
13018
13019 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
13020 {
13021         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13022         struct net_device *dev = info->user_ptr[1];
13023         struct wireless_dev *wdev = dev->ieee80211_ptr;
13024         const u8 *peer;
13025         u8 tsid, up;
13026         u16 admitted_time = 0;
13027         int err;
13028
13029         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
13030                 return -EOPNOTSUPP;
13031
13032         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
13033             !info->attrs[NL80211_ATTR_USER_PRIO])
13034                 return -EINVAL;
13035
13036         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
13037         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
13038
13039         /* WMM uses TIDs 0-7 even for TSPEC */
13040         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
13041                 /* TODO: handle 802.11 TSPEC/admission control
13042                  * need more attributes for that (e.g. BA session requirement);
13043                  * change the WMM adminssion test above to allow both then
13044                  */
13045                 return -EINVAL;
13046         }
13047
13048         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
13049
13050         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
13051                 admitted_time =
13052                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
13053                 if (!admitted_time)
13054                         return -EINVAL;
13055         }
13056
13057         wdev_lock(wdev);
13058         switch (wdev->iftype) {
13059         case NL80211_IFTYPE_STATION:
13060         case NL80211_IFTYPE_P2P_CLIENT:
13061                 if (wdev->current_bss)
13062                         break;
13063                 err = -ENOTCONN;
13064                 goto out;
13065         default:
13066                 err = -EOPNOTSUPP;
13067                 goto out;
13068         }
13069
13070         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
13071
13072  out:
13073         wdev_unlock(wdev);
13074         return err;
13075 }
13076
13077 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
13078 {
13079         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13080         struct net_device *dev = info->user_ptr[1];
13081         struct wireless_dev *wdev = dev->ieee80211_ptr;
13082         const u8 *peer;
13083         u8 tsid;
13084         int err;
13085
13086         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
13087                 return -EINVAL;
13088
13089         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
13090         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
13091
13092         wdev_lock(wdev);
13093         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
13094         wdev_unlock(wdev);
13095
13096         return err;
13097 }
13098
13099 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
13100                                        struct genl_info *info)
13101 {
13102         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13103         struct net_device *dev = info->user_ptr[1];
13104         struct wireless_dev *wdev = dev->ieee80211_ptr;
13105         struct cfg80211_chan_def chandef = {};
13106         const u8 *addr;
13107         u8 oper_class;
13108         int err;
13109
13110         if (!rdev->ops->tdls_channel_switch ||
13111             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
13112                 return -EOPNOTSUPP;
13113
13114         switch (dev->ieee80211_ptr->iftype) {
13115         case NL80211_IFTYPE_STATION:
13116         case NL80211_IFTYPE_P2P_CLIENT:
13117                 break;
13118         default:
13119                 return -EOPNOTSUPP;
13120         }
13121
13122         if (!info->attrs[NL80211_ATTR_MAC] ||
13123             !info->attrs[NL80211_ATTR_OPER_CLASS])
13124                 return -EINVAL;
13125
13126         err = nl80211_parse_chandef(rdev, info, &chandef);
13127         if (err)
13128                 return err;
13129
13130         /*
13131          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
13132          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
13133          * specification is not defined for them.
13134          */
13135         if (chandef.chan->band == NL80211_BAND_2GHZ &&
13136             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
13137             chandef.width != NL80211_CHAN_WIDTH_20)
13138                 return -EINVAL;
13139
13140         /* we will be active on the TDLS link */
13141         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
13142                                            wdev->iftype))
13143                 return -EINVAL;
13144
13145         /* don't allow switching to DFS channels */
13146         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
13147                 return -EINVAL;
13148
13149         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
13150         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
13151
13152         wdev_lock(wdev);
13153         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
13154         wdev_unlock(wdev);
13155
13156         return err;
13157 }
13158
13159 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
13160                                               struct genl_info *info)
13161 {
13162         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13163         struct net_device *dev = info->user_ptr[1];
13164         struct wireless_dev *wdev = dev->ieee80211_ptr;
13165         const u8 *addr;
13166
13167         if (!rdev->ops->tdls_channel_switch ||
13168             !rdev->ops->tdls_cancel_channel_switch ||
13169             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
13170                 return -EOPNOTSUPP;
13171
13172         switch (dev->ieee80211_ptr->iftype) {
13173         case NL80211_IFTYPE_STATION:
13174         case NL80211_IFTYPE_P2P_CLIENT:
13175                 break;
13176         default:
13177                 return -EOPNOTSUPP;
13178         }
13179
13180         if (!info->attrs[NL80211_ATTR_MAC])
13181                 return -EINVAL;
13182
13183         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
13184
13185         wdev_lock(wdev);
13186         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
13187         wdev_unlock(wdev);
13188
13189         return 0;
13190 }
13191
13192 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
13193                                             struct genl_info *info)
13194 {
13195         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13196         struct net_device *dev = info->user_ptr[1];
13197         struct wireless_dev *wdev = dev->ieee80211_ptr;
13198         const struct nlattr *nla;
13199         bool enabled;
13200
13201         if (!rdev->ops->set_multicast_to_unicast)
13202                 return -EOPNOTSUPP;
13203
13204         if (wdev->iftype != NL80211_IFTYPE_AP &&
13205             wdev->iftype != NL80211_IFTYPE_P2P_GO)
13206                 return -EOPNOTSUPP;
13207
13208         nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
13209         enabled = nla_get_flag(nla);
13210
13211         return rdev_set_multicast_to_unicast(rdev, dev, enabled);
13212 }
13213
13214 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
13215 {
13216         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13217         struct net_device *dev = info->user_ptr[1];
13218         struct wireless_dev *wdev = dev->ieee80211_ptr;
13219         struct cfg80211_pmk_conf pmk_conf = {};
13220         int ret;
13221
13222         if (wdev->iftype != NL80211_IFTYPE_STATION &&
13223             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
13224                 return -EOPNOTSUPP;
13225
13226         if (!wiphy_ext_feature_isset(&rdev->wiphy,
13227                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
13228                 return -EOPNOTSUPP;
13229
13230         if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
13231                 return -EINVAL;
13232
13233         wdev_lock(wdev);
13234         if (!wdev->current_bss) {
13235                 ret = -ENOTCONN;
13236                 goto out;
13237         }
13238
13239         pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
13240         if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) {
13241                 ret = -EINVAL;
13242                 goto out;
13243         }
13244
13245         pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
13246         pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
13247         if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
13248             pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
13249                 ret = -EINVAL;
13250                 goto out;
13251         }
13252
13253         if (info->attrs[NL80211_ATTR_PMKR0_NAME]) {
13254                 int r0_name_len = nla_len(info->attrs[NL80211_ATTR_PMKR0_NAME]);
13255
13256                 if (r0_name_len != WLAN_PMK_NAME_LEN) {
13257                         ret = -EINVAL;
13258                         goto out;
13259                 }
13260
13261                 pmk_conf.pmk_r0_name =
13262                         nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
13263         }
13264
13265         ret = rdev_set_pmk(rdev, dev, &pmk_conf);
13266 out:
13267         wdev_unlock(wdev);
13268         return ret;
13269 }
13270
13271 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
13272 {
13273         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13274         struct net_device *dev = info->user_ptr[1];
13275         struct wireless_dev *wdev = dev->ieee80211_ptr;
13276         const u8 *aa;
13277         int ret;
13278
13279         if (wdev->iftype != NL80211_IFTYPE_STATION &&
13280             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
13281                 return -EOPNOTSUPP;
13282
13283         if (!wiphy_ext_feature_isset(&rdev->wiphy,
13284                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
13285                 return -EOPNOTSUPP;
13286
13287         if (!info->attrs[NL80211_ATTR_MAC])
13288                 return -EINVAL;
13289
13290         wdev_lock(wdev);
13291         aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
13292         ret = rdev_del_pmk(rdev, dev, aa);
13293         wdev_unlock(wdev);
13294
13295         return ret;
13296 }
13297
13298 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
13299 {
13300         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13301         struct net_device *dev = info->user_ptr[1];
13302         struct cfg80211_external_auth_params params;
13303
13304         if (!rdev->ops->external_auth)
13305                 return -EOPNOTSUPP;
13306
13307         if (!info->attrs[NL80211_ATTR_SSID] &&
13308             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
13309             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
13310                 return -EINVAL;
13311
13312         if (!info->attrs[NL80211_ATTR_BSSID])
13313                 return -EINVAL;
13314
13315         if (!info->attrs[NL80211_ATTR_STATUS_CODE])
13316                 return -EINVAL;
13317
13318         memset(&params, 0, sizeof(params));
13319
13320         if (info->attrs[NL80211_ATTR_SSID]) {
13321                 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
13322                 if (params.ssid.ssid_len == 0 ||
13323                     params.ssid.ssid_len > IEEE80211_MAX_SSID_LEN)
13324                         return -EINVAL;
13325                 memcpy(params.ssid.ssid,
13326                        nla_data(info->attrs[NL80211_ATTR_SSID]),
13327                        params.ssid.ssid_len);
13328         }
13329
13330         memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
13331                ETH_ALEN);
13332
13333         params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
13334
13335         if (info->attrs[NL80211_ATTR_PMKID])
13336                 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
13337
13338         return rdev_external_auth(rdev, dev, &params);
13339 }
13340
13341 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
13342 {
13343         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13344         struct net_device *dev = info->user_ptr[1];
13345         struct wireless_dev *wdev = dev->ieee80211_ptr;
13346         const u8 *buf;
13347         size_t len;
13348         u8 *dest;
13349         u16 proto;
13350         bool noencrypt;
13351         int err;
13352
13353         if (!wiphy_ext_feature_isset(&rdev->wiphy,
13354                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
13355                 return -EOPNOTSUPP;
13356
13357         if (!rdev->ops->tx_control_port)
13358                 return -EOPNOTSUPP;
13359
13360         if (!info->attrs[NL80211_ATTR_FRAME] ||
13361             !info->attrs[NL80211_ATTR_MAC] ||
13362             !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
13363                 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
13364                 return -EINVAL;
13365         }
13366
13367         wdev_lock(wdev);
13368
13369         switch (wdev->iftype) {
13370         case NL80211_IFTYPE_AP:
13371         case NL80211_IFTYPE_P2P_GO:
13372         case NL80211_IFTYPE_MESH_POINT:
13373                 break;
13374         case NL80211_IFTYPE_ADHOC:
13375         case NL80211_IFTYPE_STATION:
13376         case NL80211_IFTYPE_P2P_CLIENT:
13377                 if (wdev->current_bss)
13378                         break;
13379                 err = -ENOTCONN;
13380                 goto out;
13381         default:
13382                 err = -EOPNOTSUPP;
13383                 goto out;
13384         }
13385
13386         wdev_unlock(wdev);
13387
13388         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
13389         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
13390         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
13391         proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
13392         noencrypt =
13393                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
13394
13395         return rdev_tx_control_port(rdev, dev, buf, len,
13396                                     dest, cpu_to_be16(proto), noencrypt);
13397
13398  out:
13399         wdev_unlock(wdev);
13400         return err;
13401 }
13402
13403 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
13404                                            struct genl_info *info)
13405 {
13406         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13407         struct net_device *dev = info->user_ptr[1];
13408         struct wireless_dev *wdev = dev->ieee80211_ptr;
13409         struct cfg80211_ftm_responder_stats ftm_stats = {};
13410         struct sk_buff *msg;
13411         void *hdr;
13412         struct nlattr *ftm_stats_attr;
13413         int err;
13414
13415         if (wdev->iftype != NL80211_IFTYPE_AP || !wdev->beacon_interval)
13416                 return -EOPNOTSUPP;
13417
13418         err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
13419         if (err)
13420                 return err;
13421
13422         if (!ftm_stats.filled)
13423                 return -ENODATA;
13424
13425         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13426         if (!msg)
13427                 return -ENOMEM;
13428
13429         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13430                              NL80211_CMD_GET_FTM_RESPONDER_STATS);
13431         if (!hdr)
13432                 return -ENOBUFS;
13433
13434         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
13435                 goto nla_put_failure;
13436
13437         ftm_stats_attr = nla_nest_start_noflag(msg,
13438                                                NL80211_ATTR_FTM_RESPONDER_STATS);
13439         if (!ftm_stats_attr)
13440                 goto nla_put_failure;
13441
13442 #define SET_FTM(field, name, type)                                       \
13443         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
13444             nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name,            \
13445                              ftm_stats.field))                           \
13446                 goto nla_put_failure; } while (0)
13447 #define SET_FTM_U64(field, name)                                         \
13448         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
13449             nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name,           \
13450                               ftm_stats.field, NL80211_FTM_STATS_PAD))   \
13451                 goto nla_put_failure; } while (0)
13452
13453         SET_FTM(success_num, SUCCESS_NUM, u32);
13454         SET_FTM(partial_num, PARTIAL_NUM, u32);
13455         SET_FTM(failed_num, FAILED_NUM, u32);
13456         SET_FTM(asap_num, ASAP_NUM, u32);
13457         SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
13458         SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
13459         SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
13460         SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
13461         SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
13462 #undef SET_FTM
13463
13464         nla_nest_end(msg, ftm_stats_attr);
13465
13466         genlmsg_end(msg, hdr);
13467         return genlmsg_reply(msg, info);
13468
13469 nla_put_failure:
13470         nlmsg_free(msg);
13471         return -ENOBUFS;
13472 }
13473
13474 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info)
13475 {
13476         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13477         struct cfg80211_update_owe_info owe_info;
13478         struct net_device *dev = info->user_ptr[1];
13479
13480         if (!rdev->ops->update_owe_info)
13481                 return -EOPNOTSUPP;
13482
13483         if (!info->attrs[NL80211_ATTR_STATUS_CODE] ||
13484             !info->attrs[NL80211_ATTR_MAC])
13485                 return -EINVAL;
13486
13487         memset(&owe_info, 0, sizeof(owe_info));
13488         owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
13489         nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN);
13490
13491         if (info->attrs[NL80211_ATTR_IE]) {
13492                 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
13493                 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
13494         }
13495
13496         return rdev_update_owe_info(rdev, dev, &owe_info);
13497 }
13498
13499 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info)
13500 {
13501         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13502         struct net_device *dev = info->user_ptr[1];
13503         struct wireless_dev *wdev = dev->ieee80211_ptr;
13504         struct station_info sinfo = {};
13505         const u8 *buf;
13506         size_t len;
13507         u8 *dest;
13508         int err;
13509
13510         if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station)
13511                 return -EOPNOTSUPP;
13512
13513         if (!info->attrs[NL80211_ATTR_MAC] ||
13514             !info->attrs[NL80211_ATTR_FRAME]) {
13515                 GENL_SET_ERR_MSG(info, "Frame or MAC missing");
13516                 return -EINVAL;
13517         }
13518
13519         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
13520                 return -EOPNOTSUPP;
13521
13522         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
13523         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
13524         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
13525
13526         if (len < sizeof(struct ethhdr))
13527                 return -EINVAL;
13528
13529         if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) ||
13530             !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr))
13531                 return -EINVAL;
13532
13533         err = rdev_get_station(rdev, dev, dest, &sinfo);
13534         if (err)
13535                 return err;
13536
13537         return rdev_probe_mesh_link(rdev, dev, dest, buf, len);
13538 }
13539
13540 #define NL80211_FLAG_NEED_WIPHY         0x01
13541 #define NL80211_FLAG_NEED_NETDEV        0x02
13542 #define NL80211_FLAG_NEED_RTNL          0x04
13543 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
13544 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
13545                                          NL80211_FLAG_CHECK_NETDEV_UP)
13546 #define NL80211_FLAG_NEED_WDEV          0x10
13547 /* If a netdev is associated, it must be UP, P2P must be started */
13548 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
13549                                          NL80211_FLAG_CHECK_NETDEV_UP)
13550 #define NL80211_FLAG_CLEAR_SKB          0x20
13551
13552 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
13553                             struct genl_info *info)
13554 {
13555         struct cfg80211_registered_device *rdev;
13556         struct wireless_dev *wdev;
13557         struct net_device *dev;
13558         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
13559
13560         if (rtnl)
13561                 rtnl_lock();
13562
13563         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
13564                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
13565                 if (IS_ERR(rdev)) {
13566                         if (rtnl)
13567                                 rtnl_unlock();
13568                         return PTR_ERR(rdev);
13569                 }
13570                 info->user_ptr[0] = rdev;
13571         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
13572                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
13573                 ASSERT_RTNL();
13574
13575                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
13576                                                   info->attrs);
13577                 if (IS_ERR(wdev)) {
13578                         if (rtnl)
13579                                 rtnl_unlock();
13580                         return PTR_ERR(wdev);
13581                 }
13582
13583                 dev = wdev->netdev;
13584                 rdev = wiphy_to_rdev(wdev->wiphy);
13585
13586                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
13587                         if (!dev) {
13588                                 if (rtnl)
13589                                         rtnl_unlock();
13590                                 return -EINVAL;
13591                         }
13592
13593                         info->user_ptr[1] = dev;
13594                 } else {
13595                         info->user_ptr[1] = wdev;
13596                 }
13597
13598                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
13599                     !wdev_running(wdev)) {
13600                         if (rtnl)
13601                                 rtnl_unlock();
13602                         return -ENETDOWN;
13603                 }
13604
13605                 if (dev)
13606                         dev_hold(dev);
13607
13608                 info->user_ptr[0] = rdev;
13609         }
13610
13611         return 0;
13612 }
13613
13614 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
13615                               struct genl_info *info)
13616 {
13617         if (info->user_ptr[1]) {
13618                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
13619                         struct wireless_dev *wdev = info->user_ptr[1];
13620
13621                         if (wdev->netdev)
13622                                 dev_put(wdev->netdev);
13623                 } else {
13624                         dev_put(info->user_ptr[1]);
13625                 }
13626         }
13627
13628         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
13629                 rtnl_unlock();
13630
13631         /* If needed, clear the netlink message payload from the SKB
13632          * as it might contain key data that shouldn't stick around on
13633          * the heap after the SKB is freed. The netlink message header
13634          * is still needed for further processing, so leave it intact.
13635          */
13636         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
13637                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
13638
13639                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
13640         }
13641 }
13642
13643 static const struct genl_ops nl80211_ops[] = {
13644         {
13645                 .cmd = NL80211_CMD_GET_WIPHY,
13646                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13647                 .doit = nl80211_get_wiphy,
13648                 .dumpit = nl80211_dump_wiphy,
13649                 .done = nl80211_dump_wiphy_done,
13650                 /* can be retrieved by unprivileged users */
13651                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13652                                   NL80211_FLAG_NEED_RTNL,
13653         },
13654         {
13655                 .cmd = NL80211_CMD_SET_WIPHY,
13656                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13657                 .doit = nl80211_set_wiphy,
13658                 .flags = GENL_UNS_ADMIN_PERM,
13659                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13660         },
13661         {
13662                 .cmd = NL80211_CMD_GET_INTERFACE,
13663                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13664                 .doit = nl80211_get_interface,
13665                 .dumpit = nl80211_dump_interface,
13666                 /* can be retrieved by unprivileged users */
13667                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13668                                   NL80211_FLAG_NEED_RTNL,
13669         },
13670         {
13671                 .cmd = NL80211_CMD_SET_INTERFACE,
13672                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13673                 .doit = nl80211_set_interface,
13674                 .flags = GENL_UNS_ADMIN_PERM,
13675                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13676                                   NL80211_FLAG_NEED_RTNL,
13677         },
13678         {
13679                 .cmd = NL80211_CMD_NEW_INTERFACE,
13680                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13681                 .doit = nl80211_new_interface,
13682                 .flags = GENL_UNS_ADMIN_PERM,
13683                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13684                                   NL80211_FLAG_NEED_RTNL,
13685         },
13686         {
13687                 .cmd = NL80211_CMD_DEL_INTERFACE,
13688                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13689                 .doit = nl80211_del_interface,
13690                 .flags = GENL_UNS_ADMIN_PERM,
13691                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13692                                   NL80211_FLAG_NEED_RTNL,
13693         },
13694         {
13695                 .cmd = NL80211_CMD_GET_KEY,
13696                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13697                 .doit = nl80211_get_key,
13698                 .flags = GENL_UNS_ADMIN_PERM,
13699                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13700                                   NL80211_FLAG_NEED_RTNL,
13701         },
13702         {
13703                 .cmd = NL80211_CMD_SET_KEY,
13704                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13705                 .doit = nl80211_set_key,
13706                 .flags = GENL_UNS_ADMIN_PERM,
13707                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13708                                   NL80211_FLAG_NEED_RTNL |
13709                                   NL80211_FLAG_CLEAR_SKB,
13710         },
13711         {
13712                 .cmd = NL80211_CMD_NEW_KEY,
13713                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13714                 .doit = nl80211_new_key,
13715                 .flags = GENL_UNS_ADMIN_PERM,
13716                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13717                                   NL80211_FLAG_NEED_RTNL |
13718                                   NL80211_FLAG_CLEAR_SKB,
13719         },
13720         {
13721                 .cmd = NL80211_CMD_DEL_KEY,
13722                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13723                 .doit = nl80211_del_key,
13724                 .flags = GENL_UNS_ADMIN_PERM,
13725                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13726                                   NL80211_FLAG_NEED_RTNL,
13727         },
13728         {
13729                 .cmd = NL80211_CMD_SET_BEACON,
13730                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13731                 .flags = GENL_UNS_ADMIN_PERM,
13732                 .doit = nl80211_set_beacon,
13733                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13734                                   NL80211_FLAG_NEED_RTNL,
13735         },
13736         {
13737                 .cmd = NL80211_CMD_START_AP,
13738                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13739                 .flags = GENL_UNS_ADMIN_PERM,
13740                 .doit = nl80211_start_ap,
13741                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13742                                   NL80211_FLAG_NEED_RTNL,
13743         },
13744         {
13745                 .cmd = NL80211_CMD_STOP_AP,
13746                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13747                 .flags = GENL_UNS_ADMIN_PERM,
13748                 .doit = nl80211_stop_ap,
13749                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13750                                   NL80211_FLAG_NEED_RTNL,
13751         },
13752         {
13753                 .cmd = NL80211_CMD_GET_STATION,
13754                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13755                 .doit = nl80211_get_station,
13756                 .dumpit = nl80211_dump_station,
13757                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13758                                   NL80211_FLAG_NEED_RTNL,
13759         },
13760         {
13761                 .cmd = NL80211_CMD_SET_STATION,
13762                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13763                 .doit = nl80211_set_station,
13764                 .flags = GENL_UNS_ADMIN_PERM,
13765                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13766                                   NL80211_FLAG_NEED_RTNL,
13767         },
13768         {
13769                 .cmd = NL80211_CMD_NEW_STATION,
13770                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13771                 .doit = nl80211_new_station,
13772                 .flags = GENL_UNS_ADMIN_PERM,
13773                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13774                                   NL80211_FLAG_NEED_RTNL,
13775         },
13776         {
13777                 .cmd = NL80211_CMD_DEL_STATION,
13778                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13779                 .doit = nl80211_del_station,
13780                 .flags = GENL_UNS_ADMIN_PERM,
13781                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13782                                   NL80211_FLAG_NEED_RTNL,
13783         },
13784         {
13785                 .cmd = NL80211_CMD_GET_MPATH,
13786                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13787                 .doit = nl80211_get_mpath,
13788                 .dumpit = nl80211_dump_mpath,
13789                 .flags = GENL_UNS_ADMIN_PERM,
13790                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13791                                   NL80211_FLAG_NEED_RTNL,
13792         },
13793         {
13794                 .cmd = NL80211_CMD_GET_MPP,
13795                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13796                 .doit = nl80211_get_mpp,
13797                 .dumpit = nl80211_dump_mpp,
13798                 .flags = GENL_UNS_ADMIN_PERM,
13799                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13800                                   NL80211_FLAG_NEED_RTNL,
13801         },
13802         {
13803                 .cmd = NL80211_CMD_SET_MPATH,
13804                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13805                 .doit = nl80211_set_mpath,
13806                 .flags = GENL_UNS_ADMIN_PERM,
13807                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13808                                   NL80211_FLAG_NEED_RTNL,
13809         },
13810         {
13811                 .cmd = NL80211_CMD_NEW_MPATH,
13812                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13813                 .doit = nl80211_new_mpath,
13814                 .flags = GENL_UNS_ADMIN_PERM,
13815                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13816                                   NL80211_FLAG_NEED_RTNL,
13817         },
13818         {
13819                 .cmd = NL80211_CMD_DEL_MPATH,
13820                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13821                 .doit = nl80211_del_mpath,
13822                 .flags = GENL_UNS_ADMIN_PERM,
13823                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13824                                   NL80211_FLAG_NEED_RTNL,
13825         },
13826         {
13827                 .cmd = NL80211_CMD_SET_BSS,
13828                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13829                 .doit = nl80211_set_bss,
13830                 .flags = GENL_UNS_ADMIN_PERM,
13831                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13832                                   NL80211_FLAG_NEED_RTNL,
13833         },
13834         {
13835                 .cmd = NL80211_CMD_GET_REG,
13836                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13837                 .doit = nl80211_get_reg_do,
13838                 .dumpit = nl80211_get_reg_dump,
13839                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13840                 /* can be retrieved by unprivileged users */
13841         },
13842 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
13843         {
13844                 .cmd = NL80211_CMD_SET_REG,
13845                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13846                 .doit = nl80211_set_reg,
13847                 .flags = GENL_ADMIN_PERM,
13848                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13849         },
13850 #endif
13851         {
13852                 .cmd = NL80211_CMD_REQ_SET_REG,
13853                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13854                 .doit = nl80211_req_set_reg,
13855                 .flags = GENL_ADMIN_PERM,
13856         },
13857         {
13858                 .cmd = NL80211_CMD_RELOAD_REGDB,
13859                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13860                 .doit = nl80211_reload_regdb,
13861                 .flags = GENL_ADMIN_PERM,
13862         },
13863         {
13864                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
13865                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13866                 .doit = nl80211_get_mesh_config,
13867                 /* can be retrieved by unprivileged users */
13868                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13869                                   NL80211_FLAG_NEED_RTNL,
13870         },
13871         {
13872                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
13873                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13874                 .doit = nl80211_update_mesh_config,
13875                 .flags = GENL_UNS_ADMIN_PERM,
13876                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13877                                   NL80211_FLAG_NEED_RTNL,
13878         },
13879         {
13880                 .cmd = NL80211_CMD_TRIGGER_SCAN,
13881                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13882                 .doit = nl80211_trigger_scan,
13883                 .flags = GENL_UNS_ADMIN_PERM,
13884                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13885                                   NL80211_FLAG_NEED_RTNL,
13886         },
13887         {
13888                 .cmd = NL80211_CMD_ABORT_SCAN,
13889                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13890                 .doit = nl80211_abort_scan,
13891                 .flags = GENL_UNS_ADMIN_PERM,
13892                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13893                                   NL80211_FLAG_NEED_RTNL,
13894         },
13895         {
13896                 .cmd = NL80211_CMD_GET_SCAN,
13897                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13898                 .dumpit = nl80211_dump_scan,
13899         },
13900         {
13901                 .cmd = NL80211_CMD_START_SCHED_SCAN,
13902                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13903                 .doit = nl80211_start_sched_scan,
13904                 .flags = GENL_UNS_ADMIN_PERM,
13905                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13906                                   NL80211_FLAG_NEED_RTNL,
13907         },
13908         {
13909                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
13910                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13911                 .doit = nl80211_stop_sched_scan,
13912                 .flags = GENL_UNS_ADMIN_PERM,
13913                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13914                                   NL80211_FLAG_NEED_RTNL,
13915         },
13916         {
13917                 .cmd = NL80211_CMD_AUTHENTICATE,
13918                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13919                 .doit = nl80211_authenticate,
13920                 .flags = GENL_UNS_ADMIN_PERM,
13921                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13922                                   NL80211_FLAG_NEED_RTNL |
13923                                   NL80211_FLAG_CLEAR_SKB,
13924         },
13925         {
13926                 .cmd = NL80211_CMD_ASSOCIATE,
13927                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13928                 .doit = nl80211_associate,
13929                 .flags = GENL_UNS_ADMIN_PERM,
13930                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13931                                   NL80211_FLAG_NEED_RTNL |
13932                                   NL80211_FLAG_CLEAR_SKB,
13933         },
13934         {
13935                 .cmd = NL80211_CMD_DEAUTHENTICATE,
13936                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13937                 .doit = nl80211_deauthenticate,
13938                 .flags = GENL_UNS_ADMIN_PERM,
13939                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13940                                   NL80211_FLAG_NEED_RTNL,
13941         },
13942         {
13943                 .cmd = NL80211_CMD_DISASSOCIATE,
13944                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13945                 .doit = nl80211_disassociate,
13946                 .flags = GENL_UNS_ADMIN_PERM,
13947                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13948                                   NL80211_FLAG_NEED_RTNL,
13949         },
13950         {
13951                 .cmd = NL80211_CMD_JOIN_IBSS,
13952                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13953                 .doit = nl80211_join_ibss,
13954                 .flags = GENL_UNS_ADMIN_PERM,
13955                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13956                                   NL80211_FLAG_NEED_RTNL,
13957         },
13958         {
13959                 .cmd = NL80211_CMD_LEAVE_IBSS,
13960                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13961                 .doit = nl80211_leave_ibss,
13962                 .flags = GENL_UNS_ADMIN_PERM,
13963                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13964                                   NL80211_FLAG_NEED_RTNL,
13965         },
13966 #ifdef CONFIG_NL80211_TESTMODE
13967         {
13968                 .cmd = NL80211_CMD_TESTMODE,
13969                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13970                 .doit = nl80211_testmode_do,
13971                 .dumpit = nl80211_testmode_dump,
13972                 .flags = GENL_UNS_ADMIN_PERM,
13973                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13974                                   NL80211_FLAG_NEED_RTNL,
13975         },
13976 #endif
13977         {
13978                 .cmd = NL80211_CMD_CONNECT,
13979                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13980                 .doit = nl80211_connect,
13981                 .flags = GENL_UNS_ADMIN_PERM,
13982                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13983                                   NL80211_FLAG_NEED_RTNL |
13984                                   NL80211_FLAG_CLEAR_SKB,
13985         },
13986         {
13987                 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
13988                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13989                 .doit = nl80211_update_connect_params,
13990                 .flags = GENL_ADMIN_PERM,
13991                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13992                                   NL80211_FLAG_NEED_RTNL |
13993                                   NL80211_FLAG_CLEAR_SKB,
13994         },
13995         {
13996                 .cmd = NL80211_CMD_DISCONNECT,
13997                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
13998                 .doit = nl80211_disconnect,
13999                 .flags = GENL_UNS_ADMIN_PERM,
14000                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14001                                   NL80211_FLAG_NEED_RTNL,
14002         },
14003         {
14004                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
14005                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14006                 .doit = nl80211_wiphy_netns,
14007                 .flags = GENL_UNS_ADMIN_PERM,
14008                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14009                                   NL80211_FLAG_NEED_RTNL,
14010         },
14011         {
14012                 .cmd = NL80211_CMD_GET_SURVEY,
14013                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14014                 .dumpit = nl80211_dump_survey,
14015         },
14016         {
14017                 .cmd = NL80211_CMD_SET_PMKSA,
14018                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14019                 .doit = nl80211_setdel_pmksa,
14020                 .flags = GENL_UNS_ADMIN_PERM,
14021                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14022                                   NL80211_FLAG_NEED_RTNL |
14023                                   NL80211_FLAG_CLEAR_SKB,
14024         },
14025         {
14026                 .cmd = NL80211_CMD_DEL_PMKSA,
14027                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14028                 .doit = nl80211_setdel_pmksa,
14029                 .flags = GENL_UNS_ADMIN_PERM,
14030                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14031                                   NL80211_FLAG_NEED_RTNL,
14032         },
14033         {
14034                 .cmd = NL80211_CMD_FLUSH_PMKSA,
14035                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14036                 .doit = nl80211_flush_pmksa,
14037                 .flags = GENL_UNS_ADMIN_PERM,
14038                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14039                                   NL80211_FLAG_NEED_RTNL,
14040         },
14041         {
14042                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
14043                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14044                 .doit = nl80211_remain_on_channel,
14045                 .flags = GENL_UNS_ADMIN_PERM,
14046                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14047                                   NL80211_FLAG_NEED_RTNL,
14048         },
14049         {
14050                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
14051                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14052                 .doit = nl80211_cancel_remain_on_channel,
14053                 .flags = GENL_UNS_ADMIN_PERM,
14054                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14055                                   NL80211_FLAG_NEED_RTNL,
14056         },
14057         {
14058                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
14059                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14060                 .doit = nl80211_set_tx_bitrate_mask,
14061                 .flags = GENL_UNS_ADMIN_PERM,
14062                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14063                                   NL80211_FLAG_NEED_RTNL,
14064         },
14065         {
14066                 .cmd = NL80211_CMD_REGISTER_FRAME,
14067                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14068                 .doit = nl80211_register_mgmt,
14069                 .flags = GENL_UNS_ADMIN_PERM,
14070                 .internal_flags = NL80211_FLAG_NEED_WDEV |
14071                                   NL80211_FLAG_NEED_RTNL,
14072         },
14073         {
14074                 .cmd = NL80211_CMD_FRAME,
14075                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14076                 .doit = nl80211_tx_mgmt,
14077                 .flags = GENL_UNS_ADMIN_PERM,
14078                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14079                                   NL80211_FLAG_NEED_RTNL,
14080         },
14081         {
14082                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
14083                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14084                 .doit = nl80211_tx_mgmt_cancel_wait,
14085                 .flags = GENL_UNS_ADMIN_PERM,
14086                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14087                                   NL80211_FLAG_NEED_RTNL,
14088         },
14089         {
14090                 .cmd = NL80211_CMD_SET_POWER_SAVE,
14091                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14092                 .doit = nl80211_set_power_save,
14093                 .flags = GENL_UNS_ADMIN_PERM,
14094                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14095                                   NL80211_FLAG_NEED_RTNL,
14096         },
14097         {
14098                 .cmd = NL80211_CMD_GET_POWER_SAVE,
14099                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14100                 .doit = nl80211_get_power_save,
14101                 /* can be retrieved by unprivileged users */
14102                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14103                                   NL80211_FLAG_NEED_RTNL,
14104         },
14105         {
14106                 .cmd = NL80211_CMD_SET_CQM,
14107                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14108                 .doit = nl80211_set_cqm,
14109                 .flags = GENL_UNS_ADMIN_PERM,
14110                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14111                                   NL80211_FLAG_NEED_RTNL,
14112         },
14113         {
14114                 .cmd = NL80211_CMD_SET_CHANNEL,
14115                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14116                 .doit = nl80211_set_channel,
14117                 .flags = GENL_UNS_ADMIN_PERM,
14118                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14119                                   NL80211_FLAG_NEED_RTNL,
14120         },
14121         {
14122                 .cmd = NL80211_CMD_SET_WDS_PEER,
14123                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14124                 .doit = nl80211_set_wds_peer,
14125                 .flags = GENL_UNS_ADMIN_PERM,
14126                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14127                                   NL80211_FLAG_NEED_RTNL,
14128         },
14129         {
14130                 .cmd = NL80211_CMD_JOIN_MESH,
14131                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14132                 .doit = nl80211_join_mesh,
14133                 .flags = GENL_UNS_ADMIN_PERM,
14134                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14135                                   NL80211_FLAG_NEED_RTNL,
14136         },
14137         {
14138                 .cmd = NL80211_CMD_LEAVE_MESH,
14139                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14140                 .doit = nl80211_leave_mesh,
14141                 .flags = GENL_UNS_ADMIN_PERM,
14142                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14143                                   NL80211_FLAG_NEED_RTNL,
14144         },
14145         {
14146                 .cmd = NL80211_CMD_JOIN_OCB,
14147                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14148                 .doit = nl80211_join_ocb,
14149                 .flags = GENL_UNS_ADMIN_PERM,
14150                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14151                                   NL80211_FLAG_NEED_RTNL,
14152         },
14153         {
14154                 .cmd = NL80211_CMD_LEAVE_OCB,
14155                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14156                 .doit = nl80211_leave_ocb,
14157                 .flags = GENL_UNS_ADMIN_PERM,
14158                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14159                                   NL80211_FLAG_NEED_RTNL,
14160         },
14161 #ifdef CONFIG_PM
14162         {
14163                 .cmd = NL80211_CMD_GET_WOWLAN,
14164                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14165                 .doit = nl80211_get_wowlan,
14166                 /* can be retrieved by unprivileged users */
14167                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14168                                   NL80211_FLAG_NEED_RTNL,
14169         },
14170         {
14171                 .cmd = NL80211_CMD_SET_WOWLAN,
14172                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14173                 .doit = nl80211_set_wowlan,
14174                 .flags = GENL_UNS_ADMIN_PERM,
14175                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14176                                   NL80211_FLAG_NEED_RTNL,
14177         },
14178 #endif
14179         {
14180                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
14181                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14182                 .doit = nl80211_set_rekey_data,
14183                 .flags = GENL_UNS_ADMIN_PERM,
14184                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14185                                   NL80211_FLAG_NEED_RTNL |
14186                                   NL80211_FLAG_CLEAR_SKB,
14187         },
14188         {
14189                 .cmd = NL80211_CMD_TDLS_MGMT,
14190                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14191                 .doit = nl80211_tdls_mgmt,
14192                 .flags = GENL_UNS_ADMIN_PERM,
14193                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14194                                   NL80211_FLAG_NEED_RTNL,
14195         },
14196         {
14197                 .cmd = NL80211_CMD_TDLS_OPER,
14198                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14199                 .doit = nl80211_tdls_oper,
14200                 .flags = GENL_UNS_ADMIN_PERM,
14201                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14202                                   NL80211_FLAG_NEED_RTNL,
14203         },
14204         {
14205                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
14206                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14207                 .doit = nl80211_register_unexpected_frame,
14208                 .flags = GENL_UNS_ADMIN_PERM,
14209                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14210                                   NL80211_FLAG_NEED_RTNL,
14211         },
14212         {
14213                 .cmd = NL80211_CMD_PROBE_CLIENT,
14214                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14215                 .doit = nl80211_probe_client,
14216                 .flags = GENL_UNS_ADMIN_PERM,
14217                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14218                                   NL80211_FLAG_NEED_RTNL,
14219         },
14220         {
14221                 .cmd = NL80211_CMD_REGISTER_BEACONS,
14222                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14223                 .doit = nl80211_register_beacons,
14224                 .flags = GENL_UNS_ADMIN_PERM,
14225                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14226                                   NL80211_FLAG_NEED_RTNL,
14227         },
14228         {
14229                 .cmd = NL80211_CMD_SET_NOACK_MAP,
14230                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14231                 .doit = nl80211_set_noack_map,
14232                 .flags = GENL_UNS_ADMIN_PERM,
14233                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14234                                   NL80211_FLAG_NEED_RTNL,
14235         },
14236         {
14237                 .cmd = NL80211_CMD_START_P2P_DEVICE,
14238                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14239                 .doit = nl80211_start_p2p_device,
14240                 .flags = GENL_UNS_ADMIN_PERM,
14241                 .internal_flags = NL80211_FLAG_NEED_WDEV |
14242                                   NL80211_FLAG_NEED_RTNL,
14243         },
14244         {
14245                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
14246                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14247                 .doit = nl80211_stop_p2p_device,
14248                 .flags = GENL_UNS_ADMIN_PERM,
14249                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14250                                   NL80211_FLAG_NEED_RTNL,
14251         },
14252         {
14253                 .cmd = NL80211_CMD_START_NAN,
14254                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14255                 .doit = nl80211_start_nan,
14256                 .flags = GENL_ADMIN_PERM,
14257                 .internal_flags = NL80211_FLAG_NEED_WDEV |
14258                                   NL80211_FLAG_NEED_RTNL,
14259         },
14260         {
14261                 .cmd = NL80211_CMD_STOP_NAN,
14262                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14263                 .doit = nl80211_stop_nan,
14264                 .flags = GENL_ADMIN_PERM,
14265                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14266                                   NL80211_FLAG_NEED_RTNL,
14267         },
14268         {
14269                 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
14270                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14271                 .doit = nl80211_nan_add_func,
14272                 .flags = GENL_ADMIN_PERM,
14273                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14274                                   NL80211_FLAG_NEED_RTNL,
14275         },
14276         {
14277                 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
14278                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14279                 .doit = nl80211_nan_del_func,
14280                 .flags = GENL_ADMIN_PERM,
14281                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14282                                   NL80211_FLAG_NEED_RTNL,
14283         },
14284         {
14285                 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
14286                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14287                 .doit = nl80211_nan_change_config,
14288                 .flags = GENL_ADMIN_PERM,
14289                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14290                                   NL80211_FLAG_NEED_RTNL,
14291         },
14292         {
14293                 .cmd = NL80211_CMD_SET_MCAST_RATE,
14294                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14295                 .doit = nl80211_set_mcast_rate,
14296                 .flags = GENL_UNS_ADMIN_PERM,
14297                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14298                                   NL80211_FLAG_NEED_RTNL,
14299         },
14300         {
14301                 .cmd = NL80211_CMD_SET_MAC_ACL,
14302                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14303                 .doit = nl80211_set_mac_acl,
14304                 .flags = GENL_UNS_ADMIN_PERM,
14305                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14306                                   NL80211_FLAG_NEED_RTNL,
14307         },
14308         {
14309                 .cmd = NL80211_CMD_RADAR_DETECT,
14310                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14311                 .doit = nl80211_start_radar_detection,
14312                 .flags = GENL_UNS_ADMIN_PERM,
14313                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14314                                   NL80211_FLAG_NEED_RTNL,
14315         },
14316         {
14317                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
14318                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14319                 .doit = nl80211_get_protocol_features,
14320         },
14321         {
14322                 .cmd = NL80211_CMD_UPDATE_FT_IES,
14323                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14324                 .doit = nl80211_update_ft_ies,
14325                 .flags = GENL_UNS_ADMIN_PERM,
14326                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14327                                   NL80211_FLAG_NEED_RTNL,
14328         },
14329         {
14330                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
14331                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14332                 .doit = nl80211_crit_protocol_start,
14333                 .flags = GENL_UNS_ADMIN_PERM,
14334                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14335                                   NL80211_FLAG_NEED_RTNL,
14336         },
14337         {
14338                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
14339                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14340                 .doit = nl80211_crit_protocol_stop,
14341                 .flags = GENL_UNS_ADMIN_PERM,
14342                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14343                                   NL80211_FLAG_NEED_RTNL,
14344         },
14345         {
14346                 .cmd = NL80211_CMD_GET_COALESCE,
14347                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14348                 .doit = nl80211_get_coalesce,
14349                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14350                                   NL80211_FLAG_NEED_RTNL,
14351         },
14352         {
14353                 .cmd = NL80211_CMD_SET_COALESCE,
14354                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14355                 .doit = nl80211_set_coalesce,
14356                 .flags = GENL_UNS_ADMIN_PERM,
14357                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14358                                   NL80211_FLAG_NEED_RTNL,
14359         },
14360         {
14361                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
14362                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14363                 .doit = nl80211_channel_switch,
14364                 .flags = GENL_UNS_ADMIN_PERM,
14365                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14366                                   NL80211_FLAG_NEED_RTNL,
14367         },
14368         {
14369                 .cmd = NL80211_CMD_VENDOR,
14370                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14371                 .doit = nl80211_vendor_cmd,
14372                 .dumpit = nl80211_vendor_cmd_dump,
14373                 .flags = GENL_UNS_ADMIN_PERM,
14374                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14375                                   NL80211_FLAG_NEED_RTNL |
14376                                   NL80211_FLAG_CLEAR_SKB,
14377         },
14378         {
14379                 .cmd = NL80211_CMD_SET_QOS_MAP,
14380                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14381                 .doit = nl80211_set_qos_map,
14382                 .flags = GENL_UNS_ADMIN_PERM,
14383                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14384                                   NL80211_FLAG_NEED_RTNL,
14385         },
14386         {
14387                 .cmd = NL80211_CMD_ADD_TX_TS,
14388                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14389                 .doit = nl80211_add_tx_ts,
14390                 .flags = GENL_UNS_ADMIN_PERM,
14391                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14392                                   NL80211_FLAG_NEED_RTNL,
14393         },
14394         {
14395                 .cmd = NL80211_CMD_DEL_TX_TS,
14396                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14397                 .doit = nl80211_del_tx_ts,
14398                 .flags = GENL_UNS_ADMIN_PERM,
14399                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14400                                   NL80211_FLAG_NEED_RTNL,
14401         },
14402         {
14403                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
14404                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14405                 .doit = nl80211_tdls_channel_switch,
14406                 .flags = GENL_UNS_ADMIN_PERM,
14407                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14408                                   NL80211_FLAG_NEED_RTNL,
14409         },
14410         {
14411                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
14412                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14413                 .doit = nl80211_tdls_cancel_channel_switch,
14414                 .flags = GENL_UNS_ADMIN_PERM,
14415                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14416                                   NL80211_FLAG_NEED_RTNL,
14417         },
14418         {
14419                 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
14420                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14421                 .doit = nl80211_set_multicast_to_unicast,
14422                 .flags = GENL_UNS_ADMIN_PERM,
14423                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14424                                   NL80211_FLAG_NEED_RTNL,
14425         },
14426         {
14427                 .cmd = NL80211_CMD_SET_PMK,
14428                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14429                 .doit = nl80211_set_pmk,
14430                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14431                                   NL80211_FLAG_NEED_RTNL |
14432                                   NL80211_FLAG_CLEAR_SKB,
14433         },
14434         {
14435                 .cmd = NL80211_CMD_DEL_PMK,
14436                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14437                 .doit = nl80211_del_pmk,
14438                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14439                                   NL80211_FLAG_NEED_RTNL,
14440         },
14441         {
14442                 .cmd = NL80211_CMD_EXTERNAL_AUTH,
14443                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14444                 .doit = nl80211_external_auth,
14445                 .flags = GENL_ADMIN_PERM,
14446                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14447                                   NL80211_FLAG_NEED_RTNL,
14448         },
14449         {
14450                 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
14451                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14452                 .doit = nl80211_tx_control_port,
14453                 .flags = GENL_UNS_ADMIN_PERM,
14454                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14455                                   NL80211_FLAG_NEED_RTNL,
14456         },
14457         {
14458                 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
14459                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14460                 .doit = nl80211_get_ftm_responder_stats,
14461                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14462                                   NL80211_FLAG_NEED_RTNL,
14463         },
14464         {
14465                 .cmd = NL80211_CMD_PEER_MEASUREMENT_START,
14466                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14467                 .doit = nl80211_pmsr_start,
14468                 .flags = GENL_UNS_ADMIN_PERM,
14469                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14470                                   NL80211_FLAG_NEED_RTNL,
14471         },
14472         {
14473                 .cmd = NL80211_CMD_NOTIFY_RADAR,
14474                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14475                 .doit = nl80211_notify_radar_detection,
14476                 .flags = GENL_UNS_ADMIN_PERM,
14477                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14478                                   NL80211_FLAG_NEED_RTNL,
14479         },
14480         {
14481                 .cmd = NL80211_CMD_UPDATE_OWE_INFO,
14482                 .doit = nl80211_update_owe_info,
14483                 .flags = GENL_ADMIN_PERM,
14484                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14485                                   NL80211_FLAG_NEED_RTNL,
14486         },
14487         {
14488                 .cmd = NL80211_CMD_PROBE_MESH_LINK,
14489                 .doit = nl80211_probe_mesh_link,
14490                 .flags = GENL_UNS_ADMIN_PERM,
14491                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14492                                   NL80211_FLAG_NEED_RTNL,
14493         },
14494 };
14495
14496 static struct genl_family nl80211_fam __ro_after_init = {
14497         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
14498         .hdrsize = 0,                   /* no private header */
14499         .version = 1,                   /* no particular meaning now */
14500         .maxattr = NL80211_ATTR_MAX,
14501         .policy = nl80211_policy,
14502         .netnsok = true,
14503         .pre_doit = nl80211_pre_doit,
14504         .post_doit = nl80211_post_doit,
14505         .module = THIS_MODULE,
14506         .ops = nl80211_ops,
14507         .n_ops = ARRAY_SIZE(nl80211_ops),
14508         .mcgrps = nl80211_mcgrps,
14509         .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
14510 };
14511
14512 /* notification functions */
14513
14514 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
14515                           enum nl80211_commands cmd)
14516 {
14517         struct sk_buff *msg;
14518         struct nl80211_dump_wiphy_state state = {};
14519
14520         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
14521                 cmd != NL80211_CMD_DEL_WIPHY);
14522
14523         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14524         if (!msg)
14525                 return;
14526
14527         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
14528                 nlmsg_free(msg);
14529                 return;
14530         }
14531
14532         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14533                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
14534 }
14535
14536 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
14537                                 struct wireless_dev *wdev,
14538                                 enum nl80211_commands cmd)
14539 {
14540         struct sk_buff *msg;
14541
14542         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14543         if (!msg)
14544                 return;
14545
14546         if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) {
14547                 nlmsg_free(msg);
14548                 return;
14549         }
14550
14551         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14552                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
14553 }
14554
14555 static int nl80211_add_scan_req(struct sk_buff *msg,
14556                                 struct cfg80211_registered_device *rdev)
14557 {
14558         struct cfg80211_scan_request *req = rdev->scan_req;
14559         struct nlattr *nest;
14560         int i;
14561
14562         if (WARN_ON(!req))
14563                 return 0;
14564
14565         nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS);
14566         if (!nest)
14567                 goto nla_put_failure;
14568         for (i = 0; i < req->n_ssids; i++) {
14569                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
14570                         goto nla_put_failure;
14571         }
14572         nla_nest_end(msg, nest);
14573
14574         nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
14575         if (!nest)
14576                 goto nla_put_failure;
14577         for (i = 0; i < req->n_channels; i++) {
14578                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
14579                         goto nla_put_failure;
14580         }
14581         nla_nest_end(msg, nest);
14582
14583         if (req->ie &&
14584             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
14585                 goto nla_put_failure;
14586
14587         if (req->flags &&
14588             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
14589                 goto nla_put_failure;
14590
14591         if (req->info.scan_start_tsf &&
14592             (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
14593                                req->info.scan_start_tsf, NL80211_BSS_PAD) ||
14594              nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
14595                      req->info.tsf_bssid)))
14596                 goto nla_put_failure;
14597
14598         return 0;
14599  nla_put_failure:
14600         return -ENOBUFS;
14601 }
14602
14603 static int nl80211_prep_scan_msg(struct sk_buff *msg,
14604                                  struct cfg80211_registered_device *rdev,
14605                                  struct wireless_dev *wdev,
14606                                  u32 portid, u32 seq, int flags,
14607                                  u32 cmd)
14608 {
14609         void *hdr;
14610
14611         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
14612         if (!hdr)
14613                 return -1;
14614
14615         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14616             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14617                                          wdev->netdev->ifindex)) ||
14618             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14619                               NL80211_ATTR_PAD))
14620                 goto nla_put_failure;
14621
14622         /* ignore errors and send incomplete event anyway */
14623         nl80211_add_scan_req(msg, rdev);
14624
14625         genlmsg_end(msg, hdr);
14626         return 0;
14627
14628  nla_put_failure:
14629         genlmsg_cancel(msg, hdr);
14630         return -EMSGSIZE;
14631 }
14632
14633 static int
14634 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
14635                             struct cfg80211_sched_scan_request *req, u32 cmd)
14636 {
14637         void *hdr;
14638
14639         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14640         if (!hdr)
14641                 return -1;
14642
14643         if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
14644                         wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
14645             nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
14646             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
14647                               NL80211_ATTR_PAD))
14648                 goto nla_put_failure;
14649
14650         genlmsg_end(msg, hdr);
14651         return 0;
14652
14653  nla_put_failure:
14654         genlmsg_cancel(msg, hdr);
14655         return -EMSGSIZE;
14656 }
14657
14658 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
14659                              struct wireless_dev *wdev)
14660 {
14661         struct sk_buff *msg;
14662
14663         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14664         if (!msg)
14665                 return;
14666
14667         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
14668                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
14669                 nlmsg_free(msg);
14670                 return;
14671         }
14672
14673         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14674                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14675 }
14676
14677 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
14678                                        struct wireless_dev *wdev, bool aborted)
14679 {
14680         struct sk_buff *msg;
14681
14682         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14683         if (!msg)
14684                 return NULL;
14685
14686         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
14687                                   aborted ? NL80211_CMD_SCAN_ABORTED :
14688                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
14689                 nlmsg_free(msg);
14690                 return NULL;
14691         }
14692
14693         return msg;
14694 }
14695
14696 /* send message created by nl80211_build_scan_msg() */
14697 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
14698                            struct sk_buff *msg)
14699 {
14700         if (!msg)
14701                 return;
14702
14703         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14704                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14705 }
14706
14707 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
14708 {
14709         struct sk_buff *msg;
14710
14711         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14712         if (!msg)
14713                 return;
14714
14715         if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
14716                 nlmsg_free(msg);
14717                 return;
14718         }
14719
14720         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
14721                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14722 }
14723
14724 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
14725                                           struct regulatory_request *request)
14726 {
14727         /* Userspace can always count this one always being set */
14728         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
14729                 goto nla_put_failure;
14730
14731         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
14732                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14733                                NL80211_REGDOM_TYPE_WORLD))
14734                         goto nla_put_failure;
14735         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
14736                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14737                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
14738                         goto nla_put_failure;
14739         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
14740                    request->intersect) {
14741                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14742                                NL80211_REGDOM_TYPE_INTERSECTION))
14743                         goto nla_put_failure;
14744         } else {
14745                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14746                                NL80211_REGDOM_TYPE_COUNTRY) ||
14747                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
14748                                    request->alpha2))
14749                         goto nla_put_failure;
14750         }
14751
14752         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
14753                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
14754
14755                 if (wiphy &&
14756                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
14757                         goto nla_put_failure;
14758
14759                 if (wiphy &&
14760                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
14761                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
14762                         goto nla_put_failure;
14763         }
14764
14765         return true;
14766
14767 nla_put_failure:
14768         return false;
14769 }
14770
14771 /*
14772  * This can happen on global regulatory changes or device specific settings
14773  * based on custom regulatory domains.
14774  */
14775 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
14776                                      struct regulatory_request *request)
14777 {
14778         struct sk_buff *msg;
14779         void *hdr;
14780
14781         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14782         if (!msg)
14783                 return;
14784
14785         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
14786         if (!hdr) {
14787                 nlmsg_free(msg);
14788                 return;
14789         }
14790
14791         if (nl80211_reg_change_event_fill(msg, request) == false)
14792                 goto nla_put_failure;
14793
14794         genlmsg_end(msg, hdr);
14795
14796         rcu_read_lock();
14797         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
14798                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
14799         rcu_read_unlock();
14800
14801         return;
14802
14803 nla_put_failure:
14804         nlmsg_free(msg);
14805 }
14806
14807 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
14808                                     struct net_device *netdev,
14809                                     const u8 *buf, size_t len,
14810                                     enum nl80211_commands cmd, gfp_t gfp,
14811                                     int uapsd_queues, const u8 *req_ies,
14812                                     size_t req_ies_len)
14813 {
14814         struct sk_buff *msg;
14815         void *hdr;
14816
14817         msg = nlmsg_new(100 + len + req_ies_len, gfp);
14818         if (!msg)
14819                 return;
14820
14821         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14822         if (!hdr) {
14823                 nlmsg_free(msg);
14824                 return;
14825         }
14826
14827         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14828             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14829             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
14830             (req_ies &&
14831              nla_put(msg, NL80211_ATTR_REQ_IE, req_ies_len, req_ies)))
14832                 goto nla_put_failure;
14833
14834         if (uapsd_queues >= 0) {
14835                 struct nlattr *nla_wmm =
14836                         nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME);
14837                 if (!nla_wmm)
14838                         goto nla_put_failure;
14839
14840                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
14841                                uapsd_queues))
14842                         goto nla_put_failure;
14843
14844                 nla_nest_end(msg, nla_wmm);
14845         }
14846
14847         genlmsg_end(msg, hdr);
14848
14849         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14850                                 NL80211_MCGRP_MLME, gfp);
14851         return;
14852
14853  nla_put_failure:
14854         nlmsg_free(msg);
14855 }
14856
14857 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
14858                           struct net_device *netdev, const u8 *buf,
14859                           size_t len, gfp_t gfp)
14860 {
14861         nl80211_send_mlme_event(rdev, netdev, buf, len,
14862                                 NL80211_CMD_AUTHENTICATE, gfp, -1, NULL, 0);
14863 }
14864
14865 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
14866                            struct net_device *netdev, const u8 *buf,
14867                            size_t len, gfp_t gfp, int uapsd_queues,
14868                            const u8 *req_ies, size_t req_ies_len)
14869 {
14870         nl80211_send_mlme_event(rdev, netdev, buf, len,
14871                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues,
14872                                 req_ies, req_ies_len);
14873 }
14874
14875 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
14876                          struct net_device *netdev, const u8 *buf,
14877                          size_t len, gfp_t gfp)
14878 {
14879         nl80211_send_mlme_event(rdev, netdev, buf, len,
14880                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1, NULL, 0);
14881 }
14882
14883 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
14884                            struct net_device *netdev, const u8 *buf,
14885                            size_t len, gfp_t gfp)
14886 {
14887         nl80211_send_mlme_event(rdev, netdev, buf, len,
14888                                 NL80211_CMD_DISASSOCIATE, gfp, -1, NULL, 0);
14889 }
14890
14891 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
14892                                   size_t len)
14893 {
14894         struct wireless_dev *wdev = dev->ieee80211_ptr;
14895         struct wiphy *wiphy = wdev->wiphy;
14896         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14897         const struct ieee80211_mgmt *mgmt = (void *)buf;
14898         u32 cmd;
14899
14900         if (WARN_ON(len < 2))
14901                 return;
14902
14903         if (ieee80211_is_deauth(mgmt->frame_control))
14904                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
14905         else
14906                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
14907
14908         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
14909         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1,
14910                                 NULL, 0);
14911 }
14912 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
14913
14914 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
14915                                       struct net_device *netdev, int cmd,
14916                                       const u8 *addr, gfp_t gfp)
14917 {
14918         struct sk_buff *msg;
14919         void *hdr;
14920
14921         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14922         if (!msg)
14923                 return;
14924
14925         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14926         if (!hdr) {
14927                 nlmsg_free(msg);
14928                 return;
14929         }
14930
14931         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14932             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14933             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
14934             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
14935                 goto nla_put_failure;
14936
14937         genlmsg_end(msg, hdr);
14938
14939         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14940                                 NL80211_MCGRP_MLME, gfp);
14941         return;
14942
14943  nla_put_failure:
14944         nlmsg_free(msg);
14945 }
14946
14947 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
14948                                struct net_device *netdev, const u8 *addr,
14949                                gfp_t gfp)
14950 {
14951         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
14952                                   addr, gfp);
14953 }
14954
14955 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
14956                                 struct net_device *netdev, const u8 *addr,
14957                                 gfp_t gfp)
14958 {
14959         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
14960                                   addr, gfp);
14961 }
14962
14963 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
14964                                  struct net_device *netdev,
14965                                  struct cfg80211_connect_resp_params *cr,
14966                                  gfp_t gfp)
14967 {
14968         struct sk_buff *msg;
14969         void *hdr;
14970
14971         msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
14972                         cr->fils.kek_len + cr->fils.pmk_len +
14973                         (cr->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
14974         if (!msg)
14975                 return;
14976
14977         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
14978         if (!hdr) {
14979                 nlmsg_free(msg);
14980                 return;
14981         }
14982
14983         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14984             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14985             (cr->bssid &&
14986              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) ||
14987             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
14988                         cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
14989                         cr->status) ||
14990             (cr->status < 0 &&
14991              (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
14992               nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
14993                           cr->timeout_reason))) ||
14994             (cr->req_ie &&
14995              nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
14996             (cr->resp_ie &&
14997              nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
14998                      cr->resp_ie)) ||
14999             (cr->fils.update_erp_next_seq_num &&
15000              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
15001                          cr->fils.erp_next_seq_num)) ||
15002             (cr->status == WLAN_STATUS_SUCCESS &&
15003              ((cr->fils.kek &&
15004                nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
15005                        cr->fils.kek)) ||
15006               (cr->fils.pmk &&
15007                nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
15008               (cr->fils.pmkid &&
15009                nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
15010                 goto nla_put_failure;
15011
15012         genlmsg_end(msg, hdr);
15013
15014         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15015                                 NL80211_MCGRP_MLME, gfp);
15016         return;
15017
15018  nla_put_failure:
15019         nlmsg_free(msg);
15020 }
15021
15022 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
15023                          struct net_device *netdev,
15024                          struct cfg80211_roam_info *info, gfp_t gfp)
15025 {
15026         struct sk_buff *msg;
15027         void *hdr;
15028         const u8 *bssid = info->bss ? info->bss->bssid : info->bssid;
15029
15030         msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
15031                         info->fils.kek_len + info->fils.pmk_len +
15032                         (info->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
15033         if (!msg)
15034                 return;
15035
15036         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
15037         if (!hdr) {
15038                 nlmsg_free(msg);
15039                 return;
15040         }
15041
15042         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15043             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15044             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
15045             (info->req_ie &&
15046              nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
15047                      info->req_ie)) ||
15048             (info->resp_ie &&
15049              nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
15050                      info->resp_ie)) ||
15051             (info->fils.update_erp_next_seq_num &&
15052              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
15053                          info->fils.erp_next_seq_num)) ||
15054             (info->fils.kek &&
15055              nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
15056                      info->fils.kek)) ||
15057             (info->fils.pmk &&
15058              nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
15059             (info->fils.pmkid &&
15060              nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
15061                 goto nla_put_failure;
15062
15063         genlmsg_end(msg, hdr);
15064
15065         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15066                                 NL80211_MCGRP_MLME, gfp);
15067         return;
15068
15069  nla_put_failure:
15070         nlmsg_free(msg);
15071 }
15072
15073 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
15074                                   struct net_device *netdev, const u8 *bssid)
15075 {
15076         struct sk_buff *msg;
15077         void *hdr;
15078
15079         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15080         if (!msg)
15081                 return;
15082
15083         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
15084         if (!hdr) {
15085                 nlmsg_free(msg);
15086                 return;
15087         }
15088
15089         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
15090                 goto nla_put_failure;
15091
15092         genlmsg_end(msg, hdr);
15093
15094         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15095                                 NL80211_MCGRP_MLME, GFP_KERNEL);
15096         return;
15097
15098  nla_put_failure:
15099         nlmsg_free(msg);
15100 }
15101
15102 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
15103                                struct net_device *netdev, u16 reason,
15104                                const u8 *ie, size_t ie_len, bool from_ap)
15105 {
15106         struct sk_buff *msg;
15107         void *hdr;
15108
15109         msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
15110         if (!msg)
15111                 return;
15112
15113         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
15114         if (!hdr) {
15115                 nlmsg_free(msg);
15116                 return;
15117         }
15118
15119         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15120             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15121             (reason &&
15122              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
15123             (from_ap &&
15124              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
15125             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
15126                 goto nla_put_failure;
15127
15128         genlmsg_end(msg, hdr);
15129
15130         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15131                                 NL80211_MCGRP_MLME, GFP_KERNEL);
15132         return;
15133
15134  nla_put_failure:
15135         nlmsg_free(msg);
15136 }
15137
15138 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
15139                              struct net_device *netdev, const u8 *bssid,
15140                              gfp_t gfp)
15141 {
15142         struct sk_buff *msg;
15143         void *hdr;
15144
15145         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15146         if (!msg)
15147                 return;
15148
15149         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
15150         if (!hdr) {
15151                 nlmsg_free(msg);
15152                 return;
15153         }
15154
15155         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15156             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15157             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
15158                 goto nla_put_failure;
15159
15160         genlmsg_end(msg, hdr);
15161
15162         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15163                                 NL80211_MCGRP_MLME, gfp);
15164         return;
15165
15166  nla_put_failure:
15167         nlmsg_free(msg);
15168 }
15169
15170 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
15171                                         const u8 *ie, u8 ie_len,
15172                                         int sig_dbm, gfp_t gfp)
15173 {
15174         struct wireless_dev *wdev = dev->ieee80211_ptr;
15175         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15176         struct sk_buff *msg;
15177         void *hdr;
15178
15179         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
15180                 return;
15181
15182         trace_cfg80211_notify_new_peer_candidate(dev, addr);
15183
15184         msg = nlmsg_new(100 + ie_len, gfp);
15185         if (!msg)
15186                 return;
15187
15188         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
15189         if (!hdr) {
15190                 nlmsg_free(msg);
15191                 return;
15192         }
15193
15194         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15195             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15196             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
15197             (ie_len && ie &&
15198              nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
15199             (sig_dbm &&
15200              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
15201                 goto nla_put_failure;
15202
15203         genlmsg_end(msg, hdr);
15204
15205         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15206                                 NL80211_MCGRP_MLME, gfp);
15207         return;
15208
15209  nla_put_failure:
15210         nlmsg_free(msg);
15211 }
15212 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
15213
15214 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
15215                                  struct net_device *netdev, const u8 *addr,
15216                                  enum nl80211_key_type key_type, int key_id,
15217                                  const u8 *tsc, gfp_t gfp)
15218 {
15219         struct sk_buff *msg;
15220         void *hdr;
15221
15222         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15223         if (!msg)
15224                 return;
15225
15226         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
15227         if (!hdr) {
15228                 nlmsg_free(msg);
15229                 return;
15230         }
15231
15232         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15233             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15234             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
15235             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
15236             (key_id != -1 &&
15237              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
15238             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
15239                 goto nla_put_failure;
15240
15241         genlmsg_end(msg, hdr);
15242
15243         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15244                                 NL80211_MCGRP_MLME, gfp);
15245         return;
15246
15247  nla_put_failure:
15248         nlmsg_free(msg);
15249 }
15250
15251 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
15252                                     struct ieee80211_channel *channel_before,
15253                                     struct ieee80211_channel *channel_after)
15254 {
15255         struct sk_buff *msg;
15256         void *hdr;
15257         struct nlattr *nl_freq;
15258
15259         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
15260         if (!msg)
15261                 return;
15262
15263         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
15264         if (!hdr) {
15265                 nlmsg_free(msg);
15266                 return;
15267         }
15268
15269         /*
15270          * Since we are applying the beacon hint to a wiphy we know its
15271          * wiphy_idx is valid
15272          */
15273         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
15274                 goto nla_put_failure;
15275
15276         /* Before */
15277         nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE);
15278         if (!nl_freq)
15279                 goto nla_put_failure;
15280
15281         if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
15282                 goto nla_put_failure;
15283         nla_nest_end(msg, nl_freq);
15284
15285         /* After */
15286         nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER);
15287         if (!nl_freq)
15288                 goto nla_put_failure;
15289
15290         if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
15291                 goto nla_put_failure;
15292         nla_nest_end(msg, nl_freq);
15293
15294         genlmsg_end(msg, hdr);
15295
15296         rcu_read_lock();
15297         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
15298                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
15299         rcu_read_unlock();
15300
15301         return;
15302
15303 nla_put_failure:
15304         nlmsg_free(msg);
15305 }
15306
15307 static void nl80211_send_remain_on_chan_event(
15308         int cmd, struct cfg80211_registered_device *rdev,
15309         struct wireless_dev *wdev, u64 cookie,
15310         struct ieee80211_channel *chan,
15311         unsigned int duration, gfp_t gfp)
15312 {
15313         struct sk_buff *msg;
15314         void *hdr;
15315
15316         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15317         if (!msg)
15318                 return;
15319
15320         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
15321         if (!hdr) {
15322                 nlmsg_free(msg);
15323                 return;
15324         }
15325
15326         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15327             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15328                                          wdev->netdev->ifindex)) ||
15329             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15330                               NL80211_ATTR_PAD) ||
15331             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
15332             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
15333                         NL80211_CHAN_NO_HT) ||
15334             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15335                               NL80211_ATTR_PAD))
15336                 goto nla_put_failure;
15337
15338         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
15339             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
15340                 goto nla_put_failure;
15341
15342         genlmsg_end(msg, hdr);
15343
15344         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15345                                 NL80211_MCGRP_MLME, gfp);
15346         return;
15347
15348  nla_put_failure:
15349         nlmsg_free(msg);
15350 }
15351
15352 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
15353                                struct ieee80211_channel *chan,
15354                                unsigned int duration, gfp_t gfp)
15355 {
15356         struct wiphy *wiphy = wdev->wiphy;
15357         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15358
15359         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
15360         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
15361                                           rdev, wdev, cookie, chan,
15362                                           duration, gfp);
15363 }
15364 EXPORT_SYMBOL(cfg80211_ready_on_channel);
15365
15366 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
15367                                         struct ieee80211_channel *chan,
15368                                         gfp_t gfp)
15369 {
15370         struct wiphy *wiphy = wdev->wiphy;
15371         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15372
15373         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
15374         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
15375                                           rdev, wdev, cookie, chan, 0, gfp);
15376 }
15377 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
15378
15379 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
15380                       struct station_info *sinfo, gfp_t gfp)
15381 {
15382         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
15383         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15384         struct sk_buff *msg;
15385
15386         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
15387
15388         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15389         if (!msg)
15390                 return;
15391
15392         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
15393                                  rdev, dev, mac_addr, sinfo) < 0) {
15394                 nlmsg_free(msg);
15395                 return;
15396         }
15397
15398         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15399                                 NL80211_MCGRP_MLME, gfp);
15400 }
15401 EXPORT_SYMBOL(cfg80211_new_sta);
15402
15403 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
15404                             struct station_info *sinfo, gfp_t gfp)
15405 {
15406         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
15407         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15408         struct sk_buff *msg;
15409         struct station_info empty_sinfo = {};
15410
15411         if (!sinfo)
15412                 sinfo = &empty_sinfo;
15413
15414         trace_cfg80211_del_sta(dev, mac_addr);
15415
15416         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15417         if (!msg) {
15418                 cfg80211_sinfo_release_content(sinfo);
15419                 return;
15420         }
15421
15422         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
15423                                  rdev, dev, mac_addr, sinfo) < 0) {
15424                 nlmsg_free(msg);
15425                 return;
15426         }
15427
15428         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15429                                 NL80211_MCGRP_MLME, gfp);
15430 }
15431 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
15432
15433 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
15434                           enum nl80211_connect_failed_reason reason,
15435                           gfp_t gfp)
15436 {
15437         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
15438         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15439         struct sk_buff *msg;
15440         void *hdr;
15441
15442         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
15443         if (!msg)
15444                 return;
15445
15446         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
15447         if (!hdr) {
15448                 nlmsg_free(msg);
15449                 return;
15450         }
15451
15452         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15453             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
15454             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
15455                 goto nla_put_failure;
15456
15457         genlmsg_end(msg, hdr);
15458
15459         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15460                                 NL80211_MCGRP_MLME, gfp);
15461         return;
15462
15463  nla_put_failure:
15464         nlmsg_free(msg);
15465 }
15466 EXPORT_SYMBOL(cfg80211_conn_failed);
15467
15468 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
15469                                        const u8 *addr, gfp_t gfp)
15470 {
15471         struct wireless_dev *wdev = dev->ieee80211_ptr;
15472         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15473         struct sk_buff *msg;
15474         void *hdr;
15475         u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
15476
15477         if (!nlportid)
15478                 return false;
15479
15480         msg = nlmsg_new(100, gfp);
15481         if (!msg)
15482                 return true;
15483
15484         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
15485         if (!hdr) {
15486                 nlmsg_free(msg);
15487                 return true;
15488         }
15489
15490         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15491             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15492             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
15493                 goto nla_put_failure;
15494
15495         genlmsg_end(msg, hdr);
15496         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15497         return true;
15498
15499  nla_put_failure:
15500         nlmsg_free(msg);
15501         return true;
15502 }
15503
15504 bool cfg80211_rx_spurious_frame(struct net_device *dev,
15505                                 const u8 *addr, gfp_t gfp)
15506 {
15507         struct wireless_dev *wdev = dev->ieee80211_ptr;
15508         bool ret;
15509
15510         trace_cfg80211_rx_spurious_frame(dev, addr);
15511
15512         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
15513                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
15514                 trace_cfg80211_return_bool(false);
15515                 return false;
15516         }
15517         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
15518                                          addr, gfp);
15519         trace_cfg80211_return_bool(ret);
15520         return ret;
15521 }
15522 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
15523
15524 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
15525                                         const u8 *addr, gfp_t gfp)
15526 {
15527         struct wireless_dev *wdev = dev->ieee80211_ptr;
15528         bool ret;
15529
15530         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
15531
15532         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
15533                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
15534                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
15535                 trace_cfg80211_return_bool(false);
15536                 return false;
15537         }
15538         ret = __nl80211_unexpected_frame(dev,
15539                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
15540                                          addr, gfp);
15541         trace_cfg80211_return_bool(ret);
15542         return ret;
15543 }
15544 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
15545
15546 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
15547                       struct wireless_dev *wdev, u32 nlportid,
15548                       int freq, int sig_dbm,
15549                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
15550 {
15551         struct net_device *netdev = wdev->netdev;
15552         struct sk_buff *msg;
15553         void *hdr;
15554
15555         msg = nlmsg_new(100 + len, gfp);
15556         if (!msg)
15557                 return -ENOMEM;
15558
15559         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
15560         if (!hdr) {
15561                 nlmsg_free(msg);
15562                 return -ENOMEM;
15563         }
15564
15565         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15566             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15567                                         netdev->ifindex)) ||
15568             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15569                               NL80211_ATTR_PAD) ||
15570             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
15571             (sig_dbm &&
15572              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
15573             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
15574             (flags &&
15575              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
15576                 goto nla_put_failure;
15577
15578         genlmsg_end(msg, hdr);
15579
15580         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15581
15582  nla_put_failure:
15583         nlmsg_free(msg);
15584         return -ENOBUFS;
15585 }
15586
15587 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
15588                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
15589 {
15590         struct wiphy *wiphy = wdev->wiphy;
15591         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15592         struct net_device *netdev = wdev->netdev;
15593         struct sk_buff *msg;
15594         void *hdr;
15595
15596         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
15597
15598         msg = nlmsg_new(100 + len, gfp);
15599         if (!msg)
15600                 return;
15601
15602         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
15603         if (!hdr) {
15604                 nlmsg_free(msg);
15605                 return;
15606         }
15607
15608         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15609             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15610                                    netdev->ifindex)) ||
15611             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15612                               NL80211_ATTR_PAD) ||
15613             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
15614             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15615                               NL80211_ATTR_PAD) ||
15616             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
15617                 goto nla_put_failure;
15618
15619         genlmsg_end(msg, hdr);
15620
15621         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15622                                 NL80211_MCGRP_MLME, gfp);
15623         return;
15624
15625  nla_put_failure:
15626         nlmsg_free(msg);
15627 }
15628 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
15629
15630 static int __nl80211_rx_control_port(struct net_device *dev,
15631                                      struct sk_buff *skb,
15632                                      bool unencrypted, gfp_t gfp)
15633 {
15634         struct wireless_dev *wdev = dev->ieee80211_ptr;
15635         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15636         struct ethhdr *ehdr = eth_hdr(skb);
15637         const u8 *addr = ehdr->h_source;
15638         u16 proto = be16_to_cpu(skb->protocol);
15639         struct sk_buff *msg;
15640         void *hdr;
15641         struct nlattr *frame;
15642
15643         u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
15644
15645         if (!nlportid)
15646                 return -ENOENT;
15647
15648         msg = nlmsg_new(100 + skb->len, gfp);
15649         if (!msg)
15650                 return -ENOMEM;
15651
15652         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
15653         if (!hdr) {
15654                 nlmsg_free(msg);
15655                 return -ENOBUFS;
15656         }
15657
15658         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15659             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15660             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15661                               NL80211_ATTR_PAD) ||
15662             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
15663             nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
15664             (unencrypted && nla_put_flag(msg,
15665                                          NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
15666                 goto nla_put_failure;
15667
15668         frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
15669         if (!frame)
15670                 goto nla_put_failure;
15671
15672         skb_copy_bits(skb, 0, nla_data(frame), skb->len);
15673         genlmsg_end(msg, hdr);
15674
15675         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15676
15677  nla_put_failure:
15678         nlmsg_free(msg);
15679         return -ENOBUFS;
15680 }
15681
15682 bool cfg80211_rx_control_port(struct net_device *dev,
15683                               struct sk_buff *skb, bool unencrypted)
15684 {
15685         int ret;
15686
15687         trace_cfg80211_rx_control_port(dev, skb, unencrypted);
15688         ret = __nl80211_rx_control_port(dev, skb, unencrypted, GFP_ATOMIC);
15689         trace_cfg80211_return_bool(ret == 0);
15690         return ret == 0;
15691 }
15692 EXPORT_SYMBOL(cfg80211_rx_control_port);
15693
15694 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
15695                                             const char *mac, gfp_t gfp)
15696 {
15697         struct wireless_dev *wdev = dev->ieee80211_ptr;
15698         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15699         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15700         void **cb;
15701
15702         if (!msg)
15703                 return NULL;
15704
15705         cb = (void **)msg->cb;
15706
15707         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
15708         if (!cb[0]) {
15709                 nlmsg_free(msg);
15710                 return NULL;
15711         }
15712
15713         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15714             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15715                 goto nla_put_failure;
15716
15717         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
15718                 goto nla_put_failure;
15719
15720         cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM);
15721         if (!cb[1])
15722                 goto nla_put_failure;
15723
15724         cb[2] = rdev;
15725
15726         return msg;
15727  nla_put_failure:
15728         nlmsg_free(msg);
15729         return NULL;
15730 }
15731
15732 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
15733 {
15734         void **cb = (void **)msg->cb;
15735         struct cfg80211_registered_device *rdev = cb[2];
15736
15737         nla_nest_end(msg, cb[1]);
15738         genlmsg_end(msg, cb[0]);
15739
15740         memset(msg->cb, 0, sizeof(msg->cb));
15741
15742         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15743                                 NL80211_MCGRP_MLME, gfp);
15744 }
15745
15746 void cfg80211_cqm_rssi_notify(struct net_device *dev,
15747                               enum nl80211_cqm_rssi_threshold_event rssi_event,
15748                               s32 rssi_level, gfp_t gfp)
15749 {
15750         struct sk_buff *msg;
15751         struct wireless_dev *wdev = dev->ieee80211_ptr;
15752         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15753
15754         trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
15755
15756         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
15757                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
15758                 return;
15759
15760         if (wdev->cqm_config) {
15761                 wdev->cqm_config->last_rssi_event_value = rssi_level;
15762
15763                 cfg80211_cqm_rssi_update(rdev, dev);
15764
15765                 if (rssi_level == 0)
15766                         rssi_level = wdev->cqm_config->last_rssi_event_value;
15767         }
15768
15769         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
15770         if (!msg)
15771                 return;
15772
15773         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
15774                         rssi_event))
15775                 goto nla_put_failure;
15776
15777         if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
15778                                       rssi_level))
15779                 goto nla_put_failure;
15780
15781         cfg80211_send_cqm(msg, gfp);
15782
15783         return;
15784
15785  nla_put_failure:
15786         nlmsg_free(msg);
15787 }
15788 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
15789
15790 void cfg80211_cqm_txe_notify(struct net_device *dev,
15791                              const u8 *peer, u32 num_packets,
15792                              u32 rate, u32 intvl, gfp_t gfp)
15793 {
15794         struct sk_buff *msg;
15795
15796         msg = cfg80211_prepare_cqm(dev, peer, gfp);
15797         if (!msg)
15798                 return;
15799
15800         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
15801                 goto nla_put_failure;
15802
15803         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
15804                 goto nla_put_failure;
15805
15806         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
15807                 goto nla_put_failure;
15808
15809         cfg80211_send_cqm(msg, gfp);
15810         return;
15811
15812  nla_put_failure:
15813         nlmsg_free(msg);
15814 }
15815 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
15816
15817 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
15818                                  const u8 *peer, u32 num_packets, gfp_t gfp)
15819 {
15820         struct sk_buff *msg;
15821
15822         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
15823
15824         msg = cfg80211_prepare_cqm(dev, peer, gfp);
15825         if (!msg)
15826                 return;
15827
15828         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
15829                 goto nla_put_failure;
15830
15831         cfg80211_send_cqm(msg, gfp);
15832         return;
15833
15834  nla_put_failure:
15835         nlmsg_free(msg);
15836 }
15837 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
15838
15839 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
15840 {
15841         struct sk_buff *msg;
15842
15843         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
15844         if (!msg)
15845                 return;
15846
15847         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
15848                 goto nla_put_failure;
15849
15850         cfg80211_send_cqm(msg, gfp);
15851         return;
15852
15853  nla_put_failure:
15854         nlmsg_free(msg);
15855 }
15856 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
15857
15858 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
15859                                      struct net_device *netdev, const u8 *bssid,
15860                                      const u8 *replay_ctr, gfp_t gfp)
15861 {
15862         struct sk_buff *msg;
15863         struct nlattr *rekey_attr;
15864         void *hdr;
15865
15866         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15867         if (!msg)
15868                 return;
15869
15870         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
15871         if (!hdr) {
15872                 nlmsg_free(msg);
15873                 return;
15874         }
15875
15876         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15877             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15878             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
15879                 goto nla_put_failure;
15880
15881         rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA);
15882         if (!rekey_attr)
15883                 goto nla_put_failure;
15884
15885         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
15886                     NL80211_REPLAY_CTR_LEN, replay_ctr))
15887                 goto nla_put_failure;
15888
15889         nla_nest_end(msg, rekey_attr);
15890
15891         genlmsg_end(msg, hdr);
15892
15893         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15894                                 NL80211_MCGRP_MLME, gfp);
15895         return;
15896
15897  nla_put_failure:
15898         nlmsg_free(msg);
15899 }
15900
15901 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
15902                                const u8 *replay_ctr, gfp_t gfp)
15903 {
15904         struct wireless_dev *wdev = dev->ieee80211_ptr;
15905         struct wiphy *wiphy = wdev->wiphy;
15906         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15907
15908         trace_cfg80211_gtk_rekey_notify(dev, bssid);
15909         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
15910 }
15911 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
15912
15913 static void
15914 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
15915                                struct net_device *netdev, int index,
15916                                const u8 *bssid, bool preauth, gfp_t gfp)
15917 {
15918         struct sk_buff *msg;
15919         struct nlattr *attr;
15920         void *hdr;
15921
15922         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15923         if (!msg)
15924                 return;
15925
15926         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
15927         if (!hdr) {
15928                 nlmsg_free(msg);
15929                 return;
15930         }
15931
15932         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15933             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
15934                 goto nla_put_failure;
15935
15936         attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE);
15937         if (!attr)
15938                 goto nla_put_failure;
15939
15940         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
15941             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
15942             (preauth &&
15943              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
15944                 goto nla_put_failure;
15945
15946         nla_nest_end(msg, attr);
15947
15948         genlmsg_end(msg, hdr);
15949
15950         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15951                                 NL80211_MCGRP_MLME, gfp);
15952         return;
15953
15954  nla_put_failure:
15955         nlmsg_free(msg);
15956 }
15957
15958 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
15959                                      const u8 *bssid, bool preauth, gfp_t gfp)
15960 {
15961         struct wireless_dev *wdev = dev->ieee80211_ptr;
15962         struct wiphy *wiphy = wdev->wiphy;
15963         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15964
15965         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
15966         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
15967 }
15968 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
15969
15970 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
15971                                      struct net_device *netdev,
15972                                      struct cfg80211_chan_def *chandef,
15973                                      gfp_t gfp,
15974                                      enum nl80211_commands notif,
15975                                      u8 count)
15976 {
15977         struct sk_buff *msg;
15978         void *hdr;
15979
15980         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15981         if (!msg)
15982                 return;
15983
15984         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
15985         if (!hdr) {
15986                 nlmsg_free(msg);
15987                 return;
15988         }
15989
15990         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
15991                 goto nla_put_failure;
15992
15993         if (nl80211_send_chandef(msg, chandef))
15994                 goto nla_put_failure;
15995
15996         if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
15997             (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
15998                         goto nla_put_failure;
15999
16000         genlmsg_end(msg, hdr);
16001
16002         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16003                                 NL80211_MCGRP_MLME, gfp);
16004         return;
16005
16006  nla_put_failure:
16007         nlmsg_free(msg);
16008 }
16009
16010 void cfg80211_ch_switch_notify(struct net_device *dev,
16011                                struct cfg80211_chan_def *chandef)
16012 {
16013         struct wireless_dev *wdev = dev->ieee80211_ptr;
16014         struct wiphy *wiphy = wdev->wiphy;
16015         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16016
16017         ASSERT_WDEV_LOCK(wdev);
16018
16019         trace_cfg80211_ch_switch_notify(dev, chandef);
16020
16021         wdev->chandef = *chandef;
16022         wdev->preset_chandef = *chandef;
16023
16024         if (wdev->iftype == NL80211_IFTYPE_STATION &&
16025             !WARN_ON(!wdev->current_bss))
16026                 wdev->current_bss->pub.channel = chandef->chan;
16027
16028         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
16029                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0);
16030 }
16031 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
16032
16033 void cfg80211_ch_switch_started_notify(struct net_device *dev,
16034                                        struct cfg80211_chan_def *chandef,
16035                                        u8 count)
16036 {
16037         struct wireless_dev *wdev = dev->ieee80211_ptr;
16038         struct wiphy *wiphy = wdev->wiphy;
16039         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16040
16041         trace_cfg80211_ch_switch_started_notify(dev, chandef);
16042
16043         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
16044                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
16045 }
16046 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
16047
16048 void
16049 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
16050                      const struct cfg80211_chan_def *chandef,
16051                      enum nl80211_radar_event event,
16052                      struct net_device *netdev, gfp_t gfp)
16053 {
16054         struct sk_buff *msg;
16055         void *hdr;
16056
16057         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16058         if (!msg)
16059                 return;
16060
16061         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
16062         if (!hdr) {
16063                 nlmsg_free(msg);
16064                 return;
16065         }
16066
16067         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
16068                 goto nla_put_failure;
16069
16070         /* NOP and radar events don't need a netdev parameter */
16071         if (netdev) {
16072                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
16073
16074                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16075                     nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16076                                       NL80211_ATTR_PAD))
16077                         goto nla_put_failure;
16078         }
16079
16080         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
16081                 goto nla_put_failure;
16082
16083         if (nl80211_send_chandef(msg, chandef))
16084                 goto nla_put_failure;
16085
16086         genlmsg_end(msg, hdr);
16087
16088         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16089                                 NL80211_MCGRP_MLME, gfp);
16090         return;
16091
16092  nla_put_failure:
16093         nlmsg_free(msg);
16094 }
16095
16096 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
16097                                        struct sta_opmode_info *sta_opmode,
16098                                        gfp_t gfp)
16099 {
16100         struct sk_buff *msg;
16101         struct wireless_dev *wdev = dev->ieee80211_ptr;
16102         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16103         void *hdr;
16104
16105         if (WARN_ON(!mac))
16106                 return;
16107
16108         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16109         if (!msg)
16110                 return;
16111
16112         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
16113         if (!hdr) {
16114                 nlmsg_free(msg);
16115                 return;
16116         }
16117
16118         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
16119                 goto nla_put_failure;
16120
16121         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
16122                 goto nla_put_failure;
16123
16124         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
16125                 goto nla_put_failure;
16126
16127         if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
16128             nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
16129                 goto nla_put_failure;
16130
16131         if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
16132             nla_put_u8(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
16133                 goto nla_put_failure;
16134
16135         if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
16136             nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
16137                 goto nla_put_failure;
16138
16139         genlmsg_end(msg, hdr);
16140
16141         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16142                                 NL80211_MCGRP_MLME, gfp);
16143
16144         return;
16145
16146 nla_put_failure:
16147         nlmsg_free(msg);
16148 }
16149 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
16150
16151 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
16152                            u64 cookie, bool acked, s32 ack_signal,
16153                            bool is_valid_ack_signal, gfp_t gfp)
16154 {
16155         struct wireless_dev *wdev = dev->ieee80211_ptr;
16156         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16157         struct sk_buff *msg;
16158         void *hdr;
16159
16160         trace_cfg80211_probe_status(dev, addr, cookie, acked);
16161
16162         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16163
16164         if (!msg)
16165                 return;
16166
16167         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
16168         if (!hdr) {
16169                 nlmsg_free(msg);
16170                 return;
16171         }
16172
16173         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16174             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16175             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
16176             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
16177                               NL80211_ATTR_PAD) ||
16178             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
16179             (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
16180                                                 ack_signal)))
16181                 goto nla_put_failure;
16182
16183         genlmsg_end(msg, hdr);
16184
16185         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16186                                 NL80211_MCGRP_MLME, gfp);
16187         return;
16188
16189  nla_put_failure:
16190         nlmsg_free(msg);
16191 }
16192 EXPORT_SYMBOL(cfg80211_probe_status);
16193
16194 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
16195                                  const u8 *frame, size_t len,
16196                                  int freq, int sig_dbm)
16197 {
16198         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16199         struct sk_buff *msg;
16200         void *hdr;
16201         struct cfg80211_beacon_registration *reg;
16202
16203         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
16204
16205         spin_lock_bh(&rdev->beacon_registrations_lock);
16206         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
16207                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
16208                 if (!msg) {
16209                         spin_unlock_bh(&rdev->beacon_registrations_lock);
16210                         return;
16211                 }
16212
16213                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
16214                 if (!hdr)
16215                         goto nla_put_failure;
16216
16217                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16218                     (freq &&
16219                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
16220                     (sig_dbm &&
16221                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
16222                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
16223                         goto nla_put_failure;
16224
16225                 genlmsg_end(msg, hdr);
16226
16227                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
16228         }
16229         spin_unlock_bh(&rdev->beacon_registrations_lock);
16230         return;
16231
16232  nla_put_failure:
16233         spin_unlock_bh(&rdev->beacon_registrations_lock);
16234         nlmsg_free(msg);
16235 }
16236 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
16237
16238 #ifdef CONFIG_PM
16239 static int cfg80211_net_detect_results(struct sk_buff *msg,
16240                                        struct cfg80211_wowlan_wakeup *wakeup)
16241 {
16242         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
16243         struct nlattr *nl_results, *nl_match, *nl_freqs;
16244         int i, j;
16245
16246         nl_results = nla_nest_start_noflag(msg,
16247                                            NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
16248         if (!nl_results)
16249                 return -EMSGSIZE;
16250
16251         for (i = 0; i < nd->n_matches; i++) {
16252                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
16253
16254                 nl_match = nla_nest_start_noflag(msg, i);
16255                 if (!nl_match)
16256                         break;
16257
16258                 /* The SSID attribute is optional in nl80211, but for
16259                  * simplicity reasons it's always present in the
16260                  * cfg80211 structure.  If a driver can't pass the
16261                  * SSID, that needs to be changed.  A zero length SSID
16262                  * is still a valid SSID (wildcard), so it cannot be
16263                  * used for this purpose.
16264                  */
16265                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
16266                             match->ssid.ssid)) {
16267                         nla_nest_cancel(msg, nl_match);
16268                         goto out;
16269                 }
16270
16271                 if (match->n_channels) {
16272                         nl_freqs = nla_nest_start_noflag(msg,
16273                                                          NL80211_ATTR_SCAN_FREQUENCIES);
16274                         if (!nl_freqs) {
16275                                 nla_nest_cancel(msg, nl_match);
16276                                 goto out;
16277                         }
16278
16279                         for (j = 0; j < match->n_channels; j++) {
16280                                 if (nla_put_u32(msg, j, match->channels[j])) {
16281                                         nla_nest_cancel(msg, nl_freqs);
16282                                         nla_nest_cancel(msg, nl_match);
16283                                         goto out;
16284                                 }
16285                         }
16286
16287                         nla_nest_end(msg, nl_freqs);
16288                 }
16289
16290                 nla_nest_end(msg, nl_match);
16291         }
16292
16293 out:
16294         nla_nest_end(msg, nl_results);
16295         return 0;
16296 }
16297
16298 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
16299                                    struct cfg80211_wowlan_wakeup *wakeup,
16300                                    gfp_t gfp)
16301 {
16302         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16303         struct sk_buff *msg;
16304         void *hdr;
16305         int size = 200;
16306
16307         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
16308
16309         if (wakeup)
16310                 size += wakeup->packet_present_len;
16311
16312         msg = nlmsg_new(size, gfp);
16313         if (!msg)
16314                 return;
16315
16316         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
16317         if (!hdr)
16318                 goto free_msg;
16319
16320         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16321             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16322                               NL80211_ATTR_PAD))
16323                 goto free_msg;
16324
16325         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16326                                         wdev->netdev->ifindex))
16327                 goto free_msg;
16328
16329         if (wakeup) {
16330                 struct nlattr *reasons;
16331
16332                 reasons = nla_nest_start_noflag(msg,
16333                                                 NL80211_ATTR_WOWLAN_TRIGGERS);
16334                 if (!reasons)
16335                         goto free_msg;
16336
16337                 if (wakeup->disconnect &&
16338                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
16339                         goto free_msg;
16340                 if (wakeup->magic_pkt &&
16341                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
16342                         goto free_msg;
16343                 if (wakeup->gtk_rekey_failure &&
16344                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
16345                         goto free_msg;
16346                 if (wakeup->eap_identity_req &&
16347                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
16348                         goto free_msg;
16349                 if (wakeup->four_way_handshake &&
16350                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
16351                         goto free_msg;
16352                 if (wakeup->rfkill_release &&
16353                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
16354                         goto free_msg;
16355
16356                 if (wakeup->pattern_idx >= 0 &&
16357                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
16358                                 wakeup->pattern_idx))
16359                         goto free_msg;
16360
16361                 if (wakeup->tcp_match &&
16362                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
16363                         goto free_msg;
16364
16365                 if (wakeup->tcp_connlost &&
16366                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
16367                         goto free_msg;
16368
16369                 if (wakeup->tcp_nomoretokens &&
16370                     nla_put_flag(msg,
16371                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
16372                         goto free_msg;
16373
16374                 if (wakeup->packet) {
16375                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
16376                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
16377
16378                         if (!wakeup->packet_80211) {
16379                                 pkt_attr =
16380                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
16381                                 len_attr =
16382                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
16383                         }
16384
16385                         if (wakeup->packet_len &&
16386                             nla_put_u32(msg, len_attr, wakeup->packet_len))
16387                                 goto free_msg;
16388
16389                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
16390                                     wakeup->packet))
16391                                 goto free_msg;
16392                 }
16393
16394                 if (wakeup->net_detect &&
16395                     cfg80211_net_detect_results(msg, wakeup))
16396                                 goto free_msg;
16397
16398                 nla_nest_end(msg, reasons);
16399         }
16400
16401         genlmsg_end(msg, hdr);
16402
16403         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16404                                 NL80211_MCGRP_MLME, gfp);
16405         return;
16406
16407  free_msg:
16408         nlmsg_free(msg);
16409 }
16410 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
16411 #endif
16412
16413 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
16414                                 enum nl80211_tdls_operation oper,
16415                                 u16 reason_code, gfp_t gfp)
16416 {
16417         struct wireless_dev *wdev = dev->ieee80211_ptr;
16418         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16419         struct sk_buff *msg;
16420         void *hdr;
16421
16422         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
16423                                          reason_code);
16424
16425         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16426         if (!msg)
16427                 return;
16428
16429         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
16430         if (!hdr) {
16431                 nlmsg_free(msg);
16432                 return;
16433         }
16434
16435         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16436             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16437             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
16438             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
16439             (reason_code > 0 &&
16440              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
16441                 goto nla_put_failure;
16442
16443         genlmsg_end(msg, hdr);
16444
16445         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16446                                 NL80211_MCGRP_MLME, gfp);
16447         return;
16448
16449  nla_put_failure:
16450         nlmsg_free(msg);
16451 }
16452 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
16453
16454 static int nl80211_netlink_notify(struct notifier_block * nb,
16455                                   unsigned long state,
16456                                   void *_notify)
16457 {
16458         struct netlink_notify *notify = _notify;
16459         struct cfg80211_registered_device *rdev;
16460         struct wireless_dev *wdev;
16461         struct cfg80211_beacon_registration *reg, *tmp;
16462
16463         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
16464                 return NOTIFY_DONE;
16465
16466         rcu_read_lock();
16467
16468         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
16469                 struct cfg80211_sched_scan_request *sched_scan_req;
16470
16471                 list_for_each_entry_rcu(sched_scan_req,
16472                                         &rdev->sched_scan_req_list,
16473                                         list) {
16474                         if (sched_scan_req->owner_nlportid == notify->portid) {
16475                                 sched_scan_req->nl_owner_dead = true;
16476                                 schedule_work(&rdev->sched_scan_stop_wk);
16477                         }
16478                 }
16479
16480                 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
16481                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
16482
16483                         if (wdev->owner_nlportid == notify->portid) {
16484                                 wdev->nl_owner_dead = true;
16485                                 schedule_work(&rdev->destroy_work);
16486                         } else if (wdev->conn_owner_nlportid == notify->portid) {
16487                                 schedule_work(&wdev->disconnect_wk);
16488                         }
16489
16490                         cfg80211_release_pmsr(wdev, notify->portid);
16491                 }
16492
16493                 spin_lock_bh(&rdev->beacon_registrations_lock);
16494                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
16495                                          list) {
16496                         if (reg->nlportid == notify->portid) {
16497                                 list_del(&reg->list);
16498                                 kfree(reg);
16499                                 break;
16500                         }
16501                 }
16502                 spin_unlock_bh(&rdev->beacon_registrations_lock);
16503         }
16504
16505         rcu_read_unlock();
16506
16507         /*
16508          * It is possible that the user space process that is controlling the
16509          * indoor setting disappeared, so notify the regulatory core.
16510          */
16511         regulatory_netlink_notify(notify->portid);
16512         return NOTIFY_OK;
16513 }
16514
16515 static struct notifier_block nl80211_netlink_notifier = {
16516         .notifier_call = nl80211_netlink_notify,
16517 };
16518
16519 void cfg80211_ft_event(struct net_device *netdev,
16520                        struct cfg80211_ft_event_params *ft_event)
16521 {
16522         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
16523         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16524         struct sk_buff *msg;
16525         void *hdr;
16526
16527         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
16528
16529         if (!ft_event->target_ap)
16530                 return;
16531
16532         msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
16533                         GFP_KERNEL);
16534         if (!msg)
16535                 return;
16536
16537         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
16538         if (!hdr)
16539                 goto out;
16540
16541         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16542             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16543             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
16544                 goto out;
16545
16546         if (ft_event->ies &&
16547             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
16548                 goto out;
16549         if (ft_event->ric_ies &&
16550             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
16551                     ft_event->ric_ies))
16552                 goto out;
16553
16554         genlmsg_end(msg, hdr);
16555
16556         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16557                                 NL80211_MCGRP_MLME, GFP_KERNEL);
16558         return;
16559  out:
16560         nlmsg_free(msg);
16561 }
16562 EXPORT_SYMBOL(cfg80211_ft_event);
16563
16564 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
16565 {
16566         struct cfg80211_registered_device *rdev;
16567         struct sk_buff *msg;
16568         void *hdr;
16569         u32 nlportid;
16570
16571         rdev = wiphy_to_rdev(wdev->wiphy);
16572         if (!rdev->crit_proto_nlportid)
16573                 return;
16574
16575         nlportid = rdev->crit_proto_nlportid;
16576         rdev->crit_proto_nlportid = 0;
16577
16578         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16579         if (!msg)
16580                 return;
16581
16582         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
16583         if (!hdr)
16584                 goto nla_put_failure;
16585
16586         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16587             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16588                               NL80211_ATTR_PAD))
16589                 goto nla_put_failure;
16590
16591         genlmsg_end(msg, hdr);
16592
16593         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
16594         return;
16595
16596  nla_put_failure:
16597         nlmsg_free(msg);
16598 }
16599 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
16600
16601 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
16602 {
16603         struct wiphy *wiphy = wdev->wiphy;
16604         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16605         struct sk_buff *msg;
16606         void *hdr;
16607
16608         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16609         if (!msg)
16610                 return;
16611
16612         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
16613         if (!hdr)
16614                 goto out;
16615
16616         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16617             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
16618             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16619                               NL80211_ATTR_PAD))
16620                 goto out;
16621
16622         genlmsg_end(msg, hdr);
16623
16624         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
16625                                 NL80211_MCGRP_MLME, GFP_KERNEL);
16626         return;
16627  out:
16628         nlmsg_free(msg);
16629 }
16630
16631 int cfg80211_external_auth_request(struct net_device *dev,
16632                                    struct cfg80211_external_auth_params *params,
16633                                    gfp_t gfp)
16634 {
16635         struct wireless_dev *wdev = dev->ieee80211_ptr;
16636         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16637         struct sk_buff *msg;
16638         void *hdr;
16639
16640         if (!wdev->conn_owner_nlportid)
16641                 return -EINVAL;
16642
16643         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16644         if (!msg)
16645                 return -ENOMEM;
16646
16647         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
16648         if (!hdr)
16649                 goto nla_put_failure;
16650
16651         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16652             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16653             nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) ||
16654             nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
16655                         params->action) ||
16656             nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
16657             nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
16658                     params->ssid.ssid))
16659                 goto nla_put_failure;
16660
16661         genlmsg_end(msg, hdr);
16662         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
16663                         wdev->conn_owner_nlportid);
16664         return 0;
16665
16666  nla_put_failure:
16667         nlmsg_free(msg);
16668         return -ENOBUFS;
16669 }
16670 EXPORT_SYMBOL(cfg80211_external_auth_request);
16671
16672 void cfg80211_update_owe_info_event(struct net_device *netdev,
16673                                     struct cfg80211_update_owe_info *owe_info,
16674                                     gfp_t gfp)
16675 {
16676         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
16677         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16678         struct sk_buff *msg;
16679         void *hdr;
16680
16681         trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info);
16682
16683         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16684         if (!msg)
16685                 return;
16686
16687         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO);
16688         if (!hdr)
16689                 goto nla_put_failure;
16690
16691         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16692             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16693             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer))
16694                 goto nla_put_failure;
16695
16696         if (!owe_info->ie_len ||
16697             nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie))
16698                 goto nla_put_failure;
16699
16700         genlmsg_end(msg, hdr);
16701
16702         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16703                                 NL80211_MCGRP_MLME, gfp);
16704         return;
16705
16706 nla_put_failure:
16707         genlmsg_cancel(msg, hdr);
16708         nlmsg_free(msg);
16709 }
16710 EXPORT_SYMBOL(cfg80211_update_owe_info_event);
16711
16712 /* initialisation/exit functions */
16713
16714 int __init nl80211_init(void)
16715 {
16716         int err;
16717
16718         err = genl_register_family(&nl80211_fam);
16719         if (err)
16720                 return err;
16721
16722         err = netlink_register_notifier(&nl80211_netlink_notifier);
16723         if (err)
16724                 goto err_out;
16725
16726         return 0;
16727  err_out:
16728         genl_unregister_family(&nl80211_fam);
16729         return err;
16730 }
16731
16732 void nl80211_exit(void)
16733 {
16734         netlink_unregister_notifier(&nl80211_netlink_notifier);
16735         genl_unregister_family(&nl80211_fam);
16736 }