net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright 2013-2014  Intel Mobile Communications GmbH
   6  * Copyright 2015-2017  Intel Deutschland GmbH
   7  * Copyright (C) 2018 Intel Corporation
   8  */
   9
  10 #include <linux/if.h>
  11 #include <linux/module.h>
  12 #include <linux/err.h>
  13 #include <linux/slab.h>
  14 #include <linux/list.h>
  15 #include <linux/if_ether.h>
  16 #include <linux/ieee80211.h>
  17 #include <linux/nl80211.h>
  18 #include <linux/rtnetlink.h>
  19 #include <linux/netlink.h>
  20 #include <linux/nospec.h>
  21 #include <linux/etherdevice.h>
  22 #include <net/net_namespace.h>
  23 #include <net/genetlink.h>
  24 #include <net/cfg80211.h>
  25 #include <net/sock.h>
  26 #include <net/inet_connection_sock.h>
  27 #include "core.h"
  28 #include "nl80211.h"
  29 #include "reg.h"
  30 #include "rdev-ops.h"
  31
  32 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  33                                    struct genl_info *info,
  34                                    struct cfg80211_crypto_settings *settings,
  35                                    int cipher_limit);
  36
  37 /* the netlink family */
  38 static struct genl_family nl80211_fam;
  39
  40 /* multicast groups */
  41 enum nl80211_multicast_groups {
  42         NL80211_MCGRP_CONFIG,
  43         NL80211_MCGRP_SCAN,
  44         NL80211_MCGRP_REGULATORY,
  45         NL80211_MCGRP_MLME,
  46         NL80211_MCGRP_VENDOR,
  47         NL80211_MCGRP_NAN,
  48         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  49 };
  50
  51 static const struct genl_multicast_group nl80211_mcgrps[] = {
  52         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  53         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  54         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  55         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  56         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  57         [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
  58 #ifdef CONFIG_NL80211_TESTMODE
  59         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  60 #endif
  61 };
  62
  63 /* returns ERR_PTR values */
  64 static struct wireless_dev *
  65 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  66 {
  67         struct cfg80211_registered_device *rdev;
  68         struct wireless_dev *result = NULL;
  69         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  70         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  71         u64 wdev_id;
  72         int wiphy_idx = -1;
  73         int ifidx = -1;
  74
  75         ASSERT_RTNL();
  76
  77         if (!have_ifidx && !have_wdev_id)
  78                 return ERR_PTR(-EINVAL);
  79
  80         if (have_ifidx)
  81                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  82         if (have_wdev_id) {
  83                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  84                 wiphy_idx = wdev_id >> 32;
  85         }
  86
  87         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  88                 struct wireless_dev *wdev;
  89
  90                 if (wiphy_net(&rdev->wiphy) != netns)
  91                         continue;
  92
  93                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  94                         continue;
  95
  96                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
  97                         if (have_ifidx && wdev->netdev &&
  98                             wdev->netdev->ifindex == ifidx) {
  99                                 result = wdev;
 100                                 break;
 101                         }
 102                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 103                                 result = wdev;
 104                                 break;
 105                         }
 106                 }
 107
 108                 if (result)
 109                         break;
 110         }
 111
 112         if (result)
 113                 return result;
 114         return ERR_PTR(-ENODEV);
 115 }
 116
 117 static struct cfg80211_registered_device *
 118 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 119 {
 120         struct cfg80211_registered_device *rdev = NULL, *tmp;
 121         struct net_device *netdev;
 122
 123         ASSERT_RTNL();
 124
 125         if (!attrs[NL80211_ATTR_WIPHY] &&
 126             !attrs[NL80211_ATTR_IFINDEX] &&
 127             !attrs[NL80211_ATTR_WDEV])
 128                 return ERR_PTR(-EINVAL);
 129
 130         if (attrs[NL80211_ATTR_WIPHY])
 131                 rdev = cfg80211_rdev_by_wiphy_idx(
 132                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 133
 134         if (attrs[NL80211_ATTR_WDEV]) {
 135                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 136                 struct wireless_dev *wdev;
 137                 bool found = false;
 138
 139                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 140                 if (tmp) {
 141                         /* make sure wdev exists */
 142                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 143                                 if (wdev->identifier != (u32)wdev_id)
 144                                         continue;
 145                                 found = true;
 146                                 break;
 147                         }
 148
 149                         if (!found)
 150                                 tmp = NULL;
 151
 152                         if (rdev && tmp != rdev)
 153                                 return ERR_PTR(-EINVAL);
 154                         rdev = tmp;
 155                 }
 156         }
 157
 158         if (attrs[NL80211_ATTR_IFINDEX]) {
 159                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 160
 161                 netdev = __dev_get_by_index(netns, ifindex);
 162                 if (netdev) {
 163                         if (netdev->ieee80211_ptr)
 164                                 tmp = wiphy_to_rdev(
 165                                         netdev->ieee80211_ptr->wiphy);
 166                         else
 167                                 tmp = NULL;
 168
 169                         /* not wireless device -- return error */
 170                         if (!tmp)
 171                                 return ERR_PTR(-EINVAL);
 172
 173                         /* mismatch -- return error */
 174                         if (rdev && tmp != rdev)
 175                                 return ERR_PTR(-EINVAL);
 176
 177                         rdev = tmp;
 178                 }
 179         }
 180
 181         if (!rdev)
 182                 return ERR_PTR(-ENODEV);
 183
 184         if (netns != wiphy_net(&rdev->wiphy))
 185                 return ERR_PTR(-ENODEV);
 186
 187         return rdev;
 188 }
 189
 190 /*
 191  * This function returns a pointer to the driver
 192  * that the genl_info item that is passed refers to.
 193  *
 194  * The result of this can be a PTR_ERR and hence must
 195  * be checked with IS_ERR() for errors.
 196  */
 197 static struct cfg80211_registered_device *
 198 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 199 {
 200         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 201 }
 202
 203 /* policy for the attributes */
 204 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 205         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 206         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 207                                       .len = 20-1 },
 208         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 209
 210         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 211         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 212         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 213         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 214         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 215
 216         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 217         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 218         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 219         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 220         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 221         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 222
 223         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 224         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 225         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 226
 227         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 228         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 229
 230         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 231         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 232                                     .len = WLAN_MAX_KEY_LEN },
 233         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 234         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 235         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 236         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 237         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 238
 239         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 240         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 241         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 242                                        .len = IEEE80211_MAX_DATA_LEN },
 243         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 244                                        .len = IEEE80211_MAX_DATA_LEN },
 245         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 246         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 247         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 248         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 249                                                .len = NL80211_MAX_SUPP_RATES },
 250         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 251         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 252         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 253         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 254                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 255         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 256
 257         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 258         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 259
 260         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 261         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 262         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 263         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 264                                            .len = NL80211_MAX_SUPP_RATES },
 265         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 266
 267         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 268         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 269
 270         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 271
 272         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 273         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 274                               .len = IEEE80211_MAX_DATA_LEN },
 275         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 276         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 277
 278         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 279                                 .len = IEEE80211_MAX_SSID_LEN },
 280         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 281         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 282         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 283         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 284         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 285         [NL80211_ATTR_STA_FLAGS2] = {
 286                 .len = sizeof(struct nl80211_sta_flag_update),
 287         },
 288         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 289         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 290         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 291         [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
 292         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 293         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 294         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 295         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 296         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 297         [NL80211_ATTR_PMKID] = { .len = WLAN_PMKID_LEN },
 298         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 299         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 300         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 301         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 302                                  .len = IEEE80211_MAX_DATA_LEN },
 303         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 304         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 305         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 306         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 307         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 308         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 309         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 310         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 311         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 312         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 313         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 314         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 315         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 316         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 317         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 318         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 319         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 320         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 321         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 322         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 323                                          .len = IEEE80211_MAX_DATA_LEN },
 324         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 325                                          .len = IEEE80211_MAX_DATA_LEN },
 326         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 327         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 328         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 329         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 330         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 331         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 332         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 333         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 334         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 335         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 336         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 337                                       .len = IEEE80211_MAX_DATA_LEN },
 338         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 339         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 340         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 341                 .len = NL80211_HT_CAPABILITY_LEN
 342         },
 343         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 344         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 345         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 346         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 347         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 348         [NL80211_ATTR_AUTH_DATA] = { .type = NLA_BINARY, },
 349         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 350         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 351         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 352         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 353         [NL80211_ATTR_LOCAL_MESH_POWER_MODE] = {. type = NLA_U32 },
 354         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 355         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 356         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 357         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 358         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 359         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 360         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 361                 .len = NL80211_VHT_CAPABILITY_LEN,
 362         },
 363         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 364         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 365                                   .len = IEEE80211_MAX_DATA_LEN },
 366         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 367         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 368         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 369         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 370         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 371         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 372         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 373         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 374         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 375         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 376         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 377         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 378         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 379         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 380                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 381         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 382         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 383         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 384         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 385         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 386         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 387         [NL80211_ATTR_TSID] = { .type = NLA_U8 },
 388         [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
 389         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 390         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 391         [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
 392         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 393         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 394         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 395         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 396         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 397         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 398         [NL80211_ATTR_STA_SUPPORT_P2P_PS] = { .type = NLA_U8 },
 399         [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 400                 .len = VHT_MUMIMO_GROUPS_DATA_LEN
 401         },
 402         [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = { .len = ETH_ALEN },
 403         [NL80211_ATTR_NAN_MASTER_PREF] = { .type = NLA_U8 },
 404         [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
 405         [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 406         [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
 407                                     .len = FILS_MAX_KEK_LEN },
 408         [NL80211_ATTR_FILS_NONCES] = { .len = 2 * FILS_NONCE_LEN },
 409         [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
 410         [NL80211_ATTR_BSSID] = { .len = ETH_ALEN },
 411         [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
 412         [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
 413                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 414         },
 415         [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
 416         [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
 417                                              .len = FILS_ERP_MAX_USERNAME_LEN },
 418         [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
 419                                           .len = FILS_ERP_MAX_REALM_LEN },
 420         [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
 421         [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
 422                                         .len = FILS_ERP_MAX_RRK_LEN },
 423         [NL80211_ATTR_FILS_CACHE_ID] = { .len = 2 },
 424         [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
 425         [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
 426         [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
 427
 428         [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
 429         [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
 430         [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
 431         [NL80211_ATTR_HE_CAPABILITY] = { .type = NLA_BINARY,
 432                                          .len = NL80211_HE_MAX_CAPABILITY_LEN },
 433 };
 434
 435 /* policy for the key attributes */
 436 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 437         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 438         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 439         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 440         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 441         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 442         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 443         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 444         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 445 };
 446
 447 /* policy for the key default flags */
 448 static const struct nla_policy
 449 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 450         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 451         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 452 };
 453
 454 #ifdef CONFIG_PM
 455 /* policy for WoWLAN attributes */
 456 static const struct nla_policy
 457 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 458         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 459         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 460         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 461         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 462         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 463         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 464         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 465         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 466         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 467         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 468 };
 469
 470 static const struct nla_policy
 471 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 472         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 473         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 474         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 475         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 476         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 477         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 478         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 479                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 480         },
 481         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 482                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 483         },
 484         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 485         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 486         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 487 };
 488 #endif /* CONFIG_PM */
 489
 490 /* policy for coalesce rule attributes */
 491 static const struct nla_policy
 492 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 493         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 494         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 495         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 496 };
 497
 498 /* policy for GTK rekey offload attributes */
 499 static const struct nla_policy
 500 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 501         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 502         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 503         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 504 };
 505
 506 static const struct nla_policy
 507 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 508         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 509                                                  .len = IEEE80211_MAX_SSID_LEN },
 510         [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = { .len = ETH_ALEN },
 511         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 512 };
 513
 514 static const struct nla_policy
 515 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 516         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 517         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 518 };
 519
 520 static const struct nla_policy
 521 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 522         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 523         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 524         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 525                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 526         },
 527 };
 528
 529 /* policy for NAN function attributes */
 530 static const struct nla_policy
 531 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 532         [NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 },
 533         [NL80211_NAN_FUNC_SERVICE_ID] = {
 534                                     .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 535         [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 536         [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 537         [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 538         [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 539         [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 540         [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = { .len = ETH_ALEN },
 541         [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 542         [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 543         [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 544                         .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 545         [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 546         [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 547         [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 548         [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 549         [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 550 };
 551
 552 /* policy for Service Response Filter attributes */
 553 static const struct nla_policy
 554 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 555         [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 556         [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 557                                  .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 558         [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 559         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 560 };
 561
 562 /* policy for packet pattern attributes */
 563 static const struct nla_policy
 564 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
 565         [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
 566         [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
 567         [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
 568 };
 569
 570 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 571                                      struct netlink_callback *cb,
 572                                      struct cfg80211_registered_device **rdev,
 573                                      struct wireless_dev **wdev)
 574 {
 575         int err;
 576
 577         if (!cb->args[0]) {
 578                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 579                                   genl_family_attrbuf(&nl80211_fam),
 580                                   nl80211_fam.maxattr, nl80211_policy, NULL);
 581                 if (err)
 582                         return err;
 583
 584                 *wdev = __cfg80211_wdev_from_attrs(
 585                                         sock_net(skb->sk),
 586                                         genl_family_attrbuf(&nl80211_fam));
 587                 if (IS_ERR(*wdev))
 588                         return PTR_ERR(*wdev);
 589                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 590                 /* 0 is the first index - add 1 to parse only once */
 591                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 592                 cb->args[1] = (*wdev)->identifier;
 593         } else {
 594                 /* subtract the 1 again here */
 595                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 596                 struct wireless_dev *tmp;
 597
 598                 if (!wiphy)
 599                         return -ENODEV;
 600                 *rdev = wiphy_to_rdev(wiphy);
 601                 *wdev = NULL;
 602
 603                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
 604                         if (tmp->identifier == cb->args[1]) {
 605                                 *wdev = tmp;
 606                                 break;
 607                         }
 608                 }
 609
 610                 if (!*wdev)
 611                         return -ENODEV;
 612         }
 613
 614         return 0;
 615 }
 616
 617 /* IE validation */
 618 static bool is_valid_ie_attr(const struct nlattr *attr)
 619 {
 620         const u8 *pos;
 621         int len;
 622
 623         if (!attr)
 624                 return true;
 625
 626         pos = nla_data(attr);
 627         len = nla_len(attr);
 628
 629         while (len) {
 630                 u8 elemlen;
 631
 632                 if (len < 2)
 633                         return false;
 634                 len -= 2;
 635
 636                 elemlen = pos[1];
 637                 if (elemlen > len)
 638                         return false;
 639
 640                 len -= elemlen;
 641                 pos += 2 + elemlen;
 642         }
 643
 644         return true;
 645 }
 646
 647 /* message building helper */
 648 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 649                                    int flags, u8 cmd)
 650 {
 651         /* since there is no private header just add the generic one */
 652         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 653 }
 654
 655 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
 656                                      const struct ieee80211_reg_rule *rule)
 657 {
 658         int j;
 659         struct nlattr *nl_wmm_rules =
 660                 nla_nest_start(msg, NL80211_FREQUENCY_ATTR_WMM);
 661
 662         if (!nl_wmm_rules)
 663                 goto nla_put_failure;
 664
 665         for (j = 0; j < IEEE80211_NUM_ACS; j++) {
 666                 struct nlattr *nl_wmm_rule = nla_nest_start(msg, j);
 667
 668                 if (!nl_wmm_rule)
 669                         goto nla_put_failure;
 670
 671                 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
 672                                 rule->wmm_rule.client[j].cw_min) ||
 673                     nla_put_u16(msg, NL80211_WMMR_CW_MAX,
 674                                 rule->wmm_rule.client[j].cw_max) ||
 675                     nla_put_u8(msg, NL80211_WMMR_AIFSN,
 676                                rule->wmm_rule.client[j].aifsn) ||
 677                     nla_put_u16(msg, NL80211_WMMR_TXOP,
 678                                 rule->wmm_rule.client[j].cot))
 679                         goto nla_put_failure;
 680
 681                 nla_nest_end(msg, nl_wmm_rule);
 682         }
 683         nla_nest_end(msg, nl_wmm_rules);
 684
 685         return 0;
 686
 687 nla_put_failure:
 688         return -ENOBUFS;
 689 }
 690
 691 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
 692                                    struct ieee80211_channel *chan,
 693                                    bool large)
 694 {
 695         /* Some channels must be completely excluded from the
 696          * list to protect old user-space tools from breaking
 697          */
 698         if (!large && chan->flags &
 699             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 700                 return 0;
 701
 702         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 703                         chan->center_freq))
 704                 goto nla_put_failure;
 705
 706         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 707             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 708                 goto nla_put_failure;
 709         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 710                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 711                         goto nla_put_failure;
 712                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 713                         goto nla_put_failure;
 714         }
 715         if (chan->flags & IEEE80211_CHAN_RADAR) {
 716                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 717                         goto nla_put_failure;
 718                 if (large) {
 719                         u32 time;
 720
 721                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 722
 723                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 724                                         chan->dfs_state))
 725                                 goto nla_put_failure;
 726                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 727                                         time))
 728                                 goto nla_put_failure;
 729                         if (nla_put_u32(msg,
 730                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 731                                         chan->dfs_cac_ms))
 732                                 goto nla_put_failure;
 733                 }
 734         }
 735
 736         if (large) {
 737                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 738                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 739                         goto nla_put_failure;
 740                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 741                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 742                         goto nla_put_failure;
 743                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 744                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 745                         goto nla_put_failure;
 746                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 747                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 748                         goto nla_put_failure;
 749                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 750                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 751                         goto nla_put_failure;
 752                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
 753                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
 754                         goto nla_put_failure;
 755                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 756                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 757                         goto nla_put_failure;
 758                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 759                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 760                         goto nla_put_failure;
 761         }
 762
 763         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 764                         DBM_TO_MBM(chan->max_power)))
 765                 goto nla_put_failure;
 766
 767         if (large) {
 768                 const struct ieee80211_reg_rule *rule =
 769                         freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
 770
 771                 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
 772                         if (nl80211_msg_put_wmm_rules(msg, rule))
 773                                 goto nla_put_failure;
 774                 }
 775         }
 776
 777         return 0;
 778
 779  nla_put_failure:
 780         return -ENOBUFS;
 781 }
 782
 783 static bool nl80211_put_txq_stats(struct sk_buff *msg,
 784                                   struct cfg80211_txq_stats *txqstats,
 785                                   int attrtype)
 786 {
 787         struct nlattr *txqattr;
 788
 789 #define PUT_TXQVAL_U32(attr, memb) do {                                   \
 790         if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) &&         \
 791             nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
 792                 return false;                                             \
 793         } while (0)
 794
 795         txqattr = nla_nest_start(msg, attrtype);
 796         if (!txqattr)
 797                 return false;
 798
 799         PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
 800         PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
 801         PUT_TXQVAL_U32(FLOWS, flows);
 802         PUT_TXQVAL_U32(DROPS, drops);
 803         PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
 804         PUT_TXQVAL_U32(OVERLIMIT, overlimit);
 805         PUT_TXQVAL_U32(OVERMEMORY, overmemory);
 806         PUT_TXQVAL_U32(COLLISIONS, collisions);
 807         PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
 808         PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
 809         PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
 810         nla_nest_end(msg, txqattr);
 811
 812 #undef PUT_TXQVAL_U32
 813         return true;
 814 }
 815
 816 /* netlink command implementations */
 817
 818 struct key_parse {
 819         struct key_params p;
 820         int idx;
 821         int type;
 822         bool def, defmgmt;
 823         bool def_uni, def_multi;
 824 };
 825
 826 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
 827                                  struct key_parse *k)
 828 {
 829         struct nlattr *tb[NL80211_KEY_MAX + 1];
 830         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 831                                    nl80211_key_policy, info->extack);
 832         if (err)
 833                 return err;
 834
 835         k->def = !!tb[NL80211_KEY_DEFAULT];
 836         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 837
 838         if (k->def) {
 839                 k->def_uni = true;
 840                 k->def_multi = true;
 841         }
 842         if (k->defmgmt)
 843                 k->def_multi = true;
 844
 845         if (tb[NL80211_KEY_IDX])
 846                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 847
 848         if (tb[NL80211_KEY_DATA]) {
 849                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 850                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 851         }
 852
 853         if (tb[NL80211_KEY_SEQ]) {
 854                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 855                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 856         }
 857
 858         if (tb[NL80211_KEY_CIPHER])
 859                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 860
 861         if (tb[NL80211_KEY_TYPE]) {
 862                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 863                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 864                         return genl_err_attr(info, -EINVAL,
 865                                              tb[NL80211_KEY_TYPE]);
 866         }
 867
 868         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 869                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 870
 871                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 872                                        tb[NL80211_KEY_DEFAULT_TYPES],
 873                                        nl80211_key_default_policy,
 874                                        info->extack);
 875                 if (err)
 876                         return err;
 877
 878                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 879                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 880         }
 881
 882         return 0;
 883 }
 884
 885 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 886 {
 887         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 888                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 889                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 890         }
 891
 892         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 893                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 894                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 895         }
 896
 897         if (info->attrs[NL80211_ATTR_KEY_IDX])
 898                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 899
 900         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 901                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 902
 903         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 904         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 905
 906         if (k->def) {
 907                 k->def_uni = true;
 908                 k->def_multi = true;
 909         }
 910         if (k->defmgmt)
 911                 k->def_multi = true;
 912
 913         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 914                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 915                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES) {
 916                         GENL_SET_ERR_MSG(info, "key type out of range");
 917                         return -EINVAL;
 918                 }
 919         }
 920
 921         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 922                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 923                 int err = nla_parse_nested(kdt,
 924                                            NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 925                                            info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 926                                            nl80211_key_default_policy,
 927                                            info->extack);
 928                 if (err)
 929                         return err;
 930
 931                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 932                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 933         }
 934
 935         return 0;
 936 }
 937
 938 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 939 {
 940         int err;
 941
 942         memset(k, 0, sizeof(*k));
 943         k->idx = -1;
 944         k->type = -1;
 945
 946         if (info->attrs[NL80211_ATTR_KEY])
 947                 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
 948         else
 949                 err = nl80211_parse_key_old(info, k);
 950
 951         if (err)
 952                 return err;
 953
 954         if (k->def && k->defmgmt) {
 955                 GENL_SET_ERR_MSG(info, "key with def && defmgmt is invalid");
 956                 return -EINVAL;
 957         }
 958
 959         if (k->defmgmt) {
 960                 if (k->def_uni || !k->def_multi) {
 961                         GENL_SET_ERR_MSG(info, "defmgmt key must be mcast");
 962                         return -EINVAL;
 963                 }
 964         }
 965
 966         if (k->idx != -1) {
 967                 if (k->defmgmt) {
 968                         if (k->idx < 4 || k->idx > 5) {
 969                                 GENL_SET_ERR_MSG(info,
 970                                                  "defmgmt key idx not 4 or 5");
 971                                 return -EINVAL;
 972                         }
 973                 } else if (k->def) {
 974                         if (k->idx < 0 || k->idx > 3) {
 975                                 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
 976                                 return -EINVAL;
 977                         }
 978                 } else {
 979                         if (k->idx < 0 || k->idx > 5) {
 980                                 GENL_SET_ERR_MSG(info, "key idx not 0-5");
 981                                 return -EINVAL;
 982                         }
 983                 }
 984         }
 985
 986         return 0;
 987 }
 988
 989 static struct cfg80211_cached_keys *
 990 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 991                        struct genl_info *info, bool *no_ht)
 992 {
 993         struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
 994         struct key_parse parse;
 995         struct nlattr *key;
 996         struct cfg80211_cached_keys *result;
 997         int rem, err, def = 0;
 998         bool have_key = false;
 999
1000         nla_for_each_nested(key, keys, rem) {
1001                 have_key = true;
1002                 break;
1003         }
1004
1005         if (!have_key)
1006                 return NULL;
1007
1008         result = kzalloc(sizeof(*result), GFP_KERNEL);
1009         if (!result)
1010                 return ERR_PTR(-ENOMEM);
1011
1012         result->def = -1;
1013
1014         nla_for_each_nested(key, keys, rem) {
1015                 memset(&parse, 0, sizeof(parse));
1016                 parse.idx = -1;
1017
1018                 err = nl80211_parse_key_new(info, key, &parse);
1019                 if (err)
1020                         goto error;
1021                 err = -EINVAL;
1022                 if (!parse.p.key)
1023                         goto error;
1024                 if (parse.idx < 0 || parse.idx > 3) {
1025                         GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1026                         goto error;
1027                 }
1028                 if (parse.def) {
1029                         if (def) {
1030                                 GENL_SET_ERR_MSG(info,
1031                                                  "only one key can be default");
1032                                 goto error;
1033                         }
1034                         def = 1;
1035                         result->def = parse.idx;
1036                         if (!parse.def_uni || !parse.def_multi)
1037                                 goto error;
1038                 } else if (parse.defmgmt)
1039                         goto error;
1040                 err = cfg80211_validate_key_settings(rdev, &parse.p,
1041                                                      parse.idx, false, NULL);
1042                 if (err)
1043                         goto error;
1044                 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1045                     parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1046                         GENL_SET_ERR_MSG(info, "connect key must be WEP");
1047                         err = -EINVAL;
1048                         goto error;
1049                 }
1050                 result->params[parse.idx].cipher = parse.p.cipher;
1051                 result->params[parse.idx].key_len = parse.p.key_len;
1052                 result->params[parse.idx].key = result->data[parse.idx];
1053                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1054
1055                 /* must be WEP key if we got here */
1056                 if (no_ht)
1057                         *no_ht = true;
1058         }
1059
1060         if (result->def < 0) {
1061                 err = -EINVAL;
1062                 GENL_SET_ERR_MSG(info, "need a default/TX key");
1063                 goto error;
1064         }
1065
1066         return result;
1067  error:
1068         kfree(result);
1069         return ERR_PTR(err);
1070 }
1071
1072 static int nl80211_key_allowed(struct wireless_dev *wdev)
1073 {
1074         ASSERT_WDEV_LOCK(wdev);
1075
1076         switch (wdev->iftype) {
1077         case NL80211_IFTYPE_AP:
1078         case NL80211_IFTYPE_AP_VLAN:
1079         case NL80211_IFTYPE_P2P_GO:
1080         case NL80211_IFTYPE_MESH_POINT:
1081                 break;
1082         case NL80211_IFTYPE_ADHOC:
1083         case NL80211_IFTYPE_STATION:
1084         case NL80211_IFTYPE_P2P_CLIENT:
1085                 if (!wdev->current_bss)
1086                         return -ENOLINK;
1087                 break;
1088         case NL80211_IFTYPE_UNSPECIFIED:
1089         case NL80211_IFTYPE_OCB:
1090         case NL80211_IFTYPE_MONITOR:
1091         case NL80211_IFTYPE_NAN:
1092         case NL80211_IFTYPE_P2P_DEVICE:
1093         case NL80211_IFTYPE_WDS:
1094         case NUM_NL80211_IFTYPES:
1095                 return -EINVAL;
1096         }
1097
1098         return 0;
1099 }
1100
1101 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1102                                                         struct nlattr *tb)
1103 {
1104         struct ieee80211_channel *chan;
1105
1106         if (tb == NULL)
1107                 return NULL;
1108         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
1109         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1110                 return NULL;
1111         return chan;
1112 }
1113
1114 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1115 {
1116         struct nlattr *nl_modes = nla_nest_start(msg, attr);
1117         int i;
1118
1119         if (!nl_modes)
1120                 goto nla_put_failure;
1121
1122         i = 0;
1123         while (ifmodes) {
1124                 if ((ifmodes & 1) && nla_put_flag(msg, i))
1125                         goto nla_put_failure;
1126                 ifmodes >>= 1;
1127                 i++;
1128         }
1129
1130         nla_nest_end(msg, nl_modes);
1131         return 0;
1132
1133 nla_put_failure:
1134         return -ENOBUFS;
1135 }
1136
1137 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1138                                           struct sk_buff *msg,
1139                                           bool large)
1140 {
1141         struct nlattr *nl_combis;
1142         int i, j;
1143
1144         nl_combis = nla_nest_start(msg,
1145                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
1146         if (!nl_combis)
1147                 goto nla_put_failure;
1148
1149         for (i = 0; i < wiphy->n_iface_combinations; i++) {
1150                 const struct ieee80211_iface_combination *c;
1151                 struct nlattr *nl_combi, *nl_limits;
1152
1153                 c = &wiphy->iface_combinations[i];
1154
1155                 nl_combi = nla_nest_start(msg, i + 1);
1156                 if (!nl_combi)
1157                         goto nla_put_failure;
1158
1159                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
1160                 if (!nl_limits)
1161                         goto nla_put_failure;
1162
1163                 for (j = 0; j < c->n_limits; j++) {
1164                         struct nlattr *nl_limit;
1165
1166                         nl_limit = nla_nest_start(msg, j + 1);
1167                         if (!nl_limit)
1168                                 goto nla_put_failure;
1169                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1170                                         c->limits[j].max))
1171                                 goto nla_put_failure;
1172                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1173                                                 c->limits[j].types))
1174                                 goto nla_put_failure;
1175                         nla_nest_end(msg, nl_limit);
1176                 }
1177
1178                 nla_nest_end(msg, nl_limits);
1179
1180                 if (c->beacon_int_infra_match &&
1181                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1182                         goto nla_put_failure;
1183                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1184                                 c->num_different_channels) ||
1185                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1186                                 c->max_interfaces))
1187                         goto nla_put_failure;
1188                 if (large &&
1189                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1190                                 c->radar_detect_widths) ||
1191                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1192                                 c->radar_detect_regions)))
1193                         goto nla_put_failure;
1194                 if (c->beacon_int_min_gcd &&
1195                     nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1196                                 c->beacon_int_min_gcd))
1197                         goto nla_put_failure;
1198
1199                 nla_nest_end(msg, nl_combi);
1200         }
1201
1202         nla_nest_end(msg, nl_combis);
1203
1204         return 0;
1205 nla_put_failure:
1206         return -ENOBUFS;
1207 }
1208
1209 #ifdef CONFIG_PM
1210 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1211                                         struct sk_buff *msg)
1212 {
1213         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1214         struct nlattr *nl_tcp;
1215
1216         if (!tcp)
1217                 return 0;
1218
1219         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1220         if (!nl_tcp)
1221                 return -ENOBUFS;
1222
1223         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1224                         tcp->data_payload_max))
1225                 return -ENOBUFS;
1226
1227         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1228                         tcp->data_payload_max))
1229                 return -ENOBUFS;
1230
1231         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1232                 return -ENOBUFS;
1233
1234         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1235                                 sizeof(*tcp->tok), tcp->tok))
1236                 return -ENOBUFS;
1237
1238         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1239                         tcp->data_interval_max))
1240                 return -ENOBUFS;
1241
1242         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1243                         tcp->wake_payload_max))
1244                 return -ENOBUFS;
1245
1246         nla_nest_end(msg, nl_tcp);
1247         return 0;
1248 }
1249
1250 static int nl80211_send_wowlan(struct sk_buff *msg,
1251                                struct cfg80211_registered_device *rdev,
1252                                bool large)
1253 {
1254         struct nlattr *nl_wowlan;
1255
1256         if (!rdev->wiphy.wowlan)
1257                 return 0;
1258
1259         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1260         if (!nl_wowlan)
1261                 return -ENOBUFS;
1262
1263         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1264              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1265             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1266              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1267             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1268              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1269             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1270              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1271             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1272              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1273             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1274              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1275             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1276              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1277             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1278              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1279                 return -ENOBUFS;
1280
1281         if (rdev->wiphy.wowlan->n_patterns) {
1282                 struct nl80211_pattern_support pat = {
1283                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1284                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1285                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1286                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1287                 };
1288
1289                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1290                             sizeof(pat), &pat))
1291                         return -ENOBUFS;
1292         }
1293
1294         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1295             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1296                         rdev->wiphy.wowlan->max_nd_match_sets))
1297                 return -ENOBUFS;
1298
1299         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1300                 return -ENOBUFS;
1301
1302         nla_nest_end(msg, nl_wowlan);
1303
1304         return 0;
1305 }
1306 #endif
1307
1308 static int nl80211_send_coalesce(struct sk_buff *msg,
1309                                  struct cfg80211_registered_device *rdev)
1310 {
1311         struct nl80211_coalesce_rule_support rule;
1312
1313         if (!rdev->wiphy.coalesce)
1314                 return 0;
1315
1316         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1317         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1318         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1319         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1320         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1321         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1322
1323         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1324                 return -ENOBUFS;
1325
1326         return 0;
1327 }
1328
1329 static int
1330 nl80211_send_iftype_data(struct sk_buff *msg,
1331                          const struct ieee80211_sband_iftype_data *iftdata)
1332 {
1333         const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1334
1335         if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1336                                 iftdata->types_mask))
1337                 return -ENOBUFS;
1338
1339         if (he_cap->has_he) {
1340                 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1341                             sizeof(he_cap->he_cap_elem.mac_cap_info),
1342                             he_cap->he_cap_elem.mac_cap_info) ||
1343                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1344                             sizeof(he_cap->he_cap_elem.phy_cap_info),
1345                             he_cap->he_cap_elem.phy_cap_info) ||
1346                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1347                             sizeof(he_cap->he_mcs_nss_supp),
1348                             &he_cap->he_mcs_nss_supp) ||
1349                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1350                             sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1351                         return -ENOBUFS;
1352         }
1353
1354         return 0;
1355 }
1356
1357 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1358                                       struct ieee80211_supported_band *sband)
1359 {
1360         struct nlattr *nl_rates, *nl_rate;
1361         struct ieee80211_rate *rate;
1362         int i;
1363
1364         /* add HT info */
1365         if (sband->ht_cap.ht_supported &&
1366             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1367                      sizeof(sband->ht_cap.mcs),
1368                      &sband->ht_cap.mcs) ||
1369              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1370                          sband->ht_cap.cap) ||
1371              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1372                         sband->ht_cap.ampdu_factor) ||
1373              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1374                         sband->ht_cap.ampdu_density)))
1375                 return -ENOBUFS;
1376
1377         /* add VHT info */
1378         if (sband->vht_cap.vht_supported &&
1379             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1380                      sizeof(sband->vht_cap.vht_mcs),
1381                      &sband->vht_cap.vht_mcs) ||
1382              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1383                          sband->vht_cap.cap)))
1384                 return -ENOBUFS;
1385
1386         if (sband->n_iftype_data) {
1387                 struct nlattr *nl_iftype_data =
1388                         nla_nest_start(msg, NL80211_BAND_ATTR_IFTYPE_DATA);
1389                 int err;
1390
1391                 if (!nl_iftype_data)
1392                         return -ENOBUFS;
1393
1394                 for (i = 0; i < sband->n_iftype_data; i++) {
1395                         struct nlattr *iftdata;
1396
1397                         iftdata = nla_nest_start(msg, i + 1);
1398                         if (!iftdata)
1399                                 return -ENOBUFS;
1400
1401                         err = nl80211_send_iftype_data(msg,
1402                                                        &sband->iftype_data[i]);
1403                         if (err)
1404                                 return err;
1405
1406                         nla_nest_end(msg, iftdata);
1407                 }
1408
1409                 nla_nest_end(msg, nl_iftype_data);
1410         }
1411
1412         /* add bitrates */
1413         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1414         if (!nl_rates)
1415                 return -ENOBUFS;
1416
1417         for (i = 0; i < sband->n_bitrates; i++) {
1418                 nl_rate = nla_nest_start(msg, i);
1419                 if (!nl_rate)
1420                         return -ENOBUFS;
1421
1422                 rate = &sband->bitrates[i];
1423                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1424                                 rate->bitrate))
1425                         return -ENOBUFS;
1426                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1427                     nla_put_flag(msg,
1428                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1429                         return -ENOBUFS;
1430
1431                 nla_nest_end(msg, nl_rate);
1432         }
1433
1434         nla_nest_end(msg, nl_rates);
1435
1436         return 0;
1437 }
1438
1439 static int
1440 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1441                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1442 {
1443         u16 stypes;
1444         struct nlattr *nl_ftypes, *nl_ifs;
1445         enum nl80211_iftype ift;
1446         int i;
1447
1448         if (!mgmt_stypes)
1449                 return 0;
1450
1451         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1452         if (!nl_ifs)
1453                 return -ENOBUFS;
1454
1455         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1456                 nl_ftypes = nla_nest_start(msg, ift);
1457                 if (!nl_ftypes)
1458                         return -ENOBUFS;
1459                 i = 0;
1460                 stypes = mgmt_stypes[ift].tx;
1461                 while (stypes) {
1462                         if ((stypes & 1) &&
1463                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1464                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1465                                 return -ENOBUFS;
1466                         stypes >>= 1;
1467                         i++;
1468                 }
1469                 nla_nest_end(msg, nl_ftypes);
1470         }
1471
1472         nla_nest_end(msg, nl_ifs);
1473
1474         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1475         if (!nl_ifs)
1476                 return -ENOBUFS;
1477
1478         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1479                 nl_ftypes = nla_nest_start(msg, ift);
1480                 if (!nl_ftypes)
1481                         return -ENOBUFS;
1482                 i = 0;
1483                 stypes = mgmt_stypes[ift].rx;
1484                 while (stypes) {
1485                         if ((stypes & 1) &&
1486                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1487                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1488                                 return -ENOBUFS;
1489                         stypes >>= 1;
1490                         i++;
1491                 }
1492                 nla_nest_end(msg, nl_ftypes);
1493         }
1494         nla_nest_end(msg, nl_ifs);
1495
1496         return 0;
1497 }
1498
1499 #define CMD(op, n)                                                      \
1500          do {                                                           \
1501                 if (rdev->ops->op) {                                    \
1502                         i++;                                            \
1503                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n))     \
1504                                 goto nla_put_failure;                   \
1505                 }                                                       \
1506         } while (0)
1507
1508 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
1509                                         struct sk_buff *msg)
1510 {
1511         int i = 0;
1512
1513         /*
1514          * do *NOT* add anything into this function, new things need to be
1515          * advertised only to new versions of userspace that can deal with
1516          * the split (and they can't possibly care about new features...
1517          */
1518         CMD(add_virtual_intf, NEW_INTERFACE);
1519         CMD(change_virtual_intf, SET_INTERFACE);
1520         CMD(add_key, NEW_KEY);
1521         CMD(start_ap, START_AP);
1522         CMD(add_station, NEW_STATION);
1523         CMD(add_mpath, NEW_MPATH);
1524         CMD(update_mesh_config, SET_MESH_CONFIG);
1525         CMD(change_bss, SET_BSS);
1526         CMD(auth, AUTHENTICATE);
1527         CMD(assoc, ASSOCIATE);
1528         CMD(deauth, DEAUTHENTICATE);
1529         CMD(disassoc, DISASSOCIATE);
1530         CMD(join_ibss, JOIN_IBSS);
1531         CMD(join_mesh, JOIN_MESH);
1532         CMD(set_pmksa, SET_PMKSA);
1533         CMD(del_pmksa, DEL_PMKSA);
1534         CMD(flush_pmksa, FLUSH_PMKSA);
1535         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1536                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1537         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1538         CMD(mgmt_tx, FRAME);
1539         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1540         if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1541                 i++;
1542                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1543                         goto nla_put_failure;
1544         }
1545         if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1546             rdev->ops->join_mesh) {
1547                 i++;
1548                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1549                         goto nla_put_failure;
1550         }
1551         CMD(set_wds_peer, SET_WDS_PEER);
1552         if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1553                 CMD(tdls_mgmt, TDLS_MGMT);
1554                 CMD(tdls_oper, TDLS_OPER);
1555         }
1556         if (rdev->wiphy.max_sched_scan_reqs)
1557                 CMD(sched_scan_start, START_SCHED_SCAN);
1558         CMD(probe_client, PROBE_CLIENT);
1559         CMD(set_noack_map, SET_NOACK_MAP);
1560         if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1561                 i++;
1562                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1563                         goto nla_put_failure;
1564         }
1565         CMD(start_p2p_device, START_P2P_DEVICE);
1566         CMD(set_mcast_rate, SET_MCAST_RATE);
1567 #ifdef CONFIG_NL80211_TESTMODE
1568         CMD(testmode_cmd, TESTMODE);
1569 #endif
1570
1571         if (rdev->ops->connect || rdev->ops->auth) {
1572                 i++;
1573                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1574                         goto nla_put_failure;
1575         }
1576
1577         if (rdev->ops->disconnect || rdev->ops->deauth) {
1578                 i++;
1579                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1580                         goto nla_put_failure;
1581         }
1582
1583         return i;
1584  nla_put_failure:
1585         return -ENOBUFS;
1586 }
1587
1588 struct nl80211_dump_wiphy_state {
1589         s64 filter_wiphy;
1590         long start;
1591         long split_start, band_start, chan_start, capa_start;
1592         bool split;
1593 };
1594
1595 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1596                               enum nl80211_commands cmd,
1597                               struct sk_buff *msg, u32 portid, u32 seq,
1598                               int flags, struct nl80211_dump_wiphy_state *state)
1599 {
1600         void *hdr;
1601         struct nlattr *nl_bands, *nl_band;
1602         struct nlattr *nl_freqs, *nl_freq;
1603         struct nlattr *nl_cmds;
1604         enum nl80211_band band;
1605         struct ieee80211_channel *chan;
1606         int i;
1607         const struct ieee80211_txrx_stypes *mgmt_stypes =
1608                                 rdev->wiphy.mgmt_stypes;
1609         u32 features;
1610
1611         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1612         if (!hdr)
1613                 return -ENOBUFS;
1614
1615         if (WARN_ON(!state))
1616                 return -EINVAL;
1617
1618         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1619             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1620                            wiphy_name(&rdev->wiphy)) ||
1621             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1622                         cfg80211_rdev_list_generation))
1623                 goto nla_put_failure;
1624
1625         if (cmd != NL80211_CMD_NEW_WIPHY)
1626                 goto finish;
1627
1628         switch (state->split_start) {
1629         case 0:
1630                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1631                                rdev->wiphy.retry_short) ||
1632                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1633                                rdev->wiphy.retry_long) ||
1634                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1635                                 rdev->wiphy.frag_threshold) ||
1636                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1637                                 rdev->wiphy.rts_threshold) ||
1638                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1639                                rdev->wiphy.coverage_class) ||
1640                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1641                                rdev->wiphy.max_scan_ssids) ||
1642                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1643                                rdev->wiphy.max_sched_scan_ssids) ||
1644                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1645                                 rdev->wiphy.max_scan_ie_len) ||
1646                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1647                                 rdev->wiphy.max_sched_scan_ie_len) ||
1648                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1649                                rdev->wiphy.max_match_sets) ||
1650                     nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1651                                 rdev->wiphy.max_sched_scan_plans) ||
1652                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1653                                 rdev->wiphy.max_sched_scan_plan_interval) ||
1654                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1655                                 rdev->wiphy.max_sched_scan_plan_iterations))
1656                         goto nla_put_failure;
1657
1658                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1659                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1660                         goto nla_put_failure;
1661                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1662                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1663                         goto nla_put_failure;
1664                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1665                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1666                         goto nla_put_failure;
1667                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1668                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1669                         goto nla_put_failure;
1670                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1671                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1672                         goto nla_put_failure;
1673                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1674                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1675                         goto nla_put_failure;
1676                 state->split_start++;
1677                 if (state->split)
1678                         break;
1679         case 1:
1680                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1681                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1682                             rdev->wiphy.cipher_suites))
1683                         goto nla_put_failure;
1684
1685                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1686                                rdev->wiphy.max_num_pmkids))
1687                         goto nla_put_failure;
1688
1689                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1690                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1691                         goto nla_put_failure;
1692
1693                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1694                                 rdev->wiphy.available_antennas_tx) ||
1695                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1696                                 rdev->wiphy.available_antennas_rx))
1697                         goto nla_put_failure;
1698
1699                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1700                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1701                                 rdev->wiphy.probe_resp_offload))
1702                         goto nla_put_failure;
1703
1704                 if ((rdev->wiphy.available_antennas_tx ||
1705                      rdev->wiphy.available_antennas_rx) &&
1706                     rdev->ops->get_antenna) {
1707                         u32 tx_ant = 0, rx_ant = 0;
1708                         int res;
1709
1710                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1711                         if (!res) {
1712                                 if (nla_put_u32(msg,
1713                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1714                                                 tx_ant) ||
1715                                     nla_put_u32(msg,
1716                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1717                                                 rx_ant))
1718                                         goto nla_put_failure;
1719                         }
1720                 }
1721
1722                 state->split_start++;
1723                 if (state->split)
1724                         break;
1725         case 2:
1726                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1727                                         rdev->wiphy.interface_modes))
1728                                 goto nla_put_failure;
1729                 state->split_start++;
1730                 if (state->split)
1731                         break;
1732         case 3:
1733                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1734                 if (!nl_bands)
1735                         goto nla_put_failure;
1736
1737                 for (band = state->band_start;
1738                      band < NUM_NL80211_BANDS; band++) {
1739                         struct ieee80211_supported_band *sband;
1740
1741                         sband = rdev->wiphy.bands[band];
1742
1743                         if (!sband)
1744                                 continue;
1745
1746                         nl_band = nla_nest_start(msg, band);
1747                         if (!nl_band)
1748                                 goto nla_put_failure;
1749
1750                         switch (state->chan_start) {
1751                         case 0:
1752                                 if (nl80211_send_band_rateinfo(msg, sband))
1753                                         goto nla_put_failure;
1754                                 state->chan_start++;
1755                                 if (state->split)
1756                                         break;
1757                         default:
1758                                 /* add frequencies */
1759                                 nl_freqs = nla_nest_start(
1760                                         msg, NL80211_BAND_ATTR_FREQS);
1761                                 if (!nl_freqs)
1762                                         goto nla_put_failure;
1763
1764                                 for (i = state->chan_start - 1;
1765                                      i < sband->n_channels;
1766                                      i++) {
1767                                         nl_freq = nla_nest_start(msg, i);
1768                                         if (!nl_freq)
1769                                                 goto nla_put_failure;
1770
1771                                         chan = &sband->channels[i];
1772
1773                                         if (nl80211_msg_put_channel(
1774                                                         msg, &rdev->wiphy, chan,
1775                                                         state->split))
1776                                                 goto nla_put_failure;
1777
1778                                         nla_nest_end(msg, nl_freq);
1779                                         if (state->split)
1780                                                 break;
1781                                 }
1782                                 if (i < sband->n_channels)
1783                                         state->chan_start = i + 2;
1784                                 else
1785                                         state->chan_start = 0;
1786                                 nla_nest_end(msg, nl_freqs);
1787                         }
1788
1789                         nla_nest_end(msg, nl_band);
1790
1791                         if (state->split) {
1792                                 /* start again here */
1793                                 if (state->chan_start)
1794                                         band--;
1795                                 break;
1796                         }
1797                 }
1798                 nla_nest_end(msg, nl_bands);
1799
1800                 if (band < NUM_NL80211_BANDS)
1801                         state->band_start = band + 1;
1802                 else
1803                         state->band_start = 0;
1804
1805                 /* if bands & channels are done, continue outside */
1806                 if (state->band_start == 0 && state->chan_start == 0)
1807                         state->split_start++;
1808                 if (state->split)
1809                         break;
1810         case 4:
1811                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1812                 if (!nl_cmds)
1813                         goto nla_put_failure;
1814
1815                 i = nl80211_add_commands_unsplit(rdev, msg);
1816                 if (i < 0)
1817                         goto nla_put_failure;
1818                 if (state->split) {
1819                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1820                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1821                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1822                                 CMD(channel_switch, CHANNEL_SWITCH);
1823                         CMD(set_qos_map, SET_QOS_MAP);
1824                         if (rdev->wiphy.features &
1825                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1826                                 CMD(add_tx_ts, ADD_TX_TS);
1827                         CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
1828                         CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
1829                 }
1830 #undef CMD
1831
1832                 nla_nest_end(msg, nl_cmds);
1833                 state->split_start++;
1834                 if (state->split)
1835                         break;
1836         case 5:
1837                 if (rdev->ops->remain_on_channel &&
1838                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1839                     nla_put_u32(msg,
1840                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1841                                 rdev->wiphy.max_remain_on_channel_duration))
1842                         goto nla_put_failure;
1843
1844                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1845                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1846                         goto nla_put_failure;
1847
1848                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1849                         goto nla_put_failure;
1850                 state->split_start++;
1851                 if (state->split)
1852                         break;
1853         case 6:
1854 #ifdef CONFIG_PM
1855                 if (nl80211_send_wowlan(msg, rdev, state->split))
1856                         goto nla_put_failure;
1857                 state->split_start++;
1858                 if (state->split)
1859                         break;
1860 #else
1861                 state->split_start++;
1862 #endif
1863         case 7:
1864                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1865                                         rdev->wiphy.software_iftypes))
1866                         goto nla_put_failure;
1867
1868                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1869                                                    state->split))
1870                         goto nla_put_failure;
1871
1872                 state->split_start++;
1873                 if (state->split)
1874                         break;
1875         case 8:
1876                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1877                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1878                                 rdev->wiphy.ap_sme_capa))
1879                         goto nla_put_failure;
1880
1881                 features = rdev->wiphy.features;
1882                 /*
1883                  * We can only add the per-channel limit information if the
1884                  * dump is split, otherwise it makes it too big. Therefore
1885                  * only advertise it in that case.
1886                  */
1887                 if (state->split)
1888                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1889                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1890                         goto nla_put_failure;
1891
1892                 if (rdev->wiphy.ht_capa_mod_mask &&
1893                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1894                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1895                             rdev->wiphy.ht_capa_mod_mask))
1896                         goto nla_put_failure;
1897
1898                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1899                     rdev->wiphy.max_acl_mac_addrs &&
1900                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1901                                 rdev->wiphy.max_acl_mac_addrs))
1902                         goto nla_put_failure;
1903
1904                 /*
1905                  * Any information below this point is only available to
1906                  * applications that can deal with it being split. This
1907                  * helps ensure that newly added capabilities don't break
1908                  * older tools by overrunning their buffers.
1909                  *
1910                  * We still increment split_start so that in the split
1911                  * case we'll continue with more data in the next round,
1912                  * but break unconditionally so unsplit data stops here.
1913                  */
1914                 state->split_start++;
1915                 break;
1916         case 9:
1917                 if (rdev->wiphy.extended_capabilities &&
1918                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1919                              rdev->wiphy.extended_capabilities_len,
1920                              rdev->wiphy.extended_capabilities) ||
1921                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1922                              rdev->wiphy.extended_capabilities_len,
1923                              rdev->wiphy.extended_capabilities_mask)))
1924                         goto nla_put_failure;
1925
1926                 if (rdev->wiphy.vht_capa_mod_mask &&
1927                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1928                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1929                             rdev->wiphy.vht_capa_mod_mask))
1930                         goto nla_put_failure;
1931
1932                 state->split_start++;
1933                 break;
1934         case 10:
1935                 if (nl80211_send_coalesce(msg, rdev))
1936                         goto nla_put_failure;
1937
1938                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1939                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1940                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1941                         goto nla_put_failure;
1942
1943                 if (rdev->wiphy.max_ap_assoc_sta &&
1944                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1945                                 rdev->wiphy.max_ap_assoc_sta))
1946                         goto nla_put_failure;
1947
1948                 state->split_start++;
1949                 break;
1950         case 11:
1951                 if (rdev->wiphy.n_vendor_commands) {
1952                         const struct nl80211_vendor_cmd_info *info;
1953                         struct nlattr *nested;
1954
1955                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1956                         if (!nested)
1957                                 goto nla_put_failure;
1958
1959                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1960                                 info = &rdev->wiphy.vendor_commands[i].info;
1961                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1962                                         goto nla_put_failure;
1963                         }
1964                         nla_nest_end(msg, nested);
1965                 }
1966
1967                 if (rdev->wiphy.n_vendor_events) {
1968                         const struct nl80211_vendor_cmd_info *info;
1969                         struct nlattr *nested;
1970
1971                         nested = nla_nest_start(msg,
1972                                                 NL80211_ATTR_VENDOR_EVENTS);
1973                         if (!nested)
1974                                 goto nla_put_failure;
1975
1976                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1977                                 info = &rdev->wiphy.vendor_events[i];
1978                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1979                                         goto nla_put_failure;
1980                         }
1981                         nla_nest_end(msg, nested);
1982                 }
1983                 state->split_start++;
1984                 break;
1985         case 12:
1986                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1987                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1988                                rdev->wiphy.max_num_csa_counters))
1989                         goto nla_put_failure;
1990
1991                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
1992                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
1993                         goto nla_put_failure;
1994
1995                 if (rdev->wiphy.max_sched_scan_reqs &&
1996                     nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
1997                                 rdev->wiphy.max_sched_scan_reqs))
1998                         goto nla_put_failure;
1999
2000                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2001                             sizeof(rdev->wiphy.ext_features),
2002                             rdev->wiphy.ext_features))
2003                         goto nla_put_failure;
2004
2005                 if (rdev->wiphy.bss_select_support) {
2006                         struct nlattr *nested;
2007                         u32 bss_select_support = rdev->wiphy.bss_select_support;
2008
2009                         nested = nla_nest_start(msg, NL80211_ATTR_BSS_SELECT);
2010                         if (!nested)
2011                                 goto nla_put_failure;
2012
2013                         i = 0;
2014                         while (bss_select_support) {
2015                                 if ((bss_select_support & 1) &&
2016                                     nla_put_flag(msg, i))
2017                                         goto nla_put_failure;
2018                                 i++;
2019                                 bss_select_support >>= 1;
2020                         }
2021                         nla_nest_end(msg, nested);
2022                 }
2023
2024                 state->split_start++;
2025                 break;
2026         case 13:
2027                 if (rdev->wiphy.num_iftype_ext_capab &&
2028                     rdev->wiphy.iftype_ext_capab) {
2029                         struct nlattr *nested_ext_capab, *nested;
2030
2031                         nested = nla_nest_start(msg,
2032                                                 NL80211_ATTR_IFTYPE_EXT_CAPA);
2033                         if (!nested)
2034                                 goto nla_put_failure;
2035
2036                         for (i = state->capa_start;
2037                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
2038                                 const struct wiphy_iftype_ext_capab *capab;
2039
2040                                 capab = &rdev->wiphy.iftype_ext_capab[i];
2041
2042                                 nested_ext_capab = nla_nest_start(msg, i);
2043                                 if (!nested_ext_capab ||
2044                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
2045                                                 capab->iftype) ||
2046                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
2047                                             capab->extended_capabilities_len,
2048                                             capab->extended_capabilities) ||
2049                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2050                                             capab->extended_capabilities_len,
2051                                             capab->extended_capabilities_mask))
2052                                         goto nla_put_failure;
2053
2054                                 nla_nest_end(msg, nested_ext_capab);
2055                                 if (state->split)
2056                                         break;
2057                         }
2058                         nla_nest_end(msg, nested);
2059                         if (i < rdev->wiphy.num_iftype_ext_capab) {
2060                                 state->capa_start = i + 1;
2061                                 break;
2062                         }
2063                 }
2064
2065                 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
2066                                 rdev->wiphy.nan_supported_bands))
2067                         goto nla_put_failure;
2068
2069                 if (wiphy_ext_feature_isset(&rdev->wiphy,
2070                                             NL80211_EXT_FEATURE_TXQS)) {
2071                         struct cfg80211_txq_stats txqstats = {};
2072                         int res;
2073
2074                         res = rdev_get_txq_stats(rdev, NULL, &txqstats);
2075                         if (!res &&
2076                             !nl80211_put_txq_stats(msg, &txqstats,
2077                                                    NL80211_ATTR_TXQ_STATS))
2078                                 goto nla_put_failure;
2079
2080                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
2081                                         rdev->wiphy.txq_limit))
2082                                 goto nla_put_failure;
2083                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
2084                                         rdev->wiphy.txq_memory_limit))
2085                                 goto nla_put_failure;
2086                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
2087                                         rdev->wiphy.txq_quantum))
2088                                 goto nla_put_failure;
2089                 }
2090
2091                 /* done */
2092                 state->split_start = 0;
2093                 break;
2094         }
2095  finish:
2096         genlmsg_end(msg, hdr);
2097         return 0;
2098
2099  nla_put_failure:
2100         genlmsg_cancel(msg, hdr);
2101         return -EMSGSIZE;
2102 }
2103
2104 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
2105                                     struct netlink_callback *cb,
2106                                     struct nl80211_dump_wiphy_state *state)
2107 {
2108         struct nlattr **tb = genl_family_attrbuf(&nl80211_fam);
2109         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, tb,
2110                               nl80211_fam.maxattr, nl80211_policy, NULL);
2111         /* ignore parse errors for backward compatibility */
2112         if (ret)
2113                 return 0;
2114
2115         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
2116         if (tb[NL80211_ATTR_WIPHY])
2117                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
2118         if (tb[NL80211_ATTR_WDEV])
2119                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
2120         if (tb[NL80211_ATTR_IFINDEX]) {
2121                 struct net_device *netdev;
2122                 struct cfg80211_registered_device *rdev;
2123                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2124
2125                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2126                 if (!netdev)
2127                         return -ENODEV;
2128                 if (netdev->ieee80211_ptr) {
2129                         rdev = wiphy_to_rdev(
2130                                 netdev->ieee80211_ptr->wiphy);
2131                         state->filter_wiphy = rdev->wiphy_idx;
2132                 }
2133         }
2134
2135         return 0;
2136 }
2137
2138 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
2139 {
2140         int idx = 0, ret;
2141         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
2142         struct cfg80211_registered_device *rdev;
2143
2144         rtnl_lock();
2145         if (!state) {
2146                 state = kzalloc(sizeof(*state), GFP_KERNEL);
2147                 if (!state) {
2148                         rtnl_unlock();
2149                         return -ENOMEM;
2150                 }
2151                 state->filter_wiphy = -1;
2152                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
2153                 if (ret) {
2154                         kfree(state);
2155                         rtnl_unlock();
2156                         return ret;
2157                 }
2158                 cb->args[0] = (long)state;
2159         }
2160
2161         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2162                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2163                         continue;
2164                 if (++idx <= state->start)
2165                         continue;
2166                 if (state->filter_wiphy != -1 &&
2167                     state->filter_wiphy != rdev->wiphy_idx)
2168                         continue;
2169                 /* attempt to fit multiple wiphy data chunks into the skb */
2170                 do {
2171                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
2172                                                  skb,
2173                                                  NETLINK_CB(cb->skb).portid,
2174                                                  cb->nlh->nlmsg_seq,
2175                                                  NLM_F_MULTI, state);
2176                         if (ret < 0) {
2177                                 /*
2178                                  * If sending the wiphy data didn't fit (ENOBUFS
2179                                  * or EMSGSIZE returned), this SKB is still
2180                                  * empty (so it's not too big because another
2181                                  * wiphy dataset is already in the skb) and
2182                                  * we've not tried to adjust the dump allocation
2183                                  * yet ... then adjust the alloc size to be
2184                                  * bigger, and return 1 but with the empty skb.
2185                                  * This results in an empty message being RX'ed
2186                                  * in userspace, but that is ignored.
2187                                  *
2188                                  * We can then retry with the larger buffer.
2189                                  */
2190                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
2191                                     !skb->len && !state->split &&
2192                                     cb->min_dump_alloc < 4096) {
2193                                         cb->min_dump_alloc = 4096;
2194                                         state->split_start = 0;
2195                                         rtnl_unlock();
2196                                         return 1;
2197                                 }
2198                                 idx--;
2199                                 break;
2200                         }
2201                 } while (state->split_start > 0);
2202                 break;
2203         }
2204         rtnl_unlock();
2205
2206         state->start = idx;
2207
2208         return skb->len;
2209 }
2210
2211 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
2212 {
2213         kfree((void *)cb->args[0]);
2214         return 0;
2215 }
2216
2217 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
2218 {
2219         struct sk_buff *msg;
2220         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2221         struct nl80211_dump_wiphy_state state = {};
2222
2223         msg = nlmsg_new(4096, GFP_KERNEL);
2224         if (!msg)
2225                 return -ENOMEM;
2226
2227         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
2228                                info->snd_portid, info->snd_seq, 0,
2229                                &state) < 0) {
2230                 nlmsg_free(msg);
2231                 return -ENOBUFS;
2232         }
2233
2234         return genlmsg_reply(msg, info);
2235 }
2236
2237 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2238         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
2239         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
2240         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
2241         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
2242         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
2243 };
2244
2245 static int parse_txq_params(struct nlattr *tb[],
2246                             struct ieee80211_txq_params *txq_params)
2247 {
2248         u8 ac;
2249
2250         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2251             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2252             !tb[NL80211_TXQ_ATTR_AIFS])
2253                 return -EINVAL;
2254
2255         ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2256         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2257         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2258         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2259         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2260
2261         if (ac >= NL80211_NUM_ACS)
2262                 return -EINVAL;
2263         txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
2264         return 0;
2265 }
2266
2267 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2268 {
2269         /*
2270          * You can only set the channel explicitly for WDS interfaces,
2271          * all others have their channel managed via their respective
2272          * "establish a connection" command (connect, join, ...)
2273          *
2274          * For AP/GO and mesh mode, the channel can be set with the
2275          * channel userspace API, but is only stored and passed to the
2276          * low-level driver when the AP starts or the mesh is joined.
2277          * This is for backward compatibility, userspace can also give
2278          * the channel in the start-ap or join-mesh commands instead.
2279          *
2280          * Monitors are special as they are normally slaved to
2281          * whatever else is going on, so they have their own special
2282          * operation to set the monitor channel if possible.
2283          */
2284         return !wdev ||
2285                 wdev->iftype == NL80211_IFTYPE_AP ||
2286                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2287                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
2288                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
2289 }
2290
2291 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2292                                  struct genl_info *info,
2293                                  struct cfg80211_chan_def *chandef)
2294 {
2295         u32 control_freq;
2296
2297         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
2298                 return -EINVAL;
2299
2300         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
2301
2302         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
2303         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2304         chandef->center_freq1 = control_freq;
2305         chandef->center_freq2 = 0;
2306
2307         /* Primary channel not allowed */
2308         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
2309                 return -EINVAL;
2310
2311         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2312                 enum nl80211_channel_type chantype;
2313
2314                 chantype = nla_get_u32(
2315                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2316
2317                 switch (chantype) {
2318                 case NL80211_CHAN_NO_HT:
2319                 case NL80211_CHAN_HT20:
2320                 case NL80211_CHAN_HT40PLUS:
2321                 case NL80211_CHAN_HT40MINUS:
2322                         cfg80211_chandef_create(chandef, chandef->chan,
2323                                                 chantype);
2324                         /* user input for center_freq is incorrect */
2325                         if (info->attrs[NL80211_ATTR_CENTER_FREQ1] &&
2326                             chandef->center_freq1 != nla_get_u32(
2327                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]))
2328                                 return -EINVAL;
2329                         /* center_freq2 must be zero */
2330                         if (info->attrs[NL80211_ATTR_CENTER_FREQ2] &&
2331                             nla_get_u32(info->attrs[NL80211_ATTR_CENTER_FREQ2]))
2332                                 return -EINVAL;
2333                         break;
2334                 default:
2335                         return -EINVAL;
2336                 }
2337         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2338                 chandef->width =
2339                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2340                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
2341                         chandef->center_freq1 =
2342                                 nla_get_u32(
2343                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
2344                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
2345                         chandef->center_freq2 =
2346                                 nla_get_u32(
2347                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
2348         }
2349
2350         if (!cfg80211_chandef_valid(chandef))
2351                 return -EINVAL;
2352
2353         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2354                                      IEEE80211_CHAN_DISABLED))
2355                 return -EINVAL;
2356
2357         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2358              chandef->width == NL80211_CHAN_WIDTH_10) &&
2359             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
2360                 return -EINVAL;
2361
2362         return 0;
2363 }
2364
2365 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
2366                                  struct net_device *dev,
2367                                  struct genl_info *info)
2368 {
2369         struct cfg80211_chan_def chandef;
2370         int result;
2371         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2372         struct wireless_dev *wdev = NULL;
2373
2374         if (dev)
2375                 wdev = dev->ieee80211_ptr;
2376         if (!nl80211_can_set_dev_channel(wdev))
2377                 return -EOPNOTSUPP;
2378         if (wdev)
2379                 iftype = wdev->iftype;
2380
2381         result = nl80211_parse_chandef(rdev, info, &chandef);
2382         if (result)
2383                 return result;
2384
2385         switch (iftype) {
2386         case NL80211_IFTYPE_AP:
2387         case NL80211_IFTYPE_P2P_GO:
2388                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2389                                                    iftype)) {
2390                         result = -EINVAL;
2391                         break;
2392                 }
2393                 if (wdev->beacon_interval) {
2394                         if (!dev || !rdev->ops->set_ap_chanwidth ||
2395                             !(rdev->wiphy.features &
2396                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2397                                 result = -EBUSY;
2398                                 break;
2399                         }
2400
2401                         /* Only allow dynamic channel width changes */
2402                         if (chandef.chan != wdev->preset_chandef.chan) {
2403                                 result = -EBUSY;
2404                                 break;
2405                         }
2406                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2407                         if (result)
2408                                 break;
2409                 }
2410                 wdev->preset_chandef = chandef;
2411                 result = 0;
2412                 break;
2413         case NL80211_IFTYPE_MESH_POINT:
2414                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2415                 break;
2416         case NL80211_IFTYPE_MONITOR:
2417                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2418                 break;
2419         default:
2420                 result = -EINVAL;
2421         }
2422
2423         return result;
2424 }
2425
2426 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2427 {
2428         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2429         struct net_device *netdev = info->user_ptr[1];
2430
2431         return __nl80211_set_channel(rdev, netdev, info);
2432 }
2433
2434 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2435 {
2436         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2437         struct net_device *dev = info->user_ptr[1];
2438         struct wireless_dev *wdev = dev->ieee80211_ptr;
2439         const u8 *bssid;
2440
2441         if (!info->attrs[NL80211_ATTR_MAC])
2442                 return -EINVAL;
2443
2444         if (netif_running(dev))
2445                 return -EBUSY;
2446
2447         if (!rdev->ops->set_wds_peer)
2448                 return -EOPNOTSUPP;
2449
2450         if (wdev->iftype != NL80211_IFTYPE_WDS)
2451                 return -EOPNOTSUPP;
2452
2453         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2454         return rdev_set_wds_peer(rdev, dev, bssid);
2455 }
2456
2457 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2458 {
2459         struct cfg80211_registered_device *rdev;
2460         struct net_device *netdev = NULL;
2461         struct wireless_dev *wdev;
2462         int result = 0, rem_txq_params = 0;
2463         struct nlattr *nl_txq_params;
2464         u32 changed;
2465         u8 retry_short = 0, retry_long = 0;
2466         u32 frag_threshold = 0, rts_threshold = 0;
2467         u8 coverage_class = 0;
2468         u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
2469
2470         ASSERT_RTNL();
2471
2472         /*
2473          * Try to find the wiphy and netdev. Normally this
2474          * function shouldn't need the netdev, but this is
2475          * done for backward compatibility -- previously
2476          * setting the channel was done per wiphy, but now
2477          * it is per netdev. Previous userland like hostapd
2478          * also passed a netdev to set_wiphy, so that it is
2479          * possible to let that go to the right netdev!
2480          */
2481
2482         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2483                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2484
2485                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2486                 if (netdev && netdev->ieee80211_ptr)
2487                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2488                 else
2489                         netdev = NULL;
2490         }
2491
2492         if (!netdev) {
2493                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2494                                                   info->attrs);
2495                 if (IS_ERR(rdev))
2496                         return PTR_ERR(rdev);
2497                 wdev = NULL;
2498                 netdev = NULL;
2499                 result = 0;
2500         } else
2501                 wdev = netdev->ieee80211_ptr;
2502
2503         /*
2504          * end workaround code, by now the rdev is available
2505          * and locked, and wdev may or may not be NULL.
2506          */
2507
2508         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2509                 result = cfg80211_dev_rename(
2510                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2511
2512         if (result)
2513                 return result;
2514
2515         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2516                 struct ieee80211_txq_params txq_params;
2517                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2518
2519                 if (!rdev->ops->set_txq_params)
2520                         return -EOPNOTSUPP;
2521
2522                 if (!netdev)
2523                         return -EINVAL;
2524
2525                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2526                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2527                         return -EINVAL;
2528
2529                 if (!netif_running(netdev))
2530                         return -ENETDOWN;
2531
2532                 nla_for_each_nested(nl_txq_params,
2533                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2534                                     rem_txq_params) {
2535                         result = nla_parse_nested(tb, NL80211_TXQ_ATTR_MAX,
2536                                                   nl_txq_params,
2537                                                   txq_params_policy,
2538                                                   info->extack);
2539                         if (result)
2540                                 return result;
2541                         result = parse_txq_params(tb, &txq_params);
2542                         if (result)
2543                                 return result;
2544
2545                         result = rdev_set_txq_params(rdev, netdev,
2546                                                      &txq_params);
2547                         if (result)
2548                                 return result;
2549                 }
2550         }
2551
2552         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2553                 result = __nl80211_set_channel(
2554                         rdev,
2555                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2556                         info);
2557                 if (result)
2558                         return result;
2559         }
2560
2561         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2562                 struct wireless_dev *txp_wdev = wdev;
2563                 enum nl80211_tx_power_setting type;
2564                 int idx, mbm = 0;
2565
2566                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2567                         txp_wdev = NULL;
2568
2569                 if (!rdev->ops->set_tx_power)
2570                         return -EOPNOTSUPP;
2571
2572                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2573                 type = nla_get_u32(info->attrs[idx]);
2574
2575                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2576                     (type != NL80211_TX_POWER_AUTOMATIC))
2577                         return -EINVAL;
2578
2579                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2580                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2581                         mbm = nla_get_u32(info->attrs[idx]);
2582                 }
2583
2584                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2585                 if (result)
2586                         return result;
2587         }
2588
2589         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2590             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2591                 u32 tx_ant, rx_ant;
2592
2593                 if ((!rdev->wiphy.available_antennas_tx &&
2594                      !rdev->wiphy.available_antennas_rx) ||
2595                     !rdev->ops->set_antenna)
2596                         return -EOPNOTSUPP;
2597
2598                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2599                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2600
2601                 /* reject antenna configurations which don't match the
2602                  * available antenna masks, except for the "all" mask */
2603                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2604                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2605                         return -EINVAL;
2606
2607                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2608                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2609
2610                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2611                 if (result)
2612                         return result;
2613         }
2614
2615         changed = 0;
2616
2617         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2618                 retry_short = nla_get_u8(
2619                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2620                 if (retry_short == 0)
2621                         return -EINVAL;
2622
2623                 changed |= WIPHY_PARAM_RETRY_SHORT;
2624         }
2625
2626         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2627                 retry_long = nla_get_u8(
2628                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2629                 if (retry_long == 0)
2630                         return -EINVAL;
2631
2632                 changed |= WIPHY_PARAM_RETRY_LONG;
2633         }
2634
2635         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2636                 frag_threshold = nla_get_u32(
2637                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2638                 if (frag_threshold < 256)
2639                         return -EINVAL;
2640
2641                 if (frag_threshold != (u32) -1) {
2642                         /*
2643                          * Fragments (apart from the last one) are required to
2644                          * have even length. Make the fragmentation code
2645                          * simpler by stripping LSB should someone try to use
2646                          * odd threshold value.
2647                          */
2648                         frag_threshold &= ~0x1;
2649                 }
2650                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2651         }
2652
2653         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2654                 rts_threshold = nla_get_u32(
2655                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2656                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2657         }
2658
2659         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2660                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2661                         return -EINVAL;
2662
2663                 coverage_class = nla_get_u8(
2664                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2665                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2666         }
2667
2668         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2669                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2670                         return -EOPNOTSUPP;
2671
2672                 changed |= WIPHY_PARAM_DYN_ACK;
2673         }
2674
2675         if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
2676                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2677                                              NL80211_EXT_FEATURE_TXQS))
2678                         return -EOPNOTSUPP;
2679                 txq_limit = nla_get_u32(
2680                         info->attrs[NL80211_ATTR_TXQ_LIMIT]);
2681                 changed |= WIPHY_PARAM_TXQ_LIMIT;
2682         }
2683
2684         if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
2685                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2686                                              NL80211_EXT_FEATURE_TXQS))
2687                         return -EOPNOTSUPP;
2688                 txq_memory_limit = nla_get_u32(
2689                         info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
2690                 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
2691         }
2692
2693         if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
2694                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2695                                              NL80211_EXT_FEATURE_TXQS))
2696                         return -EOPNOTSUPP;
2697                 txq_quantum = nla_get_u32(
2698                         info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
2699                 changed |= WIPHY_PARAM_TXQ_QUANTUM;
2700         }
2701
2702         if (changed) {
2703                 u8 old_retry_short, old_retry_long;
2704                 u32 old_frag_threshold, old_rts_threshold;
2705                 u8 old_coverage_class;
2706                 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
2707
2708                 if (!rdev->ops->set_wiphy_params)
2709                         return -EOPNOTSUPP;
2710
2711                 old_retry_short = rdev->wiphy.retry_short;
2712                 old_retry_long = rdev->wiphy.retry_long;
2713                 old_frag_threshold = rdev->wiphy.frag_threshold;
2714                 old_rts_threshold = rdev->wiphy.rts_threshold;
2715                 old_coverage_class = rdev->wiphy.coverage_class;
2716                 old_txq_limit = rdev->wiphy.txq_limit;
2717                 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
2718                 old_txq_quantum = rdev->wiphy.txq_quantum;
2719
2720                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2721                         rdev->wiphy.retry_short = retry_short;
2722                 if (changed & WIPHY_PARAM_RETRY_LONG)
2723                         rdev->wiphy.retry_long = retry_long;
2724                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2725                         rdev->wiphy.frag_threshold = frag_threshold;
2726                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2727                         rdev->wiphy.rts_threshold = rts_threshold;
2728                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2729                         rdev->wiphy.coverage_class = coverage_class;
2730                 if (changed & WIPHY_PARAM_TXQ_LIMIT)
2731                         rdev->wiphy.txq_limit = txq_limit;
2732                 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
2733                         rdev->wiphy.txq_memory_limit = txq_memory_limit;
2734                 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
2735                         rdev->wiphy.txq_quantum = txq_quantum;
2736
2737                 result = rdev_set_wiphy_params(rdev, changed);
2738                 if (result) {
2739                         rdev->wiphy.retry_short = old_retry_short;
2740                         rdev->wiphy.retry_long = old_retry_long;
2741                         rdev->wiphy.frag_threshold = old_frag_threshold;
2742                         rdev->wiphy.rts_threshold = old_rts_threshold;
2743                         rdev->wiphy.coverage_class = old_coverage_class;
2744                         rdev->wiphy.txq_limit = old_txq_limit;
2745                         rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
2746                         rdev->wiphy.txq_quantum = old_txq_quantum;
2747                         return result;
2748                 }
2749         }
2750         return 0;
2751 }
2752
2753 static inline u64 wdev_id(struct wireless_dev *wdev)
2754 {
2755         return (u64)wdev->identifier |
2756                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2757 }
2758
2759 static int nl80211_send_chandef(struct sk_buff *msg,
2760                                 const struct cfg80211_chan_def *chandef)
2761 {
2762         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2763                 return -EINVAL;
2764
2765         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2766                         chandef->chan->center_freq))
2767                 return -ENOBUFS;
2768         switch (chandef->width) {
2769         case NL80211_CHAN_WIDTH_20_NOHT:
2770         case NL80211_CHAN_WIDTH_20:
2771         case NL80211_CHAN_WIDTH_40:
2772                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2773                                 cfg80211_get_chandef_type(chandef)))
2774                         return -ENOBUFS;
2775                 break;
2776         default:
2777                 break;
2778         }
2779         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2780                 return -ENOBUFS;
2781         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2782                 return -ENOBUFS;
2783         if (chandef->center_freq2 &&
2784             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2785                 return -ENOBUFS;
2786         return 0;
2787 }
2788
2789 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2790                               struct cfg80211_registered_device *rdev,
2791                               struct wireless_dev *wdev, bool removal)
2792 {
2793         struct net_device *dev = wdev->netdev;
2794         u8 cmd = NL80211_CMD_NEW_INTERFACE;
2795         void *hdr;
2796
2797         if (removal)
2798                 cmd = NL80211_CMD_DEL_INTERFACE;
2799
2800         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2801         if (!hdr)
2802                 return -1;
2803
2804         if (dev &&
2805             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2806              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2807                 goto nla_put_failure;
2808
2809         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2810             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2811             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
2812                               NL80211_ATTR_PAD) ||
2813             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2814             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2815                         rdev->devlist_generation ^
2816                         (cfg80211_rdev_list_generation << 2)) ||
2817             nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr))
2818                 goto nla_put_failure;
2819
2820         if (rdev->ops->get_channel) {
2821                 int ret;
2822                 struct cfg80211_chan_def chandef;
2823
2824                 ret = rdev_get_channel(rdev, wdev, &chandef);
2825                 if (ret == 0) {
2826                         if (nl80211_send_chandef(msg, &chandef))
2827                                 goto nla_put_failure;
2828                 }
2829         }
2830
2831         if (rdev->ops->get_tx_power) {
2832                 int dbm, ret;
2833
2834                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
2835                 if (ret == 0 &&
2836                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
2837                                 DBM_TO_MBM(dbm)))
2838                         goto nla_put_failure;
2839         }
2840
2841         wdev_lock(wdev);
2842         switch (wdev->iftype) {
2843         case NL80211_IFTYPE_AP:
2844                 if (wdev->ssid_len &&
2845                     nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2846                         goto nla_put_failure_locked;
2847                 break;
2848         case NL80211_IFTYPE_STATION:
2849         case NL80211_IFTYPE_P2P_CLIENT:
2850         case NL80211_IFTYPE_ADHOC: {
2851                 const u8 *ssid_ie;
2852                 if (!wdev->current_bss)
2853                         break;
2854                 rcu_read_lock();
2855                 ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
2856                                                WLAN_EID_SSID);
2857                 if (ssid_ie &&
2858                     nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2))
2859                         goto nla_put_failure_rcu_locked;
2860                 rcu_read_unlock();
2861                 break;
2862                 }
2863         default:
2864                 /* nothing */
2865                 break;
2866         }
2867         wdev_unlock(wdev);
2868
2869         if (rdev->ops->get_txq_stats) {
2870                 struct cfg80211_txq_stats txqstats = {};
2871                 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
2872
2873                 if (ret == 0 &&
2874                     !nl80211_put_txq_stats(msg, &txqstats,
2875                                            NL80211_ATTR_TXQ_STATS))
2876                         goto nla_put_failure;
2877         }
2878
2879         genlmsg_end(msg, hdr);
2880         return 0;
2881
2882  nla_put_failure_rcu_locked:
2883         rcu_read_unlock();
2884  nla_put_failure_locked:
2885         wdev_unlock(wdev);
2886  nla_put_failure:
2887         genlmsg_cancel(msg, hdr);
2888         return -EMSGSIZE;
2889 }
2890
2891 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2892 {
2893         int wp_idx = 0;
2894         int if_idx = 0;
2895         int wp_start = cb->args[0];
2896         int if_start = cb->args[1];
2897         int filter_wiphy = -1;
2898         struct cfg80211_registered_device *rdev;
2899         struct wireless_dev *wdev;
2900         int ret;
2901
2902         rtnl_lock();
2903         if (!cb->args[2]) {
2904                 struct nl80211_dump_wiphy_state state = {
2905                         .filter_wiphy = -1,
2906                 };
2907
2908                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
2909                 if (ret)
2910                         goto out_unlock;
2911
2912                 filter_wiphy = state.filter_wiphy;
2913
2914                 /*
2915                  * if filtering, set cb->args[2] to +1 since 0 is the default
2916                  * value needed to determine that parsing is necessary.
2917                  */
2918                 if (filter_wiphy >= 0)
2919                         cb->args[2] = filter_wiphy + 1;
2920                 else
2921                         cb->args[2] = -1;
2922         } else if (cb->args[2] > 0) {
2923                 filter_wiphy = cb->args[2] - 1;
2924         }
2925
2926         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2927                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2928                         continue;
2929                 if (wp_idx < wp_start) {
2930                         wp_idx++;
2931                         continue;
2932                 }
2933
2934                 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
2935                         continue;
2936
2937                 if_idx = 0;
2938
2939                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
2940                         if (if_idx < if_start) {
2941                                 if_idx++;
2942                                 continue;
2943                         }
2944                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2945                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2946                                                rdev, wdev, false) < 0) {
2947                                 goto out;
2948                         }
2949                         if_idx++;
2950                 }
2951
2952                 wp_idx++;
2953         }
2954  out:
2955         cb->args[0] = wp_idx;
2956         cb->args[1] = if_idx;
2957
2958         ret = skb->len;
2959  out_unlock:
2960         rtnl_unlock();
2961
2962         return ret;
2963 }
2964
2965 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2966 {
2967         struct sk_buff *msg;
2968         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2969         struct wireless_dev *wdev = info->user_ptr[1];
2970
2971         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2972         if (!msg)
2973                 return -ENOMEM;
2974
2975         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2976                                rdev, wdev, false) < 0) {
2977                 nlmsg_free(msg);
2978                 return -ENOBUFS;
2979         }
2980
2981         return genlmsg_reply(msg, info);
2982 }
2983
2984 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2985         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2986         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2987         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2988         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2989         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2990         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2991 };
2992
2993 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2994 {
2995         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2996         int flag;
2997
2998         *mntrflags = 0;
2999
3000         if (!nla)
3001                 return -EINVAL;
3002
3003         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX, nla,
3004                              mntr_flags_policy, NULL))
3005                 return -EINVAL;
3006
3007         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
3008                 if (flags[flag])
3009                         *mntrflags |= (1<<flag);
3010
3011         *mntrflags |= MONITOR_FLAG_CHANGED;
3012
3013         return 0;
3014 }
3015
3016 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
3017                                      enum nl80211_iftype type,
3018                                      struct genl_info *info,
3019                                      struct vif_params *params)
3020 {
3021         bool change = false;
3022         int err;
3023
3024         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
3025                 if (type != NL80211_IFTYPE_MONITOR)
3026                         return -EINVAL;
3027
3028                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
3029                                           &params->flags);
3030                 if (err)
3031                         return err;
3032
3033                 change = true;
3034         }
3035
3036         if (params->flags & MONITOR_FLAG_ACTIVE &&
3037             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
3038                 return -EOPNOTSUPP;
3039
3040         if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
3041                 const u8 *mumimo_groups;
3042                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3043
3044                 if (type != NL80211_IFTYPE_MONITOR)
3045                         return -EINVAL;
3046
3047                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3048                         return -EOPNOTSUPP;
3049
3050                 mumimo_groups =
3051                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
3052
3053                 /* bits 0 and 63 are reserved and must be zero */
3054                 if ((mumimo_groups[0] & BIT(0)) ||
3055                     (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
3056                         return -EINVAL;
3057
3058                 params->vht_mumimo_groups = mumimo_groups;
3059                 change = true;
3060         }
3061
3062         if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
3063                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3064
3065                 if (type != NL80211_IFTYPE_MONITOR)
3066                         return -EINVAL;
3067
3068                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3069                         return -EOPNOTSUPP;
3070
3071                 params->vht_mumimo_follow_addr =
3072                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
3073                 change = true;
3074         }
3075
3076         return change ? 1 : 0;
3077 }
3078
3079 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
3080                                struct net_device *netdev, u8 use_4addr,
3081                                enum nl80211_iftype iftype)
3082 {
3083         if (!use_4addr) {
3084                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
3085                         return -EBUSY;
3086                 return 0;
3087         }
3088
3089         switch (iftype) {
3090         case NL80211_IFTYPE_AP_VLAN:
3091                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
3092                         return 0;
3093                 break;
3094         case NL80211_IFTYPE_STATION:
3095                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
3096                         return 0;
3097                 break;
3098         default:
3099                 break;
3100         }
3101
3102         return -EOPNOTSUPP;
3103 }
3104
3105 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
3106 {
3107         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3108         struct vif_params params;
3109         int err;
3110         enum nl80211_iftype otype, ntype;
3111         struct net_device *dev = info->user_ptr[1];
3112         bool change = false;
3113
3114         memset(&params, 0, sizeof(params));
3115
3116         otype = ntype = dev->ieee80211_ptr->iftype;
3117
3118         if (info->attrs[NL80211_ATTR_IFTYPE]) {
3119                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3120                 if (otype != ntype)
3121                         change = true;
3122                 if (ntype > NL80211_IFTYPE_MAX)
3123                         return -EINVAL;
3124         }
3125
3126         if (info->attrs[NL80211_ATTR_MESH_ID]) {
3127                 struct wireless_dev *wdev = dev->ieee80211_ptr;
3128
3129                 if (ntype != NL80211_IFTYPE_MESH_POINT)
3130                         return -EINVAL;
3131                 if (netif_running(dev))
3132                         return -EBUSY;
3133
3134                 wdev_lock(wdev);
3135                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3136                              IEEE80211_MAX_MESH_ID_LEN);
3137                 wdev->mesh_id_up_len =
3138                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3139                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3140                        wdev->mesh_id_up_len);
3141                 wdev_unlock(wdev);
3142         }
3143
3144         if (info->attrs[NL80211_ATTR_4ADDR]) {
3145                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3146                 change = true;
3147                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
3148                 if (err)
3149                         return err;
3150         } else {
3151                 params.use_4addr = -1;
3152         }
3153
3154         err = nl80211_parse_mon_options(rdev, ntype, info, &params);
3155         if (err < 0)
3156                 return err;
3157         if (err > 0)
3158                 change = true;
3159
3160         if (change)
3161                 err = cfg80211_change_iface(rdev, dev, ntype, &params);
3162         else
3163                 err = 0;
3164
3165         if (!err && params.use_4addr != -1)
3166                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
3167
3168         return err;
3169 }
3170
3171 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
3172 {
3173         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3174         struct vif_params params;
3175         struct wireless_dev *wdev;
3176         struct sk_buff *msg;
3177         int err;
3178         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
3179
3180         /* to avoid failing a new interface creation due to pending removal */
3181         cfg80211_destroy_ifaces(rdev);
3182
3183         memset(&params, 0, sizeof(params));
3184
3185         if (!info->attrs[NL80211_ATTR_IFNAME])
3186                 return -EINVAL;
3187
3188         if (info->attrs[NL80211_ATTR_IFTYPE]) {
3189                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3190                 if (type > NL80211_IFTYPE_MAX)
3191                         return -EINVAL;
3192         }
3193
3194         if (!rdev->ops->add_virtual_intf ||
3195             !(rdev->wiphy.interface_modes & (1 << type)))
3196                 return -EOPNOTSUPP;
3197
3198         if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
3199              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
3200             info->attrs[NL80211_ATTR_MAC]) {
3201                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
3202                            ETH_ALEN);
3203                 if (!is_valid_ether_addr(params.macaddr))
3204                         return -EADDRNOTAVAIL;
3205         }
3206
3207         if (info->attrs[NL80211_ATTR_4ADDR]) {
3208                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3209                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
3210                 if (err)
3211                         return err;
3212         }
3213
3214         err = nl80211_parse_mon_options(rdev, type, info, &params);
3215         if (err < 0)
3216                 return err;
3217
3218         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3219         if (!msg)
3220                 return -ENOMEM;
3221
3222         wdev = rdev_add_virtual_intf(rdev,
3223                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
3224                                 NET_NAME_USER, type, &params);
3225         if (WARN_ON(!wdev)) {
3226                 nlmsg_free(msg);
3227                 return -EPROTO;
3228         } else if (IS_ERR(wdev)) {
3229                 nlmsg_free(msg);
3230                 return PTR_ERR(wdev);
3231         }
3232
3233         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
3234                 wdev->owner_nlportid = info->snd_portid;
3235
3236         switch (type) {
3237         case NL80211_IFTYPE_MESH_POINT:
3238                 if (!info->attrs[NL80211_ATTR_MESH_ID])
3239                         break;
3240                 wdev_lock(wdev);
3241                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3242                              IEEE80211_MAX_MESH_ID_LEN);
3243                 wdev->mesh_id_up_len =
3244                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3245                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3246                        wdev->mesh_id_up_len);
3247                 wdev_unlock(wdev);
3248                 break;
3249         case NL80211_IFTYPE_NAN:
3250         case NL80211_IFTYPE_P2P_DEVICE:
3251                 /*
3252                  * P2P Device and NAN do not have a netdev, so don't go
3253                  * through the netdev notifier and must be added here
3254                  */
3255                 mutex_init(&wdev->mtx);
3256                 INIT_LIST_HEAD(&wdev->event_list);
3257                 spin_lock_init(&wdev->event_lock);
3258                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
3259                 spin_lock_init(&wdev->mgmt_registrations_lock);
3260
3261                 wdev->identifier = ++rdev->wdev_id;
3262                 list_add_rcu(&wdev->list, &rdev->wiphy.wdev_list);
3263                 rdev->devlist_generation++;
3264                 break;
3265         default:
3266                 break;
3267         }
3268
3269         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3270                                rdev, wdev, false) < 0) {
3271                 nlmsg_free(msg);
3272                 return -ENOBUFS;
3273         }
3274
3275         /*
3276          * For wdevs which have no associated netdev object (e.g. of type
3277          * NL80211_IFTYPE_P2P_DEVICE), emit the NEW_INTERFACE event here.
3278          * For all other types, the event will be generated from the
3279          * netdev notifier
3280          */
3281         if (!wdev->netdev)
3282                 nl80211_notify_iface(rdev, wdev, NL80211_CMD_NEW_INTERFACE);
3283
3284         return genlmsg_reply(msg, info);
3285 }
3286
3287 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
3288 {
3289         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3290         struct wireless_dev *wdev = info->user_ptr[1];
3291
3292         if (!rdev->ops->del_virtual_intf)
3293                 return -EOPNOTSUPP;
3294
3295         /*
3296          * If we remove a wireless device without a netdev then clear
3297          * user_ptr[1] so that nl80211_post_doit won't dereference it
3298          * to check if it needs to do dev_put(). Otherwise it crashes
3299          * since the wdev has been freed, unlike with a netdev where
3300          * we need the dev_put() for the netdev to really be freed.
3301          */
3302         if (!wdev->netdev)
3303                 info->user_ptr[1] = NULL;
3304
3305         return rdev_del_virtual_intf(rdev, wdev);
3306 }
3307
3308 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
3309 {
3310         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3311         struct net_device *dev = info->user_ptr[1];
3312         u16 noack_map;
3313
3314         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
3315                 return -EINVAL;
3316
3317         if (!rdev->ops->set_noack_map)
3318                 return -EOPNOTSUPP;
3319
3320         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
3321
3322         return rdev_set_noack_map(rdev, dev, noack_map);
3323 }
3324
3325 struct get_key_cookie {
3326         struct sk_buff *msg;
3327         int error;
3328         int idx;
3329 };
3330
3331 static void get_key_callback(void *c, struct key_params *params)
3332 {
3333         struct nlattr *key;
3334         struct get_key_cookie *cookie = c;
3335
3336         if ((params->key &&
3337              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
3338                      params->key_len, params->key)) ||
3339             (params->seq &&
3340              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
3341                      params->seq_len, params->seq)) ||
3342             (params->cipher &&
3343              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
3344                          params->cipher)))
3345                 goto nla_put_failure;
3346
3347         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
3348         if (!key)
3349                 goto nla_put_failure;
3350
3351         if ((params->key &&
3352              nla_put(cookie->msg, NL80211_KEY_DATA,
3353                      params->key_len, params->key)) ||
3354             (params->seq &&
3355              nla_put(cookie->msg, NL80211_KEY_SEQ,
3356                      params->seq_len, params->seq)) ||
3357             (params->cipher &&
3358              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
3359                          params->cipher)))
3360                 goto nla_put_failure;
3361
3362         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
3363                 goto nla_put_failure;
3364
3365         nla_nest_end(cookie->msg, key);
3366
3367         return;
3368  nla_put_failure:
3369         cookie->error = 1;
3370 }
3371
3372 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
3373 {
3374         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3375         int err;
3376         struct net_device *dev = info->user_ptr[1];
3377         u8 key_idx = 0;
3378         const u8 *mac_addr = NULL;
3379         bool pairwise;
3380         struct get_key_cookie cookie = {
3381                 .error = 0,
3382         };
3383         void *hdr;
3384         struct sk_buff *msg;
3385
3386         if (info->attrs[NL80211_ATTR_KEY_IDX])
3387                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
3388
3389         if (key_idx > 5)
3390                 return -EINVAL;
3391
3392         if (info->attrs[NL80211_ATTR_MAC])
3393                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3394
3395         pairwise = !!mac_addr;
3396         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
3397                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
3398
3399                 if (kt >= NUM_NL80211_KEYTYPES)
3400                         return -EINVAL;
3401                 if (kt != NL80211_KEYTYPE_GROUP &&
3402                     kt != NL80211_KEYTYPE_PAIRWISE)
3403                         return -EINVAL;
3404                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
3405         }
3406
3407         if (!rdev->ops->get_key)
3408                 return -EOPNOTSUPP;
3409
3410         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3411                 return -ENOENT;
3412
3413         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3414         if (!msg)
3415                 return -ENOMEM;
3416
3417         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3418                              NL80211_CMD_NEW_KEY);
3419         if (!hdr)
3420                 goto nla_put_failure;
3421
3422         cookie.msg = msg;
3423         cookie.idx = key_idx;
3424
3425         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3426             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
3427                 goto nla_put_failure;
3428         if (mac_addr &&
3429             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
3430                 goto nla_put_failure;
3431
3432         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
3433                            get_key_callback);
3434
3435         if (err)
3436                 goto free_msg;
3437
3438         if (cookie.error)
3439                 goto nla_put_failure;
3440
3441         genlmsg_end(msg, hdr);
3442         return genlmsg_reply(msg, info);
3443
3444  nla_put_failure:
3445         err = -ENOBUFS;
3446  free_msg:
3447         nlmsg_free(msg);
3448         return err;
3449 }
3450
3451 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
3452 {
3453         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3454         struct key_parse key;
3455         int err;
3456         struct net_device *dev = info->user_ptr[1];
3457
3458         err = nl80211_parse_key(info, &key);
3459         if (err)
3460                 return err;
3461
3462         if (key.idx < 0)
3463                 return -EINVAL;
3464
3465         /* only support setting default key */
3466         if (!key.def && !key.defmgmt)
3467                 return -EINVAL;
3468
3469         wdev_lock(dev->ieee80211_ptr);
3470
3471         if (key.def) {
3472                 if (!rdev->ops->set_default_key) {
3473                         err = -EOPNOTSUPP;
3474                         goto out;
3475                 }
3476
3477                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3478                 if (err)
3479                         goto out;
3480
3481                 err = rdev_set_default_key(rdev, dev, key.idx,
3482                                                  key.def_uni, key.def_multi);
3483
3484                 if (err)
3485                         goto out;
3486
3487 #ifdef CONFIG_CFG80211_WEXT
3488                 dev->ieee80211_ptr->wext.default_key = key.idx;
3489 #endif
3490         } else {
3491                 if (key.def_uni || !key.def_multi) {
3492                         err = -EINVAL;
3493                         goto out;
3494                 }
3495
3496                 if (!rdev->ops->set_default_mgmt_key) {
3497                         err = -EOPNOTSUPP;
3498                         goto out;
3499                 }
3500
3501                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3502                 if (err)
3503                         goto out;
3504
3505                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
3506                 if (err)
3507                         goto out;
3508
3509 #ifdef CONFIG_CFG80211_WEXT
3510                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3511 #endif
3512         }
3513
3514  out:
3515         wdev_unlock(dev->ieee80211_ptr);
3516
3517         return err;
3518 }
3519
3520 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3521 {
3522         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3523         int err;
3524         struct net_device *dev = info->user_ptr[1];
3525         struct key_parse key;
3526         const u8 *mac_addr = NULL;
3527
3528         err = nl80211_parse_key(info, &key);
3529         if (err)
3530                 return err;
3531
3532         if (!key.p.key)
3533                 return -EINVAL;
3534
3535         if (info->attrs[NL80211_ATTR_MAC])
3536                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3537
3538         if (key.type == -1) {
3539                 if (mac_addr)
3540                         key.type = NL80211_KEYTYPE_PAIRWISE;
3541                 else
3542                         key.type = NL80211_KEYTYPE_GROUP;
3543         }
3544
3545         /* for now */
3546         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3547             key.type != NL80211_KEYTYPE_GROUP)
3548                 return -EINVAL;
3549
3550         if (!rdev->ops->add_key)
3551                 return -EOPNOTSUPP;
3552
3553         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3554                                            key.type == NL80211_KEYTYPE_PAIRWISE,
3555                                            mac_addr))
3556                 return -EINVAL;
3557
3558         wdev_lock(dev->ieee80211_ptr);
3559         err = nl80211_key_allowed(dev->ieee80211_ptr);
3560         if (!err)
3561                 err = rdev_add_key(rdev, dev, key.idx,
3562                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3563                                     mac_addr, &key.p);
3564         wdev_unlock(dev->ieee80211_ptr);
3565
3566         return err;
3567 }
3568
3569 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3570 {
3571         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3572         int err;
3573         struct net_device *dev = info->user_ptr[1];
3574         u8 *mac_addr = NULL;
3575         struct key_parse key;
3576
3577         err = nl80211_parse_key(info, &key);
3578         if (err)
3579                 return err;
3580
3581         if (info->attrs[NL80211_ATTR_MAC])
3582                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3583
3584         if (key.type == -1) {
3585                 if (mac_addr)
3586                         key.type = NL80211_KEYTYPE_PAIRWISE;
3587                 else
3588                         key.type = NL80211_KEYTYPE_GROUP;
3589         }
3590
3591         /* for now */
3592         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3593             key.type != NL80211_KEYTYPE_GROUP)
3594                 return -EINVAL;
3595
3596         if (!rdev->ops->del_key)
3597                 return -EOPNOTSUPP;
3598
3599         wdev_lock(dev->ieee80211_ptr);
3600         err = nl80211_key_allowed(dev->ieee80211_ptr);
3601
3602         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3603             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3604                 err = -ENOENT;
3605
3606         if (!err)
3607                 err = rdev_del_key(rdev, dev, key.idx,
3608                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3609                                    mac_addr);
3610
3611 #ifdef CONFIG_CFG80211_WEXT
3612         if (!err) {
3613                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3614                         dev->ieee80211_ptr->wext.default_key = -1;
3615                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3616                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3617         }
3618 #endif
3619         wdev_unlock(dev->ieee80211_ptr);
3620
3621         return err;
3622 }
3623
3624 /* This function returns an error or the number of nested attributes */
3625 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3626 {
3627         struct nlattr *attr;
3628         int n_entries = 0, tmp;
3629
3630         nla_for_each_nested(attr, nl_attr, tmp) {
3631                 if (nla_len(attr) != ETH_ALEN)
3632                         return -EINVAL;
3633
3634                 n_entries++;
3635         }
3636
3637         return n_entries;
3638 }
3639
3640 /*
3641  * This function parses ACL information and allocates memory for ACL data.
3642  * On successful return, the calling function is responsible to free the
3643  * ACL buffer returned by this function.
3644  */
3645 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3646                                                 struct genl_info *info)
3647 {
3648         enum nl80211_acl_policy acl_policy;
3649         struct nlattr *attr;
3650         struct cfg80211_acl_data *acl;
3651         int i = 0, n_entries, tmp;
3652
3653         if (!wiphy->max_acl_mac_addrs)
3654                 return ERR_PTR(-EOPNOTSUPP);
3655
3656         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3657                 return ERR_PTR(-EINVAL);
3658
3659         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3660         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3661             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3662                 return ERR_PTR(-EINVAL);
3663
3664         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3665                 return ERR_PTR(-EINVAL);
3666
3667         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3668         if (n_entries < 0)
3669                 return ERR_PTR(n_entries);
3670
3671         if (n_entries > wiphy->max_acl_mac_addrs)
3672                 return ERR_PTR(-ENOTSUPP);
3673
3674         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3675                       GFP_KERNEL);
3676         if (!acl)
3677                 return ERR_PTR(-ENOMEM);
3678
3679         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3680                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3681                 i++;
3682         }
3683
3684         acl->n_acl_entries = n_entries;
3685         acl->acl_policy = acl_policy;
3686
3687         return acl;
3688 }
3689
3690 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3691 {
3692         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3693         struct net_device *dev = info->user_ptr[1];
3694         struct cfg80211_acl_data *acl;
3695         int err;
3696
3697         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3698             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3699                 return -EOPNOTSUPP;
3700
3701         if (!dev->ieee80211_ptr->beacon_interval)
3702                 return -EINVAL;
3703
3704         acl = parse_acl_data(&rdev->wiphy, info);
3705         if (IS_ERR(acl))
3706                 return PTR_ERR(acl);
3707
3708         err = rdev_set_mac_acl(rdev, dev, acl);
3709
3710         kfree(acl);
3711
3712         return err;
3713 }
3714
3715 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
3716                            u8 *rates, u8 rates_len)
3717 {
3718         u8 i;
3719         u32 mask = 0;
3720
3721         for (i = 0; i < rates_len; i++) {
3722                 int rate = (rates[i] & 0x7f) * 5;
3723                 int ridx;
3724
3725                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
3726                         struct ieee80211_rate *srate =
3727                                 &sband->bitrates[ridx];
3728                         if (rate == srate->bitrate) {
3729                                 mask |= 1 << ridx;
3730                                 break;
3731                         }
3732                 }
3733                 if (ridx == sband->n_bitrates)
3734                         return 0; /* rate not found */
3735         }
3736
3737         return mask;
3738 }
3739
3740 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
3741                                u8 *rates, u8 rates_len,
3742                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
3743 {
3744         u8 i;
3745
3746         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
3747
3748         for (i = 0; i < rates_len; i++) {
3749                 int ridx, rbit;
3750
3751                 ridx = rates[i] / 8;
3752                 rbit = BIT(rates[i] % 8);
3753
3754                 /* check validity */
3755                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
3756                         return false;
3757
3758                 /* check availability */
3759                 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
3760                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
3761                         mcs[ridx] |= rbit;
3762                 else
3763                         return false;
3764         }
3765
3766         return true;
3767 }
3768
3769 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
3770 {
3771         u16 mcs_mask = 0;
3772
3773         switch (vht_mcs_map) {
3774         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
3775                 break;
3776         case IEEE80211_VHT_MCS_SUPPORT_0_7:
3777                 mcs_mask = 0x00FF;
3778                 break;
3779         case IEEE80211_VHT_MCS_SUPPORT_0_8:
3780                 mcs_mask = 0x01FF;
3781                 break;
3782         case IEEE80211_VHT_MCS_SUPPORT_0_9:
3783                 mcs_mask = 0x03FF;
3784                 break;
3785         default:
3786                 break;
3787         }
3788
3789         return mcs_mask;
3790 }
3791
3792 static void vht_build_mcs_mask(u16 vht_mcs_map,
3793                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
3794 {
3795         u8 nss;
3796
3797         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
3798                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
3799                 vht_mcs_map >>= 2;
3800         }
3801 }
3802
3803 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
3804                              struct nl80211_txrate_vht *txrate,
3805                              u16 mcs[NL80211_VHT_NSS_MAX])
3806 {
3807         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3808         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
3809         u8 i;
3810
3811         if (!sband->vht_cap.vht_supported)
3812                 return false;
3813
3814         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
3815
3816         /* Build vht_mcs_mask from VHT capabilities */
3817         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
3818
3819         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3820                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
3821                         mcs[i] = txrate->mcs[i];
3822                 else
3823                         return false;
3824         }
3825
3826         return true;
3827 }
3828
3829 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
3830         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
3831                                     .len = NL80211_MAX_SUPP_RATES },
3832         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
3833                                 .len = NL80211_MAX_SUPP_HT_RATES },
3834         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
3835         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
3836 };
3837
3838 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
3839                                          struct cfg80211_bitrate_mask *mask)
3840 {
3841         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
3842         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3843         int rem, i;
3844         struct nlattr *tx_rates;
3845         struct ieee80211_supported_band *sband;
3846         u16 vht_tx_mcs_map;
3847
3848         memset(mask, 0, sizeof(*mask));
3849         /* Default to all rates enabled */
3850         for (i = 0; i < NUM_NL80211_BANDS; i++) {
3851                 sband = rdev->wiphy.bands[i];
3852
3853                 if (!sband)
3854                         continue;
3855
3856                 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
3857                 memcpy(mask->control[i].ht_mcs,
3858                        sband->ht_cap.mcs.rx_mask,
3859                        sizeof(mask->control[i].ht_mcs));
3860
3861                 if (!sband->vht_cap.vht_supported)
3862                         continue;
3863
3864                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3865                 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
3866         }
3867
3868         /* if no rates are given set it back to the defaults */
3869         if (!info->attrs[NL80211_ATTR_TX_RATES])
3870                 goto out;
3871
3872         /* The nested attribute uses enum nl80211_band as the index. This maps
3873          * directly to the enum nl80211_band values used in cfg80211.
3874          */
3875         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
3876         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
3877                 enum nl80211_band band = nla_type(tx_rates);
3878                 int err;
3879
3880                 if (band < 0 || band >= NUM_NL80211_BANDS)
3881                         return -EINVAL;
3882                 sband = rdev->wiphy.bands[band];
3883                 if (sband == NULL)
3884                         return -EINVAL;
3885                 err = nla_parse_nested(tb, NL80211_TXRATE_MAX, tx_rates,
3886                                        nl80211_txattr_policy, info->extack);
3887                 if (err)
3888                         return err;
3889                 if (tb[NL80211_TXRATE_LEGACY]) {
3890                         mask->control[band].legacy = rateset_to_mask(
3891                                 sband,
3892                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
3893                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
3894                         if ((mask->control[band].legacy == 0) &&
3895                             nla_len(tb[NL80211_TXRATE_LEGACY]))
3896                                 return -EINVAL;
3897                 }
3898                 if (tb[NL80211_TXRATE_HT]) {
3899                         if (!ht_rateset_to_mask(
3900                                         sband,
3901                                         nla_data(tb[NL80211_TXRATE_HT]),
3902                                         nla_len(tb[NL80211_TXRATE_HT]),
3903                                         mask->control[band].ht_mcs))
3904                                 return -EINVAL;
3905                 }
3906                 if (tb[NL80211_TXRATE_VHT]) {
3907                         if (!vht_set_mcs_mask(
3908                                         sband,
3909                                         nla_data(tb[NL80211_TXRATE_VHT]),
3910                                         mask->control[band].vht_mcs))
3911                                 return -EINVAL;
3912                 }
3913                 if (tb[NL80211_TXRATE_GI]) {
3914                         mask->control[band].gi =
3915                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
3916                         if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
3917                                 return -EINVAL;
3918                 }
3919
3920                 if (mask->control[band].legacy == 0) {
3921                         /* don't allow empty legacy rates if HT or VHT
3922                          * are not even supported.
3923                          */
3924                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
3925                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
3926                                 return -EINVAL;
3927
3928                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
3929                                 if (mask->control[band].ht_mcs[i])
3930                                         goto out;
3931
3932                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
3933                                 if (mask->control[band].vht_mcs[i])
3934                                         goto out;
3935
3936                         /* legacy and mcs rates may not be both empty */
3937                         return -EINVAL;
3938                 }
3939         }
3940
3941 out:
3942         return 0;
3943 }
3944
3945 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
3946                                    enum nl80211_band band,
3947                                    struct cfg80211_bitrate_mask *beacon_rate)
3948 {
3949         u32 count_ht, count_vht, i;
3950         u32 rate = beacon_rate->control[band].legacy;
3951
3952         /* Allow only one rate */
3953         if (hweight32(rate) > 1)
3954                 return -EINVAL;
3955
3956         count_ht = 0;
3957         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3958                 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
3959                         return -EINVAL;
3960                 } else if (beacon_rate->control[band].ht_mcs[i]) {
3961                         count_ht++;
3962                         if (count_ht > 1)
3963                                 return -EINVAL;
3964                 }
3965                 if (count_ht && rate)
3966                         return -EINVAL;
3967         }
3968
3969         count_vht = 0;
3970         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3971                 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
3972                         return -EINVAL;
3973                 } else if (beacon_rate->control[band].vht_mcs[i]) {
3974                         count_vht++;
3975                         if (count_vht > 1)
3976                                 return -EINVAL;
3977                 }
3978                 if (count_vht && rate)
3979                         return -EINVAL;
3980         }
3981
3982         if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht))
3983                 return -EINVAL;
3984
3985         if (rate &&
3986             !wiphy_ext_feature_isset(&rdev->wiphy,
3987                                      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
3988                 return -EINVAL;
3989         if (count_ht &&
3990             !wiphy_ext_feature_isset(&rdev->wiphy,
3991                                      NL80211_EXT_FEATURE_BEACON_RATE_HT))
3992                 return -EINVAL;
3993         if (count_vht &&
3994             !wiphy_ext_feature_isset(&rdev->wiphy,
3995                                      NL80211_EXT_FEATURE_BEACON_RATE_VHT))
3996                 return -EINVAL;
3997
3998         return 0;
3999 }
4000
4001 static int nl80211_parse_beacon(struct nlattr *attrs[],
4002                                 struct cfg80211_beacon_data *bcn)
4003 {
4004         bool haveinfo = false;
4005
4006         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
4007             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
4008             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
4009             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
4010                 return -EINVAL;
4011
4012         memset(bcn, 0, sizeof(*bcn));
4013
4014         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
4015                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
4016                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
4017                 if (!bcn->head_len)
4018                         return -EINVAL;
4019                 haveinfo = true;
4020         }
4021
4022         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
4023                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
4024                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
4025                 haveinfo = true;
4026         }
4027
4028         if (!haveinfo)
4029                 return -EINVAL;
4030
4031         if (attrs[NL80211_ATTR_IE]) {
4032                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
4033                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
4034         }
4035
4036         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
4037                 bcn->proberesp_ies =
4038                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4039                 bcn->proberesp_ies_len =
4040                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4041         }
4042
4043         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
4044                 bcn->assocresp_ies =
4045                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4046                 bcn->assocresp_ies_len =
4047                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4048         }
4049
4050         if (attrs[NL80211_ATTR_PROBE_RESP]) {
4051                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
4052                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
4053         }
4054
4055         return 0;
4056 }
4057
4058 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
4059                                             const u8 *rates)
4060 {
4061         int i;
4062
4063         if (!rates)
4064                 return;
4065
4066         for (i = 0; i < rates[1]; i++) {
4067                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
4068                         params->ht_required = true;
4069                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
4070                         params->vht_required = true;
4071         }
4072 }
4073
4074 /*
4075  * Since the nl80211 API didn't include, from the beginning, attributes about
4076  * HT/VHT requirements/capabilities, we parse them out of the IEs for the
4077  * benefit of drivers that rebuild IEs in the firmware.
4078  */
4079 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
4080 {
4081         const struct cfg80211_beacon_data *bcn = &params->beacon;
4082         size_t ies_len = bcn->tail_len;
4083         const u8 *ies = bcn->tail;
4084         const u8 *rates;
4085         const u8 *cap;
4086
4087         rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len);
4088         nl80211_check_ap_rate_selectors(params, rates);
4089
4090         rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
4091         nl80211_check_ap_rate_selectors(params, rates);
4092
4093         cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len);
4094         if (cap && cap[1] >= sizeof(*params->ht_cap))
4095                 params->ht_cap = (void *)(cap + 2);
4096         cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
4097         if (cap && cap[1] >= sizeof(*params->vht_cap))
4098                 params->vht_cap = (void *)(cap + 2);
4099 }
4100
4101 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
4102                                    struct cfg80211_ap_settings *params)
4103 {
4104         struct wireless_dev *wdev;
4105         bool ret = false;
4106
4107         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
4108                 if (wdev->iftype != NL80211_IFTYPE_AP &&
4109                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
4110                         continue;
4111
4112                 if (!wdev->preset_chandef.chan)
4113                         continue;
4114
4115                 params->chandef = wdev->preset_chandef;
4116                 ret = true;
4117                 break;
4118         }
4119
4120         return ret;
4121 }
4122
4123 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
4124                                     enum nl80211_auth_type auth_type,
4125                                     enum nl80211_commands cmd)
4126 {
4127         if (auth_type > NL80211_AUTHTYPE_MAX)
4128                 return false;
4129
4130         switch (cmd) {
4131         case NL80211_CMD_AUTHENTICATE:
4132                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
4133                     auth_type == NL80211_AUTHTYPE_SAE)
4134                         return false;
4135                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
4136                                              NL80211_EXT_FEATURE_FILS_STA) &&
4137                     (auth_type == NL80211_AUTHTYPE_FILS_SK ||
4138                      auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4139                      auth_type == NL80211_AUTHTYPE_FILS_PK))
4140                         return false;
4141                 return true;
4142         case NL80211_CMD_CONNECT:
4143                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
4144                     auth_type == NL80211_AUTHTYPE_SAE)
4145                         return false;
4146
4147                 /* FILS with SK PFS or PK not supported yet */
4148                 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4149                     auth_type == NL80211_AUTHTYPE_FILS_PK)
4150                         return false;
4151                 if (!wiphy_ext_feature_isset(
4152                             &rdev->wiphy,
4153                             NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
4154                     auth_type == NL80211_AUTHTYPE_FILS_SK)
4155                         return false;
4156                 return true;
4157         case NL80211_CMD_START_AP:
4158                 /* SAE not supported yet */
4159                 if (auth_type == NL80211_AUTHTYPE_SAE)
4160                         return false;
4161                 /* FILS not supported yet */
4162                 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
4163                     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4164                     auth_type == NL80211_AUTHTYPE_FILS_PK)
4165                         return false;
4166                 return true;
4167         default:
4168                 return false;
4169         }
4170 }
4171
4172 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
4173 {
4174         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4175         struct net_device *dev = info->user_ptr[1];
4176         struct wireless_dev *wdev = dev->ieee80211_ptr;
4177         struct cfg80211_ap_settings params;
4178         int err;
4179
4180         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4181             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4182                 return -EOPNOTSUPP;
4183
4184         if (!rdev->ops->start_ap)
4185                 return -EOPNOTSUPP;
4186
4187         if (wdev->beacon_interval)
4188                 return -EALREADY;
4189
4190         memset(&params, 0, sizeof(params));
4191
4192         /* these are required for START_AP */
4193         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
4194             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
4195             !info->attrs[NL80211_ATTR_BEACON_HEAD])
4196                 return -EINVAL;
4197
4198         err = nl80211_parse_beacon(info->attrs, &params.beacon);
4199         if (err)
4200                 return err;
4201
4202         params.beacon_interval =
4203                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
4204         params.dtim_period =
4205                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
4206
4207         err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
4208                                            params.beacon_interval);
4209         if (err)
4210                 return err;
4211
4212         /*
4213          * In theory, some of these attributes should be required here
4214          * but since they were not used when the command was originally
4215          * added, keep them optional for old user space programs to let
4216          * them continue to work with drivers that do not need the
4217          * additional information -- drivers must check!
4218          */
4219         if (info->attrs[NL80211_ATTR_SSID]) {
4220                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4221                 params.ssid_len =
4222                         nla_len(info->attrs[NL80211_ATTR_SSID]);
4223                 if (params.ssid_len == 0 ||
4224                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
4225                         return -EINVAL;
4226         }
4227
4228         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
4229                 params.hidden_ssid = nla_get_u32(
4230                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
4231                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
4232                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
4233                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
4234                         return -EINVAL;
4235         }
4236
4237         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
4238
4239         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4240                 params.auth_type = nla_get_u32(
4241                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
4242                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
4243                                              NL80211_CMD_START_AP))
4244                         return -EINVAL;
4245         } else
4246                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4247
4248         err = nl80211_crypto_settings(rdev, info, &params.crypto,
4249                                       NL80211_MAX_NR_CIPHER_SUITES);
4250         if (err)
4251                 return err;
4252
4253         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
4254                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
4255                         return -EOPNOTSUPP;
4256                 params.inactivity_timeout = nla_get_u16(
4257                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
4258         }
4259
4260         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4261                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4262                         return -EINVAL;
4263                 params.p2p_ctwindow =
4264                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4265                 if (params.p2p_ctwindow > 127)
4266                         return -EINVAL;
4267                 if (params.p2p_ctwindow != 0 &&
4268                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4269                         return -EINVAL;
4270         }
4271
4272         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4273                 u8 tmp;
4274
4275                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4276                         return -EINVAL;
4277                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4278                 if (tmp > 1)
4279                         return -EINVAL;
4280                 params.p2p_opp_ps = tmp;
4281                 if (params.p2p_opp_ps != 0 &&
4282                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4283                         return -EINVAL;
4284         }
4285
4286         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4287                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
4288                 if (err)
4289                         return err;
4290         } else if (wdev->preset_chandef.chan) {
4291                 params.chandef = wdev->preset_chandef;
4292         } else if (!nl80211_get_ap_channel(rdev, &params))
4293                 return -EINVAL;
4294
4295         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
4296                                            wdev->iftype))
4297                 return -EINVAL;
4298
4299         if (info->attrs[NL80211_ATTR_TX_RATES]) {
4300                 err = nl80211_parse_tx_bitrate_mask(info, &params.beacon_rate);
4301                 if (err)
4302                         return err;
4303
4304                 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
4305                                               &params.beacon_rate);
4306                 if (err)
4307                         return err;
4308         }
4309
4310         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
4311                 params.smps_mode =
4312                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
4313                 switch (params.smps_mode) {
4314                 case NL80211_SMPS_OFF:
4315                         break;
4316                 case NL80211_SMPS_STATIC:
4317                         if (!(rdev->wiphy.features &
4318                               NL80211_FEATURE_STATIC_SMPS))
4319                                 return -EINVAL;
4320                         break;
4321                 case NL80211_SMPS_DYNAMIC:
4322                         if (!(rdev->wiphy.features &
4323                               NL80211_FEATURE_DYNAMIC_SMPS))
4324                                 return -EINVAL;
4325                         break;
4326                 default:
4327                         return -EINVAL;
4328                 }
4329         } else {
4330                 params.smps_mode = NL80211_SMPS_OFF;
4331         }
4332
4333         params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
4334         if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
4335                 return -EOPNOTSUPP;
4336
4337         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
4338                 params.acl = parse_acl_data(&rdev->wiphy, info);
4339                 if (IS_ERR(params.acl))
4340                         return PTR_ERR(params.acl);
4341         }
4342
4343         nl80211_calculate_ap_params(&params);
4344
4345         wdev_lock(wdev);
4346         err = rdev_start_ap(rdev, dev, &params);
4347         if (!err) {
4348                 wdev->preset_chandef = params.chandef;
4349                 wdev->beacon_interval = params.beacon_interval;
4350                 wdev->chandef = params.chandef;
4351                 wdev->ssid_len = params.ssid_len;
4352                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
4353
4354                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4355                         wdev->conn_owner_nlportid = info->snd_portid;
4356         }
4357         wdev_unlock(wdev);
4358
4359         kfree(params.acl);
4360
4361         return err;
4362 }
4363
4364 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
4365 {
4366         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4367         struct net_device *dev = info->user_ptr[1];
4368         struct wireless_dev *wdev = dev->ieee80211_ptr;
4369         struct cfg80211_beacon_data params;
4370         int err;
4371
4372         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4373             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4374                 return -EOPNOTSUPP;
4375
4376         if (!rdev->ops->change_beacon)
4377                 return -EOPNOTSUPP;
4378
4379         if (!wdev->beacon_interval)
4380                 return -EINVAL;
4381
4382         err = nl80211_parse_beacon(info->attrs, &params);
4383         if (err)
4384                 return err;
4385
4386         wdev_lock(wdev);
4387         err = rdev_change_beacon(rdev, dev, &params);
4388         wdev_unlock(wdev);
4389
4390         return err;
4391 }
4392
4393 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
4394 {
4395         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4396         struct net_device *dev = info->user_ptr[1];
4397
4398         return cfg80211_stop_ap(rdev, dev, false);
4399 }
4400
4401 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
4402         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
4403         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
4404         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
4405         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
4406         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
4407         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
4408 };
4409
4410 static int parse_station_flags(struct genl_info *info,
4411                                enum nl80211_iftype iftype,
4412                                struct station_parameters *params)
4413 {
4414         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
4415         struct nlattr *nla;
4416         int flag;
4417
4418         /*
4419          * Try parsing the new attribute first so userspace
4420          * can specify both for older kernels.
4421          */
4422         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
4423         if (nla) {
4424                 struct nl80211_sta_flag_update *sta_flags;
4425
4426                 sta_flags = nla_data(nla);
4427                 params->sta_flags_mask = sta_flags->mask;
4428                 params->sta_flags_set = sta_flags->set;
4429                 params->sta_flags_set &= params->sta_flags_mask;
4430                 if ((params->sta_flags_mask |
4431                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
4432                         return -EINVAL;
4433                 return 0;
4434         }
4435
4436         /* if present, parse the old attribute */
4437
4438         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
4439         if (!nla)
4440                 return 0;
4441
4442         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX, nla,
4443                              sta_flags_policy, info->extack))
4444                 return -EINVAL;
4445
4446         /*
4447          * Only allow certain flags for interface types so that
4448          * other attributes are silently ignored. Remember that
4449          * this is backward compatibility code with old userspace
4450          * and shouldn't be hit in other cases anyway.
4451          */
4452         switch (iftype) {
4453         case NL80211_IFTYPE_AP:
4454         case NL80211_IFTYPE_AP_VLAN:
4455         case NL80211_IFTYPE_P2P_GO:
4456                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4457                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4458                                          BIT(NL80211_STA_FLAG_WME) |
4459                                          BIT(NL80211_STA_FLAG_MFP);
4460                 break;
4461         case NL80211_IFTYPE_P2P_CLIENT:
4462         case NL80211_IFTYPE_STATION:
4463                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4464                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
4465                 break;
4466         case NL80211_IFTYPE_MESH_POINT:
4467                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4468                                          BIT(NL80211_STA_FLAG_MFP) |
4469                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
4470                 break;
4471         default:
4472                 return -EINVAL;
4473         }
4474
4475         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
4476                 if (flags[flag]) {
4477                         params->sta_flags_set |= (1<<flag);
4478
4479                         /* no longer support new API additions in old API */
4480                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
4481                                 return -EINVAL;
4482                 }
4483         }
4484
4485         return 0;
4486 }
4487
4488 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
4489                                  int attr)
4490 {
4491         struct nlattr *rate;
4492         u32 bitrate;
4493         u16 bitrate_compat;
4494         enum nl80211_rate_info rate_flg;
4495
4496         rate = nla_nest_start(msg, attr);
4497         if (!rate)
4498                 return false;
4499
4500         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
4501         bitrate = cfg80211_calculate_bitrate(info);
4502         /* report 16-bit bitrate only if we can */
4503         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
4504         if (bitrate > 0 &&
4505             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
4506                 return false;
4507         if (bitrate_compat > 0 &&
4508             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
4509                 return false;
4510
4511         switch (info->bw) {
4512         case RATE_INFO_BW_5:
4513                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
4514                 break;
4515         case RATE_INFO_BW_10:
4516                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
4517                 break;
4518         default:
4519                 WARN_ON(1);
4520                 /* fall through */
4521         case RATE_INFO_BW_20:
4522                 rate_flg = 0;
4523                 break;
4524         case RATE_INFO_BW_40:
4525                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
4526                 break;
4527         case RATE_INFO_BW_80:
4528                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
4529                 break;
4530         case RATE_INFO_BW_160:
4531                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
4532                 break;
4533         case RATE_INFO_BW_HE_RU:
4534                 rate_flg = 0;
4535                 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
4536         }
4537
4538         if (rate_flg && nla_put_flag(msg, rate_flg))
4539                 return false;
4540
4541         if (info->flags & RATE_INFO_FLAGS_MCS) {
4542                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
4543                         return false;
4544                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4545                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4546                         return false;
4547         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
4548                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
4549                         return false;
4550                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
4551                         return false;
4552                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4553                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4554                         return false;
4555         } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
4556                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
4557                         return false;
4558                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
4559                         return false;
4560                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
4561                         return false;
4562                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
4563                         return false;
4564                 if (info->bw == RATE_INFO_BW_HE_RU &&
4565                     nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
4566                                info->he_ru_alloc))
4567                         return false;
4568         }
4569
4570         nla_nest_end(msg, rate);
4571         return true;
4572 }
4573
4574 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
4575                                int id)
4576 {
4577         void *attr;
4578         int i = 0;
4579
4580         if (!mask)
4581                 return true;
4582
4583         attr = nla_nest_start(msg, id);
4584         if (!attr)
4585                 return false;
4586
4587         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
4588                 if (!(mask & BIT(i)))
4589                         continue;
4590
4591                 if (nla_put_u8(msg, i, signal[i]))
4592                         return false;
4593         }
4594
4595         nla_nest_end(msg, attr);
4596
4597         return true;
4598 }
4599
4600 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
4601                                 u32 seq, int flags,
4602                                 struct cfg80211_registered_device *rdev,
4603                                 struct net_device *dev,
4604                                 const u8 *mac_addr, struct station_info *sinfo)
4605 {
4606         void *hdr;
4607         struct nlattr *sinfoattr, *bss_param;
4608
4609         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
4610         if (!hdr)
4611                 return -1;
4612
4613         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4614             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
4615             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
4616                 goto nla_put_failure;
4617
4618         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
4619         if (!sinfoattr)
4620                 goto nla_put_failure;
4621
4622 #define PUT_SINFO(attr, memb, type) do {                                \
4623         BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
4624         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
4625             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
4626                              sinfo->memb))                              \
4627                 goto nla_put_failure;                                   \
4628         } while (0)
4629 #define PUT_SINFO_U64(attr, memb) do {                                  \
4630         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
4631             nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
4632                               sinfo->memb, NL80211_STA_INFO_PAD))       \
4633                 goto nla_put_failure;                                   \
4634         } while (0)
4635
4636         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
4637         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
4638
4639         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
4640                              BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
4641             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
4642                         (u32)sinfo->rx_bytes))
4643                 goto nla_put_failure;
4644
4645         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
4646                              BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
4647             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
4648                         (u32)sinfo->tx_bytes))
4649                 goto nla_put_failure;
4650
4651         PUT_SINFO_U64(RX_BYTES64, rx_bytes);
4652         PUT_SINFO_U64(TX_BYTES64, tx_bytes);
4653         PUT_SINFO(LLID, llid, u16);
4654         PUT_SINFO(PLID, plid, u16);
4655         PUT_SINFO(PLINK_STATE, plink_state, u8);
4656         PUT_SINFO_U64(RX_DURATION, rx_duration);
4657
4658         switch (rdev->wiphy.signal_type) {
4659         case CFG80211_SIGNAL_TYPE_MBM:
4660                 PUT_SINFO(SIGNAL, signal, u8);
4661                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
4662                 break;
4663         default:
4664                 break;
4665         }
4666         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
4667                 if (!nl80211_put_signal(msg, sinfo->chains,
4668                                         sinfo->chain_signal,
4669                                         NL80211_STA_INFO_CHAIN_SIGNAL))
4670                         goto nla_put_failure;
4671         }
4672         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
4673                 if (!nl80211_put_signal(msg, sinfo->chains,
4674                                         sinfo->chain_signal_avg,
4675                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
4676                         goto nla_put_failure;
4677         }
4678         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
4679                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
4680                                           NL80211_STA_INFO_TX_BITRATE))
4681                         goto nla_put_failure;
4682         }
4683         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
4684                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
4685                                           NL80211_STA_INFO_RX_BITRATE))
4686                         goto nla_put_failure;
4687         }
4688
4689         PUT_SINFO(RX_PACKETS, rx_packets, u32);
4690         PUT_SINFO(TX_PACKETS, tx_packets, u32);
4691         PUT_SINFO(TX_RETRIES, tx_retries, u32);
4692         PUT_SINFO(TX_FAILED, tx_failed, u32);
4693         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
4694         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
4695         PUT_SINFO(LOCAL_PM, local_pm, u32);
4696         PUT_SINFO(PEER_PM, peer_pm, u32);
4697         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
4698
4699         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
4700                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
4701                 if (!bss_param)
4702                         goto nla_put_failure;
4703
4704                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
4705                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
4706                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
4707                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
4708                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
4709                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
4710                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
4711                                sinfo->bss_param.dtim_period) ||
4712                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
4713                                 sinfo->bss_param.beacon_interval))
4714                         goto nla_put_failure;
4715
4716                 nla_nest_end(msg, bss_param);
4717         }
4718         if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
4719             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
4720                     sizeof(struct nl80211_sta_flag_update),
4721                     &sinfo->sta_flags))
4722                 goto nla_put_failure;
4723
4724         PUT_SINFO_U64(T_OFFSET, t_offset);
4725         PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
4726         PUT_SINFO_U64(BEACON_RX, rx_beacon);
4727         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
4728         PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
4729         if (wiphy_ext_feature_isset(&rdev->wiphy,
4730                                     NL80211_EXT_FEATURE_DATA_ACK_SIGNAL_SUPPORT))
4731                 PUT_SINFO(DATA_ACK_SIGNAL_AVG, avg_ack_signal, s8);
4732
4733 #undef PUT_SINFO
4734 #undef PUT_SINFO_U64
4735
4736         if (sinfo->pertid) {
4737                 struct nlattr *tidsattr;
4738                 int tid;
4739
4740                 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS);
4741                 if (!tidsattr)
4742                         goto nla_put_failure;
4743
4744                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
4745                         struct cfg80211_tid_stats *tidstats;
4746                         struct nlattr *tidattr;
4747
4748                         tidstats = &sinfo->pertid[tid];
4749
4750                         if (!tidstats->filled)
4751                                 continue;
4752
4753                         tidattr = nla_nest_start(msg, tid + 1);
4754                         if (!tidattr)
4755                                 goto nla_put_failure;
4756
4757 #define PUT_TIDVAL_U64(attr, memb) do {                                 \
4758         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
4759             nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,          \
4760                               tidstats->memb, NL80211_TID_STATS_PAD))   \
4761                 goto nla_put_failure;                                   \
4762         } while (0)
4763
4764                         PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
4765                         PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
4766                         PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
4767                         PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
4768
4769 #undef PUT_TIDVAL_U64
4770                         if ((tidstats->filled &
4771                              BIT(NL80211_TID_STATS_TXQ_STATS)) &&
4772                             !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
4773                                                    NL80211_TID_STATS_TXQ_STATS))
4774                                 goto nla_put_failure;
4775
4776                         nla_nest_end(msg, tidattr);
4777                 }
4778
4779                 nla_nest_end(msg, tidsattr);
4780         }
4781
4782         nla_nest_end(msg, sinfoattr);
4783
4784         if (sinfo->assoc_req_ies_len &&
4785             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
4786                     sinfo->assoc_req_ies))
4787                 goto nla_put_failure;
4788
4789         cfg80211_sinfo_release_content(sinfo);
4790         genlmsg_end(msg, hdr);
4791         return 0;
4792
4793  nla_put_failure:
4794         cfg80211_sinfo_release_content(sinfo);
4795         genlmsg_cancel(msg, hdr);
4796         return -EMSGSIZE;
4797 }
4798
4799 static int nl80211_dump_station(struct sk_buff *skb,
4800                                 struct netlink_callback *cb)
4801 {
4802         struct station_info sinfo;
4803         struct cfg80211_registered_device *rdev;
4804         struct wireless_dev *wdev;
4805         u8 mac_addr[ETH_ALEN];
4806         int sta_idx = cb->args[2];
4807         int err;
4808
4809         rtnl_lock();
4810         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4811         if (err)
4812                 goto out_err;
4813
4814         if (!wdev->netdev) {
4815                 err = -EINVAL;
4816                 goto out_err;
4817         }
4818
4819         if (!rdev->ops->dump_station) {
4820                 err = -EOPNOTSUPP;
4821                 goto out_err;
4822         }
4823
4824         while (1) {
4825                 memset(&sinfo, 0, sizeof(sinfo));
4826                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
4827                                         mac_addr, &sinfo);
4828                 if (err == -ENOENT)
4829                         break;
4830                 if (err)
4831                         goto out_err;
4832
4833                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
4834                                 NETLINK_CB(cb->skb).portid,
4835                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4836                                 rdev, wdev->netdev, mac_addr,
4837                                 &sinfo) < 0)
4838                         goto out;
4839
4840                 sta_idx++;
4841         }
4842
4843  out:
4844         cb->args[2] = sta_idx;
4845         err = skb->len;
4846  out_err:
4847         rtnl_unlock();
4848
4849         return err;
4850 }
4851
4852 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
4853 {
4854         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4855         struct net_device *dev = info->user_ptr[1];
4856         struct station_info sinfo;
4857         struct sk_buff *msg;
4858         u8 *mac_addr = NULL;
4859         int err;
4860
4861         memset(&sinfo, 0, sizeof(sinfo));
4862
4863         if (!info->attrs[NL80211_ATTR_MAC])
4864                 return -EINVAL;
4865
4866         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4867
4868         if (!rdev->ops->get_station)
4869                 return -EOPNOTSUPP;
4870
4871         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
4872         if (err)
4873                 return err;
4874
4875         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4876         if (!msg) {
4877                 cfg80211_sinfo_release_content(&sinfo);
4878                 return -ENOMEM;
4879         }
4880
4881         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
4882                                  info->snd_portid, info->snd_seq, 0,
4883                                  rdev, dev, mac_addr, &sinfo) < 0) {
4884                 nlmsg_free(msg);
4885                 return -ENOBUFS;
4886         }
4887
4888         return genlmsg_reply(msg, info);
4889 }
4890
4891 int cfg80211_check_station_change(struct wiphy *wiphy,
4892                                   struct station_parameters *params,
4893                                   enum cfg80211_station_type statype)
4894 {
4895         if (params->listen_interval != -1 &&
4896             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4897                 return -EINVAL;
4898
4899         if (params->support_p2p_ps != -1 &&
4900             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4901                 return -EINVAL;
4902
4903         if (params->aid &&
4904             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
4905             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4906                 return -EINVAL;
4907
4908         /* When you run into this, adjust the code below for the new flag */
4909         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4910
4911         switch (statype) {
4912         case CFG80211_STA_MESH_PEER_KERNEL:
4913         case CFG80211_STA_MESH_PEER_USER:
4914                 /*
4915                  * No ignoring the TDLS flag here -- the userspace mesh
4916                  * code doesn't have the bug of including TDLS in the
4917                  * mask everywhere.
4918                  */
4919                 if (params->sta_flags_mask &
4920                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4921                                   BIT(NL80211_STA_FLAG_MFP) |
4922                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
4923                         return -EINVAL;
4924                 break;
4925         case CFG80211_STA_TDLS_PEER_SETUP:
4926         case CFG80211_STA_TDLS_PEER_ACTIVE:
4927                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4928                         return -EINVAL;
4929                 /* ignore since it can't change */
4930                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4931                 break;
4932         default:
4933                 /* disallow mesh-specific things */
4934                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
4935                         return -EINVAL;
4936                 if (params->local_pm)
4937                         return -EINVAL;
4938                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4939                         return -EINVAL;
4940         }
4941
4942         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4943             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
4944                 /* TDLS can't be set, ... */
4945                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4946                         return -EINVAL;
4947                 /*
4948                  * ... but don't bother the driver with it. This works around
4949                  * a hostapd/wpa_supplicant issue -- it always includes the
4950                  * TLDS_PEER flag in the mask even for AP mode.
4951                  */
4952                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4953         }
4954
4955         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4956             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4957                 /* reject other things that can't change */
4958                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
4959                         return -EINVAL;
4960                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
4961                         return -EINVAL;
4962                 if (params->supported_rates)
4963                         return -EINVAL;
4964                 if (params->ext_capab || params->ht_capa || params->vht_capa ||
4965                     params->he_capa)
4966                         return -EINVAL;
4967         }
4968
4969         if (statype != CFG80211_STA_AP_CLIENT &&
4970             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4971                 if (params->vlan)
4972                         return -EINVAL;
4973         }
4974
4975         switch (statype) {
4976         case CFG80211_STA_AP_MLME_CLIENT:
4977                 /* Use this only for authorizing/unauthorizing a station */
4978                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4979                         return -EOPNOTSUPP;
4980                 break;
4981         case CFG80211_STA_AP_CLIENT:
4982         case CFG80211_STA_AP_CLIENT_UNASSOC:
4983                 /* accept only the listed bits */
4984                 if (params->sta_flags_mask &
4985                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4986                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4987                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
4988                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4989                                   BIT(NL80211_STA_FLAG_WME) |
4990                                   BIT(NL80211_STA_FLAG_MFP)))
4991                         return -EINVAL;
4992
4993                 /* but authenticated/associated only if driver handles it */
4994                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4995                     params->sta_flags_mask &
4996                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4997                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4998                         return -EINVAL;
4999                 break;
5000         case CFG80211_STA_IBSS:
5001         case CFG80211_STA_AP_STA:
5002                 /* reject any changes other than AUTHORIZED */
5003                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
5004                         return -EINVAL;
5005                 break;
5006         case CFG80211_STA_TDLS_PEER_SETUP:
5007                 /* reject any changes other than AUTHORIZED or WME */
5008                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
5009                                                BIT(NL80211_STA_FLAG_WME)))
5010                         return -EINVAL;
5011                 /* force (at least) rates when authorizing */
5012                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
5013                     !params->supported_rates)
5014                         return -EINVAL;
5015                 break;
5016         case CFG80211_STA_TDLS_PEER_ACTIVE:
5017                 /* reject any changes */
5018                 return -EINVAL;
5019         case CFG80211_STA_MESH_PEER_KERNEL:
5020                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
5021                         return -EINVAL;
5022                 break;
5023         case CFG80211_STA_MESH_PEER_USER:
5024                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
5025                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
5026                         return -EINVAL;
5027                 break;
5028         }
5029
5030         /*
5031          * Older kernel versions ignored this attribute entirely, so don't
5032          * reject attempts to update it but mark it as unused instead so the
5033          * driver won't look at the data.
5034          */
5035         if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
5036             statype != CFG80211_STA_TDLS_PEER_SETUP)
5037                 params->opmode_notif_used = false;
5038
5039         return 0;
5040 }
5041 EXPORT_SYMBOL(cfg80211_check_station_change);
5042
5043 /*
5044  * Get vlan interface making sure it is running and on the right wiphy.
5045  */
5046 static struct net_device *get_vlan(struct genl_info *info,
5047                                    struct cfg80211_registered_device *rdev)
5048 {
5049         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
5050         struct net_device *v;
5051         int ret;
5052
5053         if (!vlanattr)
5054                 return NULL;
5055
5056         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
5057         if (!v)
5058                 return ERR_PTR(-ENODEV);
5059
5060         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
5061                 ret = -EINVAL;
5062                 goto error;
5063         }
5064
5065         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5066             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5067             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
5068                 ret = -EINVAL;
5069                 goto error;
5070         }
5071
5072         if (!netif_running(v)) {
5073                 ret = -ENETDOWN;
5074                 goto error;
5075         }
5076
5077         return v;
5078  error:
5079         dev_put(v);
5080         return ERR_PTR(ret);
5081 }
5082
5083 static const struct nla_policy
5084 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
5085         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
5086         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
5087 };
5088
5089 static int nl80211_parse_sta_wme(struct genl_info *info,
5090                                  struct station_parameters *params)
5091 {
5092         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
5093         struct nlattr *nla;
5094         int err;
5095
5096         /* parse WME attributes if present */
5097         if (!info->attrs[NL80211_ATTR_STA_WME])
5098                 return 0;
5099
5100         nla = info->attrs[NL80211_ATTR_STA_WME];
5101         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
5102                                nl80211_sta_wme_policy, info->extack);
5103         if (err)
5104                 return err;
5105
5106         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
5107                 params->uapsd_queues = nla_get_u8(
5108                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
5109         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
5110                 return -EINVAL;
5111
5112         if (tb[NL80211_STA_WME_MAX_SP])
5113                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
5114
5115         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
5116                 return -EINVAL;
5117
5118         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
5119
5120         return 0;
5121 }
5122
5123 static int nl80211_parse_sta_channel_info(struct genl_info *info,
5124                                       struct station_parameters *params)
5125 {
5126         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
5127                 params->supported_channels =
5128                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
5129                 params->supported_channels_len =
5130                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
5131                 /*
5132                  * Need to include at least one (first channel, number of
5133                  * channels) tuple for each subband, and must have proper
5134                  * tuples for the rest of the data as well.
5135                  */
5136                 if (params->supported_channels_len < 2)
5137                         return -EINVAL;
5138                 if (params->supported_channels_len % 2)
5139                         return -EINVAL;
5140         }
5141
5142         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
5143                 params->supported_oper_classes =
5144                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
5145                 params->supported_oper_classes_len =
5146                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
5147                 /*
5148                  * The value of the Length field of the Supported Operating
5149                  * Classes element is between 2 and 253.
5150                  */
5151                 if (params->supported_oper_classes_len < 2 ||
5152                     params->supported_oper_classes_len > 253)
5153                         return -EINVAL;
5154         }
5155         return 0;
5156 }
5157
5158 static int nl80211_set_station_tdls(struct genl_info *info,
5159                                     struct station_parameters *params)
5160 {
5161         int err;
5162         /* Dummy STA entry gets updated once the peer capabilities are known */
5163         if (info->attrs[NL80211_ATTR_PEER_AID])
5164                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5165         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5166                 params->ht_capa =
5167                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5168         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5169                 params->vht_capa =
5170                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5171         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
5172                 params->he_capa =
5173                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5174                 params->he_capa_len =
5175                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5176
5177                 if (params->he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN)
5178                         return -EINVAL;
5179         }
5180
5181         err = nl80211_parse_sta_channel_info(info, params);
5182         if (err)
5183                 return err;
5184
5185         return nl80211_parse_sta_wme(info, params);
5186 }
5187
5188 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
5189 {
5190         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5191         struct net_device *dev = info->user_ptr[1];
5192         struct station_parameters params;
5193         u8 *mac_addr;
5194         int err;
5195
5196         memset(&params, 0, sizeof(params));
5197
5198         if (!rdev->ops->change_station)
5199                 return -EOPNOTSUPP;
5200
5201         /*
5202          * AID and listen_interval properties can be set only for unassociated
5203          * station. Include these parameters here and will check them in
5204          * cfg80211_check_station_change().
5205          */
5206         if (info->attrs[NL80211_ATTR_STA_AID])
5207                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5208
5209         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5210                 params.listen_interval =
5211                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5212         else
5213                 params.listen_interval = -1;
5214
5215         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
5216                 u8 tmp;
5217
5218                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5219                 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
5220                         return -EINVAL;
5221
5222                 params.support_p2p_ps = tmp;
5223         } else {
5224                 params.support_p2p_ps = -1;
5225         }
5226
5227         if (!info->attrs[NL80211_ATTR_MAC])
5228                 return -EINVAL;
5229
5230         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5231
5232         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
5233                 params.supported_rates =
5234                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5235                 params.supported_rates_len =
5236                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5237         }
5238
5239         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5240                 params.capability =
5241                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5242                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5243         }
5244
5245         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5246                 params.ext_capab =
5247                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5248                 params.ext_capab_len =
5249                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5250         }
5251
5252         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5253                 return -EINVAL;
5254
5255         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
5256                 params.plink_action =
5257                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5258                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
5259                         return -EINVAL;
5260         }
5261
5262         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
5263                 params.plink_state =
5264                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
5265                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
5266                         return -EINVAL;
5267                 if (info->attrs[NL80211_ATTR_MESH_PEER_AID]) {
5268                         params.peer_aid = nla_get_u16(
5269                                 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
5270                         if (params.peer_aid > IEEE80211_MAX_AID)
5271                                 return -EINVAL;
5272                 }
5273                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
5274         }
5275
5276         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
5277                 enum nl80211_mesh_power_mode pm = nla_get_u32(
5278                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
5279
5280                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
5281                     pm > NL80211_MESH_POWER_MAX)
5282                         return -EINVAL;
5283
5284                 params.local_pm = pm;
5285         }
5286
5287         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5288                 params.opmode_notif_used = true;
5289                 params.opmode_notif =
5290                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5291         }
5292
5293         /* Include parameters for TDLS peer (will check later) */
5294         err = nl80211_set_station_tdls(info, &params);
5295         if (err)
5296                 return err;
5297
5298         params.vlan = get_vlan(info, rdev);
5299         if (IS_ERR(params.vlan))
5300                 return PTR_ERR(params.vlan);
5301
5302         switch (dev->ieee80211_ptr->iftype) {
5303         case NL80211_IFTYPE_AP:
5304         case NL80211_IFTYPE_AP_VLAN:
5305         case NL80211_IFTYPE_P2P_GO:
5306         case NL80211_IFTYPE_P2P_CLIENT:
5307         case NL80211_IFTYPE_STATION:
5308         case NL80211_IFTYPE_ADHOC:
5309         case NL80211_IFTYPE_MESH_POINT:
5310                 break;
5311         default:
5312                 err = -EOPNOTSUPP;
5313                 goto out_put_vlan;
5314         }
5315
5316         /* driver will call cfg80211_check_station_change() */
5317         err = rdev_change_station(rdev, dev, mac_addr, &params);
5318
5319  out_put_vlan:
5320         if (params.vlan)
5321                 dev_put(params.vlan);
5322
5323         return err;
5324 }
5325
5326 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
5327 {
5328         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5329         int err;
5330         struct net_device *dev = info->user_ptr[1];
5331         struct station_parameters params;
5332         u8 *mac_addr = NULL;
5333         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5334                          BIT(NL80211_STA_FLAG_ASSOCIATED);
5335
5336         memset(&params, 0, sizeof(params));
5337
5338         if (!rdev->ops->add_station)
5339                 return -EOPNOTSUPP;
5340
5341         if (!info->attrs[NL80211_ATTR_MAC])
5342                 return -EINVAL;
5343
5344         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5345                 return -EINVAL;
5346
5347         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
5348                 return -EINVAL;
5349
5350         if (!info->attrs[NL80211_ATTR_STA_AID] &&
5351             !info->attrs[NL80211_ATTR_PEER_AID])
5352                 return -EINVAL;
5353
5354         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5355         params.supported_rates =
5356                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5357         params.supported_rates_len =
5358                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5359         params.listen_interval =
5360                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5361
5362         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
5363                 u8 tmp;
5364
5365                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5366                 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
5367                         return -EINVAL;
5368
5369                 params.support_p2p_ps = tmp;
5370         } else {
5371                 /*
5372                  * if not specified, assume it's supported for P2P GO interface,
5373                  * and is NOT supported for AP interface
5374                  */
5375                 params.support_p2p_ps =
5376                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
5377         }
5378
5379         if (info->attrs[NL80211_ATTR_PEER_AID])
5380                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5381         else
5382                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5383         if (!params.aid || params.aid > IEEE80211_MAX_AID)
5384                 return -EINVAL;
5385
5386         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5387                 params.capability =
5388                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5389                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5390         }
5391
5392         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5393                 params.ext_capab =
5394                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5395                 params.ext_capab_len =
5396                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5397         }
5398
5399         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5400                 params.ht_capa =
5401                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5402
5403         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5404                 params.vht_capa =
5405                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5406
5407         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
5408                 params.he_capa =
5409                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5410                 params.he_capa_len =
5411                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5412
5413                 /* max len is validated in nla policy */
5414                 if (params.he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN)
5415                         return -EINVAL;
5416         }
5417
5418         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5419                 params.opmode_notif_used = true;
5420                 params.opmode_notif =
5421                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5422         }
5423
5424         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
5425                 params.plink_action =
5426                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5427                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
5428                         return -EINVAL;
5429         }
5430
5431         err = nl80211_parse_sta_channel_info(info, &params);
5432         if (err)
5433                 return err;
5434
5435         err = nl80211_parse_sta_wme(info, &params);
5436         if (err)
5437                 return err;
5438
5439         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5440                 return -EINVAL;
5441
5442         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
5443          * as userspace might just pass through the capabilities from the IEs
5444          * directly, rather than enforcing this restriction and returning an
5445          * error in this case.
5446          */
5447         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
5448                 params.ht_capa = NULL;
5449                 params.vht_capa = NULL;
5450
5451                 /* HE requires WME */
5452                 if (params.he_capa_len)
5453                         return -EINVAL;
5454         }
5455
5456         /* When you run into this, adjust the code below for the new flag */
5457         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
5458
5459         switch (dev->ieee80211_ptr->iftype) {
5460         case NL80211_IFTYPE_AP:
5461         case NL80211_IFTYPE_AP_VLAN:
5462         case NL80211_IFTYPE_P2P_GO:
5463                 /* ignore WME attributes if iface/sta is not capable */
5464                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
5465                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
5466                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5467
5468                 /* TDLS peers cannot be added */
5469                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5470                     info->attrs[NL80211_ATTR_PEER_AID])
5471                         return -EINVAL;
5472                 /* but don't bother the driver with it */
5473                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5474
5475                 /* allow authenticated/associated only if driver handles it */
5476                 if (!(rdev->wiphy.features &
5477                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5478                     params.sta_flags_mask & auth_assoc)
5479                         return -EINVAL;
5480
5481                 /* Older userspace, or userspace wanting to be compatible with
5482                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
5483                  * and assoc flags in the mask, but assumes the station will be
5484                  * added as associated anyway since this was the required driver
5485                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
5486                  * introduced.
5487                  * In order to not bother drivers with this quirk in the API
5488                  * set the flags in both the mask and set for new stations in
5489                  * this case.
5490                  */
5491                 if (!(params.sta_flags_mask & auth_assoc)) {
5492                         params.sta_flags_mask |= auth_assoc;
5493                         params.sta_flags_set |= auth_assoc;
5494                 }
5495
5496                 /* must be last in here for error handling */
5497                 params.vlan = get_vlan(info, rdev);
5498                 if (IS_ERR(params.vlan))
5499                         return PTR_ERR(params.vlan);
5500                 break;
5501         case NL80211_IFTYPE_MESH_POINT:
5502                 /* ignore uAPSD data */
5503                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5504
5505                 /* associated is disallowed */
5506                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
5507                         return -EINVAL;
5508                 /* TDLS peers cannot be added */
5509                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5510                     info->attrs[NL80211_ATTR_PEER_AID])
5511                         return -EINVAL;
5512                 break;
5513         case NL80211_IFTYPE_STATION:
5514         case NL80211_IFTYPE_P2P_CLIENT:
5515                 /* ignore uAPSD data */
5516                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5517
5518                 /* these are disallowed */
5519                 if (params.sta_flags_mask &
5520                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
5521                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
5522                         return -EINVAL;
5523                 /* Only TDLS peers can be added */
5524                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
5525                         return -EINVAL;
5526                 /* Can only add if TDLS ... */
5527                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
5528                         return -EOPNOTSUPP;
5529                 /* ... with external setup is supported */
5530                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
5531                         return -EOPNOTSUPP;
5532                 /*
5533                  * Older wpa_supplicant versions always mark the TDLS peer
5534                  * as authorized, but it shouldn't yet be.
5535                  */
5536                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
5537                 break;
5538         default:
5539                 return -EOPNOTSUPP;
5540         }
5541
5542         /* be aware of params.vlan when changing code here */
5543
5544         err = rdev_add_station(rdev, dev, mac_addr, &params);
5545
5546         if (params.vlan)
5547                 dev_put(params.vlan);
5548         return err;
5549 }
5550
5551 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
5552 {
5553         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5554         struct net_device *dev = info->user_ptr[1];
5555         struct station_del_parameters params;
5556
5557         memset(&params, 0, sizeof(params));
5558
5559         if (info->attrs[NL80211_ATTR_MAC])
5560                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
5561
5562         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5563             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5564             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5565             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5566                 return -EINVAL;
5567
5568         if (!rdev->ops->del_station)
5569                 return -EOPNOTSUPP;
5570
5571         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
5572                 params.subtype =
5573                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
5574                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
5575                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
5576                         return -EINVAL;
5577         } else {
5578                 /* Default to Deauthentication frame */
5579                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
5580         }
5581
5582         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
5583                 params.reason_code =
5584                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5585                 if (params.reason_code == 0)
5586                         return -EINVAL; /* 0 is reserved */
5587         } else {
5588                 /* Default to reason code 2 */
5589                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
5590         }
5591
5592         return rdev_del_station(rdev, dev, &params);
5593 }
5594
5595 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
5596                                 int flags, struct net_device *dev,
5597                                 u8 *dst, u8 *next_hop,
5598                                 struct mpath_info *pinfo)
5599 {
5600         void *hdr;
5601         struct nlattr *pinfoattr;
5602
5603         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
5604         if (!hdr)
5605                 return -1;
5606
5607         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5608             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
5609             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
5610             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
5611                 goto nla_put_failure;
5612
5613         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
5614         if (!pinfoattr)
5615                 goto nla_put_failure;
5616         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
5617             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
5618                         pinfo->frame_qlen))
5619                 goto nla_put_failure;
5620         if (((pinfo->filled & MPATH_INFO_SN) &&
5621              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
5622             ((pinfo->filled & MPATH_INFO_METRIC) &&
5623              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
5624                          pinfo->metric)) ||
5625             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
5626              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
5627                          pinfo->exptime)) ||
5628             ((pinfo->filled & MPATH_INFO_FLAGS) &&
5629              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
5630                         pinfo->flags)) ||
5631             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
5632              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
5633                          pinfo->discovery_timeout)) ||
5634             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
5635              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
5636                         pinfo->discovery_retries)))
5637                 goto nla_put_failure;
5638
5639         nla_nest_end(msg, pinfoattr);
5640
5641         genlmsg_end(msg, hdr);
5642         return 0;
5643
5644  nla_put_failure:
5645         genlmsg_cancel(msg, hdr);
5646         return -EMSGSIZE;
5647 }
5648
5649 static int nl80211_dump_mpath(struct sk_buff *skb,
5650                               struct netlink_callback *cb)
5651 {
5652         struct mpath_info pinfo;
5653         struct cfg80211_registered_device *rdev;
5654         struct wireless_dev *wdev;
5655         u8 dst[ETH_ALEN];
5656         u8 next_hop[ETH_ALEN];
5657         int path_idx = cb->args[2];
5658         int err;
5659
5660         rtnl_lock();
5661         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5662         if (err)
5663                 goto out_err;
5664
5665         if (!rdev->ops->dump_mpath) {
5666                 err = -EOPNOTSUPP;
5667                 goto out_err;
5668         }
5669
5670         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5671                 err = -EOPNOTSUPP;
5672                 goto out_err;
5673         }
5674
5675         while (1) {
5676                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
5677                                       next_hop, &pinfo);
5678                 if (err == -ENOENT)
5679                         break;
5680                 if (err)
5681                         goto out_err;
5682
5683                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5684                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
5685                                        wdev->netdev, dst, next_hop,
5686                                        &pinfo) < 0)
5687                         goto out;
5688
5689                 path_idx++;
5690         }
5691
5692  out:
5693         cb->args[2] = path_idx;
5694         err = skb->len;
5695  out_err:
5696         rtnl_unlock();
5697         return err;
5698 }
5699
5700 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
5701 {
5702         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5703         int err;
5704         struct net_device *dev = info->user_ptr[1];
5705         struct mpath_info pinfo;
5706         struct sk_buff *msg;
5707         u8 *dst = NULL;
5708         u8 next_hop[ETH_ALEN];
5709
5710         memset(&pinfo, 0, sizeof(pinfo));
5711
5712         if (!info->attrs[NL80211_ATTR_MAC])
5713                 return -EINVAL;
5714
5715         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5716
5717         if (!rdev->ops->get_mpath)
5718                 return -EOPNOTSUPP;
5719
5720         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5721                 return -EOPNOTSUPP;
5722
5723         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
5724         if (err)
5725                 return err;
5726
5727         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5728         if (!msg)
5729                 return -ENOMEM;
5730
5731         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5732                                  dev, dst, next_hop, &pinfo) < 0) {
5733                 nlmsg_free(msg);
5734                 return -ENOBUFS;
5735         }
5736
5737         return genlmsg_reply(msg, info);
5738 }
5739
5740 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
5741 {
5742         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5743         struct net_device *dev = info->user_ptr[1];
5744         u8 *dst = NULL;
5745         u8 *next_hop = NULL;
5746
5747         if (!info->attrs[NL80211_ATTR_MAC])
5748                 return -EINVAL;
5749
5750         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5751                 return -EINVAL;
5752
5753         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5754         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5755
5756         if (!rdev->ops->change_mpath)
5757                 return -EOPNOTSUPP;
5758
5759         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5760                 return -EOPNOTSUPP;
5761
5762         return rdev_change_mpath(rdev, dev, dst, next_hop);
5763 }
5764
5765 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
5766 {
5767         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5768         struct net_device *dev = info->user_ptr[1];
5769         u8 *dst = NULL;
5770         u8 *next_hop = NULL;
5771
5772         if (!info->attrs[NL80211_ATTR_MAC])
5773                 return -EINVAL;
5774
5775         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5776                 return -EINVAL;
5777
5778         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5779         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5780
5781         if (!rdev->ops->add_mpath)
5782                 return -EOPNOTSUPP;
5783
5784         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5785                 return -EOPNOTSUPP;
5786
5787         return rdev_add_mpath(rdev, dev, dst, next_hop);
5788 }
5789
5790 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
5791 {
5792         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5793         struct net_device *dev = info->user_ptr[1];
5794         u8 *dst = NULL;
5795
5796         if (info->attrs[NL80211_ATTR_MAC])
5797                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5798
5799         if (!rdev->ops->del_mpath)
5800                 return -EOPNOTSUPP;
5801
5802         return rdev_del_mpath(rdev, dev, dst);
5803 }
5804
5805 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
5806 {
5807         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5808         int err;
5809         struct net_device *dev = info->user_ptr[1];
5810         struct mpath_info pinfo;
5811         struct sk_buff *msg;
5812         u8 *dst = NULL;
5813         u8 mpp[ETH_ALEN];
5814
5815         memset(&pinfo, 0, sizeof(pinfo));
5816
5817         if (!info->attrs[NL80211_ATTR_MAC])
5818                 return -EINVAL;
5819
5820         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5821
5822         if (!rdev->ops->get_mpp)
5823                 return -EOPNOTSUPP;
5824
5825         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5826                 return -EOPNOTSUPP;
5827
5828         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
5829         if (err)
5830                 return err;
5831
5832         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5833         if (!msg)
5834                 return -ENOMEM;
5835
5836         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5837                                dev, dst, mpp, &pinfo) < 0) {
5838                 nlmsg_free(msg);
5839                 return -ENOBUFS;
5840         }
5841
5842         return genlmsg_reply(msg, info);
5843 }
5844
5845 static int nl80211_dump_mpp(struct sk_buff *skb,
5846                             struct netlink_callback *cb)
5847 {
5848         struct mpath_info pinfo;
5849         struct cfg80211_registered_device *rdev;
5850         struct wireless_dev *wdev;
5851         u8 dst[ETH_ALEN];
5852         u8 mpp[ETH_ALEN];
5853         int path_idx = cb->args[2];
5854         int err;
5855
5856         rtnl_lock();
5857         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5858         if (err)
5859                 goto out_err;
5860
5861         if (!rdev->ops->dump_mpp) {
5862                 err = -EOPNOTSUPP;
5863                 goto out_err;
5864         }
5865
5866         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5867                 err = -EOPNOTSUPP;
5868                 goto out_err;
5869         }
5870
5871         while (1) {
5872                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
5873                                     mpp, &pinfo);
5874                 if (err == -ENOENT)
5875                         break;
5876                 if (err)
5877                         goto out_err;
5878
5879                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5880                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
5881                                        wdev->netdev, dst, mpp,
5882                                        &pinfo) < 0)
5883                         goto out;
5884
5885                 path_idx++;
5886         }
5887
5888  out:
5889         cb->args[2] = path_idx;
5890         err = skb->len;
5891  out_err:
5892         rtnl_unlock();
5893         return err;
5894 }
5895
5896 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
5897 {
5898         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5899         struct net_device *dev = info->user_ptr[1];
5900         struct wireless_dev *wdev = dev->ieee80211_ptr;
5901         struct bss_parameters params;
5902         int err;
5903
5904         memset(&params, 0, sizeof(params));
5905         /* default to not changing parameters */
5906         params.use_cts_prot = -1;
5907         params.use_short_preamble = -1;
5908         params.use_short_slot_time = -1;
5909         params.ap_isolate = -1;
5910         params.ht_opmode = -1;
5911         params.p2p_ctwindow = -1;
5912         params.p2p_opp_ps = -1;
5913
5914         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
5915                 params.use_cts_prot =
5916                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
5917         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
5918                 params.use_short_preamble =
5919                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
5920         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
5921                 params.use_short_slot_time =
5922                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
5923         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5924                 params.basic_rates =
5925                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5926                 params.basic_rates_len =
5927                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5928         }
5929         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
5930                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
5931         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
5932                 params.ht_opmode =
5933                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
5934
5935         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
5936                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5937                         return -EINVAL;
5938                 params.p2p_ctwindow =
5939                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
5940                 if (params.p2p_ctwindow < 0)
5941                         return -EINVAL;
5942                 if (params.p2p_ctwindow != 0 &&
5943                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
5944                         return -EINVAL;
5945         }
5946
5947         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
5948                 u8 tmp;
5949
5950                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5951                         return -EINVAL;
5952                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
5953                 if (tmp > 1)
5954                         return -EINVAL;
5955                 params.p2p_opp_ps = tmp;
5956                 if (params.p2p_opp_ps &&
5957                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
5958                         return -EINVAL;
5959         }
5960
5961         if (!rdev->ops->change_bss)
5962                 return -EOPNOTSUPP;
5963
5964         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5965             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5966                 return -EOPNOTSUPP;
5967
5968         wdev_lock(wdev);
5969         err = rdev_change_bss(rdev, dev, &params);
5970         wdev_unlock(wdev);
5971
5972         return err;
5973 }
5974
5975 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
5976 {
5977         char *data = NULL;
5978         bool is_indoor;
5979         enum nl80211_user_reg_hint_type user_reg_hint_type;
5980         u32 owner_nlportid;
5981
5982         /*
5983          * You should only get this when cfg80211 hasn't yet initialized
5984          * completely when built-in to the kernel right between the time
5985          * window between nl80211_init() and regulatory_init(), if that is
5986          * even possible.
5987          */
5988         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
5989                 return -EINPROGRESS;
5990
5991         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
5992                 user_reg_hint_type =
5993                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
5994         else
5995                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
5996
5997         switch (user_reg_hint_type) {
5998         case NL80211_USER_REG_HINT_USER:
5999         case NL80211_USER_REG_HINT_CELL_BASE:
6000                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6001                         return -EINVAL;
6002
6003                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6004                 return regulatory_hint_user(data, user_reg_hint_type);
6005         case NL80211_USER_REG_HINT_INDOOR:
6006                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
6007                         owner_nlportid = info->snd_portid;
6008                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
6009                 } else {
6010                         owner_nlportid = 0;
6011                         is_indoor = true;
6012                 }
6013
6014                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
6015         default:
6016                 return -EINVAL;
6017         }
6018 }
6019
6020 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
6021 {
6022         return reg_reload_regdb();
6023 }
6024
6025 static int nl80211_get_mesh_config(struct sk_buff *skb,
6026                                    struct genl_info *info)
6027 {
6028         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6029         struct net_device *dev = info->user_ptr[1];
6030         struct wireless_dev *wdev = dev->ieee80211_ptr;
6031         struct mesh_config cur_params;
6032         int err = 0;
6033         void *hdr;
6034         struct nlattr *pinfoattr;
6035         struct sk_buff *msg;
6036
6037         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6038                 return -EOPNOTSUPP;
6039
6040         if (!rdev->ops->get_mesh_config)
6041                 return -EOPNOTSUPP;
6042
6043         wdev_lock(wdev);
6044         /* If not connected, get default parameters */
6045         if (!wdev->mesh_id_len)
6046                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
6047         else
6048                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
6049         wdev_unlock(wdev);
6050
6051         if (err)
6052                 return err;
6053
6054         /* Draw up a netlink message to send back */
6055         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6056         if (!msg)
6057                 return -ENOMEM;
6058         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6059                              NL80211_CMD_GET_MESH_CONFIG);
6060         if (!hdr)
6061                 goto out;
6062         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
6063         if (!pinfoattr)
6064                 goto nla_put_failure;
6065         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6066             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
6067                         cur_params.dot11MeshRetryTimeout) ||
6068             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
6069                         cur_params.dot11MeshConfirmTimeout) ||
6070             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
6071                         cur_params.dot11MeshHoldingTimeout) ||
6072             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
6073                         cur_params.dot11MeshMaxPeerLinks) ||
6074             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
6075                        cur_params.dot11MeshMaxRetries) ||
6076             nla_put_u8(msg, NL80211_MESHCONF_TTL,
6077                        cur_params.dot11MeshTTL) ||
6078             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
6079                        cur_params.element_ttl) ||
6080             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
6081                        cur_params.auto_open_plinks) ||
6082             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
6083                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
6084             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
6085                        cur_params.dot11MeshHWMPmaxPREQretries) ||
6086             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
6087                         cur_params.path_refresh_time) ||
6088             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
6089                         cur_params.min_discovery_timeout) ||
6090             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
6091                         cur_params.dot11MeshHWMPactivePathTimeout) ||
6092             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
6093                         cur_params.dot11MeshHWMPpreqMinInterval) ||
6094             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
6095                         cur_params.dot11MeshHWMPperrMinInterval) ||
6096             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
6097                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
6098             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
6099                        cur_params.dot11MeshHWMPRootMode) ||
6100             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
6101                         cur_params.dot11MeshHWMPRannInterval) ||
6102             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
6103                        cur_params.dot11MeshGateAnnouncementProtocol) ||
6104             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
6105                        cur_params.dot11MeshForwarding) ||
6106             nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
6107                         cur_params.rssi_threshold) ||
6108             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
6109                         cur_params.ht_opmode) ||
6110             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6111                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
6112             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6113                         cur_params.dot11MeshHWMProotInterval) ||
6114             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6115                         cur_params.dot11MeshHWMPconfirmationInterval) ||
6116             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
6117                         cur_params.power_mode) ||
6118             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
6119                         cur_params.dot11MeshAwakeWindowDuration) ||
6120             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
6121                         cur_params.plink_timeout))
6122                 goto nla_put_failure;
6123         nla_nest_end(msg, pinfoattr);
6124         genlmsg_end(msg, hdr);
6125         return genlmsg_reply(msg, info);
6126
6127  nla_put_failure:
6128  out:
6129         nlmsg_free(msg);
6130         return -ENOBUFS;
6131 }
6132
6133 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
6134         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
6135         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
6136         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
6137         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
6138         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
6139         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
6140         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
6141         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
6142         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
6143         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
6144         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
6145         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
6146         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
6147         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
6148         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
6149         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
6150         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
6151         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
6152         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
6153         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
6154         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
6155         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
6156         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
6157         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
6158         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
6159         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
6160         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
6161         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
6162 };
6163
6164 static const struct nla_policy
6165         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
6166         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
6167         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
6168         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
6169         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
6170         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
6171         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
6172         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
6173                                     .len = IEEE80211_MAX_DATA_LEN },
6174         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
6175 };
6176
6177 static int nl80211_check_bool(const struct nlattr *nla, u8 min, u8 max, bool *out)
6178 {
6179         u8 val = nla_get_u8(nla);
6180         if (val < min || val > max)
6181                 return -EINVAL;
6182         *out = val;
6183         return 0;
6184 }
6185
6186 static int nl80211_check_u8(const struct nlattr *nla, u8 min, u8 max, u8 *out)
6187 {
6188         u8 val = nla_get_u8(nla);
6189         if (val < min || val > max)
6190                 return -EINVAL;
6191         *out = val;
6192         return 0;
6193 }
6194
6195 static int nl80211_check_u16(const struct nlattr *nla, u16 min, u16 max, u16 *out)
6196 {
6197         u16 val = nla_get_u16(nla);
6198         if (val < min || val > max)
6199                 return -EINVAL;
6200         *out = val;
6201         return 0;
6202 }
6203
6204 static int nl80211_check_u32(const struct nlattr *nla, u32 min, u32 max, u32 *out)
6205 {
6206         u32 val = nla_get_u32(nla);
6207         if (val < min || val > max)
6208                 return -EINVAL;
6209         *out = val;
6210         return 0;
6211 }
6212
6213 static int nl80211_check_s32(const struct nlattr *nla, s32 min, s32 max, s32 *out)
6214 {
6215         s32 val = nla_get_s32(nla);
6216         if (val < min || val > max)
6217                 return -EINVAL;
6218         *out = val;
6219         return 0;
6220 }
6221
6222 static int nl80211_check_power_mode(const struct nlattr *nla,
6223                                     enum nl80211_mesh_power_mode min,
6224                                     enum nl80211_mesh_power_mode max,
6225                                     enum nl80211_mesh_power_mode *out)
6226 {
6227         u32 val = nla_get_u32(nla);
6228         if (val < min || val > max)
6229                 return -EINVAL;
6230         *out = val;
6231         return 0;
6232 }
6233
6234 static int nl80211_parse_mesh_config(struct genl_info *info,
6235                                      struct mesh_config *cfg,
6236                                      u32 *mask_out)
6237 {
6238         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
6239         u32 mask = 0;
6240         u16 ht_opmode;
6241
6242 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
6243 do {                                                                        \
6244         if (tb[attr]) {                                                     \
6245                 if (fn(tb[attr], min, max, &cfg->param))                    \
6246                         return -EINVAL;                                     \
6247                 mask |= (1 << (attr - 1));                                  \
6248         }                                                                   \
6249 } while (0)
6250
6251         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
6252                 return -EINVAL;
6253         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
6254                              info->attrs[NL80211_ATTR_MESH_CONFIG],
6255                              nl80211_meshconf_params_policy, info->extack))
6256                 return -EINVAL;
6257
6258         /* This makes sure that there aren't more than 32 mesh config
6259          * parameters (otherwise our bitfield scheme would not work.) */
6260         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
6261
6262         /* Fill in the params struct */
6263         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
6264                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
6265                                   nl80211_check_u16);
6266         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
6267                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
6268                                   nl80211_check_u16);
6269         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
6270                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
6271                                   nl80211_check_u16);
6272         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
6273                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
6274                                   nl80211_check_u16);
6275         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
6276                                   mask, NL80211_MESHCONF_MAX_RETRIES,
6277                                   nl80211_check_u8);
6278         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
6279                                   mask, NL80211_MESHCONF_TTL, nl80211_check_u8);
6280         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
6281                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
6282                                   nl80211_check_u8);
6283         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
6284                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
6285                                   nl80211_check_bool);
6286         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
6287                                   1, 255, mask,
6288                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
6289                                   nl80211_check_u32);
6290         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
6291                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
6292                                   nl80211_check_u8);
6293         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
6294                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
6295                                   nl80211_check_u32);
6296         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
6297                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
6298                                   nl80211_check_u16);
6299         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
6300                                   1, 65535, mask,
6301                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
6302                                   nl80211_check_u32);
6303         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
6304                                   1, 65535, mask,
6305                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
6306                                   nl80211_check_u16);
6307         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
6308                                   1, 65535, mask,
6309                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
6310                                   nl80211_check_u16);
6311         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6312                                   dot11MeshHWMPnetDiameterTraversalTime,
6313                                   1, 65535, mask,
6314                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
6315                                   nl80211_check_u16);
6316         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
6317                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
6318                                   nl80211_check_u8);
6319         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
6320                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
6321                                   nl80211_check_u16);
6322         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6323                                   dot11MeshGateAnnouncementProtocol, 0, 1,
6324                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
6325                                   nl80211_check_bool);
6326         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
6327                                   mask, NL80211_MESHCONF_FORWARDING,
6328                                   nl80211_check_bool);
6329         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
6330                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
6331                                   nl80211_check_s32);
6332         /*
6333          * Check HT operation mode based on
6334          * IEEE 802.11-2016 9.4.2.57 HT Operation element.
6335          */
6336         if (tb[NL80211_MESHCONF_HT_OPMODE]) {
6337                 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
6338
6339                 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
6340                                   IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
6341                                   IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
6342                         return -EINVAL;
6343
6344                 /* NON_HT_STA bit is reserved, but some programs set it */
6345                 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
6346
6347                 cfg->ht_opmode = ht_opmode;
6348                 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
6349         }
6350         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
6351                                   1, 65535, mask,
6352                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6353                                   nl80211_check_u32);
6354         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
6355                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6356                                   nl80211_check_u16);
6357         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6358                                   dot11MeshHWMPconfirmationInterval,
6359                                   1, 65535, mask,
6360                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6361                                   nl80211_check_u16);
6362         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
6363                                   NL80211_MESH_POWER_ACTIVE,
6364                                   NL80211_MESH_POWER_MAX,
6365                                   mask, NL80211_MESHCONF_POWER_MODE,
6366                                   nl80211_check_power_mode);
6367         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
6368                                   0, 65535, mask,
6369                                   NL80211_MESHCONF_AWAKE_WINDOW, nl80211_check_u16);
6370         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 0, 0xffffffff,
6371                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
6372                                   nl80211_check_u32);
6373         if (mask_out)
6374                 *mask_out = mask;
6375
6376         return 0;
6377
6378 #undef FILL_IN_MESH_PARAM_IF_SET
6379 }
6380
6381 static int nl80211_parse_mesh_setup(struct genl_info *info,
6382                                      struct mesh_setup *setup)
6383 {
6384         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6385         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
6386
6387         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
6388                 return -EINVAL;
6389         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
6390                              info->attrs[NL80211_ATTR_MESH_SETUP],
6391                              nl80211_mesh_setup_params_policy, info->extack))
6392                 return -EINVAL;
6393
6394         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
6395                 setup->sync_method =
6396                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
6397                  IEEE80211_SYNC_METHOD_VENDOR :
6398                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
6399
6400         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
6401                 setup->path_sel_proto =
6402                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
6403                  IEEE80211_PATH_PROTOCOL_VENDOR :
6404                  IEEE80211_PATH_PROTOCOL_HWMP;
6405
6406         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
6407                 setup->path_metric =
6408                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
6409                  IEEE80211_PATH_METRIC_VENDOR :
6410                  IEEE80211_PATH_METRIC_AIRTIME;
6411
6412         if (tb[NL80211_MESH_SETUP_IE]) {
6413                 struct nlattr *ieattr =
6414                         tb[NL80211_MESH_SETUP_IE];
6415                 if (!is_valid_ie_attr(ieattr))
6416                         return -EINVAL;
6417                 setup->ie = nla_data(ieattr);
6418                 setup->ie_len = nla_len(ieattr);
6419         }
6420         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
6421             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
6422                 return -EINVAL;
6423         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
6424         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
6425         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
6426         if (setup->is_secure)
6427                 setup->user_mpm = true;
6428
6429         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
6430                 if (!setup->user_mpm)
6431                         return -EINVAL;
6432                 setup->auth_id =
6433                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
6434         }
6435
6436         return 0;
6437 }
6438
6439 static int nl80211_update_mesh_config(struct sk_buff *skb,
6440                                       struct genl_info *info)
6441 {
6442         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6443         struct net_device *dev = info->user_ptr[1];
6444         struct wireless_dev *wdev = dev->ieee80211_ptr;
6445         struct mesh_config cfg;
6446         u32 mask;
6447         int err;
6448
6449         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6450                 return -EOPNOTSUPP;
6451
6452         if (!rdev->ops->update_mesh_config)
6453                 return -EOPNOTSUPP;
6454
6455         err = nl80211_parse_mesh_config(info, &cfg, &mask);
6456         if (err)
6457                 return err;
6458
6459         wdev_lock(wdev);
6460         if (!wdev->mesh_id_len)
6461                 err = -ENOLINK;
6462
6463         if (!err)
6464                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
6465
6466         wdev_unlock(wdev);
6467
6468         return err;
6469 }
6470
6471 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
6472                               struct sk_buff *msg)
6473 {
6474         struct nlattr *nl_reg_rules;
6475         unsigned int i;
6476
6477         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
6478             (regdom->dfs_region &&
6479              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
6480                 goto nla_put_failure;
6481
6482         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
6483         if (!nl_reg_rules)
6484                 goto nla_put_failure;
6485
6486         for (i = 0; i < regdom->n_reg_rules; i++) {
6487                 struct nlattr *nl_reg_rule;
6488                 const struct ieee80211_reg_rule *reg_rule;
6489                 const struct ieee80211_freq_range *freq_range;
6490                 const struct ieee80211_power_rule *power_rule;
6491                 unsigned int max_bandwidth_khz;
6492
6493                 reg_rule = &regdom->reg_rules[i];
6494                 freq_range = &reg_rule->freq_range;
6495                 power_rule = &reg_rule->power_rule;
6496
6497                 nl_reg_rule = nla_nest_start(msg, i);
6498                 if (!nl_reg_rule)
6499                         goto nla_put_failure;
6500
6501                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
6502                 if (!max_bandwidth_khz)
6503                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
6504                                                                   reg_rule);
6505
6506                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
6507                                 reg_rule->flags) ||
6508                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
6509                                 freq_range->start_freq_khz) ||
6510                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
6511                                 freq_range->end_freq_khz) ||
6512                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
6513                                 max_bandwidth_khz) ||
6514                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
6515                                 power_rule->max_antenna_gain) ||
6516                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
6517                                 power_rule->max_eirp) ||
6518                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
6519                                 reg_rule->dfs_cac_ms))
6520                         goto nla_put_failure;
6521
6522                 nla_nest_end(msg, nl_reg_rule);
6523         }
6524
6525         nla_nest_end(msg, nl_reg_rules);
6526         return 0;
6527
6528 nla_put_failure:
6529         return -EMSGSIZE;
6530 }
6531
6532 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
6533 {
6534         const struct ieee80211_regdomain *regdom = NULL;
6535         struct cfg80211_registered_device *rdev;
6536         struct wiphy *wiphy = NULL;
6537         struct sk_buff *msg;
6538         void *hdr;
6539
6540         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6541         if (!msg)
6542                 return -ENOBUFS;
6543
6544         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6545                              NL80211_CMD_GET_REG);
6546         if (!hdr)
6547                 goto put_failure;
6548
6549         if (info->attrs[NL80211_ATTR_WIPHY]) {
6550                 bool self_managed;
6551
6552                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
6553                 if (IS_ERR(rdev)) {
6554                         nlmsg_free(msg);
6555                         return PTR_ERR(rdev);
6556                 }
6557
6558                 wiphy = &rdev->wiphy;
6559                 self_managed = wiphy->regulatory_flags &
6560                                REGULATORY_WIPHY_SELF_MANAGED;
6561                 regdom = get_wiphy_regdom(wiphy);
6562
6563                 /* a self-managed-reg device must have a private regdom */
6564                 if (WARN_ON(!regdom && self_managed)) {
6565                         nlmsg_free(msg);
6566                         return -EINVAL;
6567                 }
6568
6569                 if (regdom &&
6570                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6571                         goto nla_put_failure;
6572         }
6573
6574         if (!wiphy && reg_last_request_cell_base() &&
6575             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6576                         NL80211_USER_REG_HINT_CELL_BASE))
6577                 goto nla_put_failure;
6578
6579         rcu_read_lock();
6580
6581         if (!regdom)
6582                 regdom = rcu_dereference(cfg80211_regdomain);
6583
6584         if (nl80211_put_regdom(regdom, msg))
6585                 goto nla_put_failure_rcu;
6586
6587         rcu_read_unlock();
6588
6589         genlmsg_end(msg, hdr);
6590         return genlmsg_reply(msg, info);
6591
6592 nla_put_failure_rcu:
6593         rcu_read_unlock();
6594 nla_put_failure:
6595 put_failure:
6596         nlmsg_free(msg);
6597         return -EMSGSIZE;
6598 }
6599
6600 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
6601                                u32 seq, int flags, struct wiphy *wiphy,
6602                                const struct ieee80211_regdomain *regdom)
6603 {
6604         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6605                                    NL80211_CMD_GET_REG);
6606
6607         if (!hdr)
6608                 return -1;
6609
6610         genl_dump_check_consistent(cb, hdr);
6611
6612         if (nl80211_put_regdom(regdom, msg))
6613                 goto nla_put_failure;
6614
6615         if (!wiphy && reg_last_request_cell_base() &&
6616             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6617                         NL80211_USER_REG_HINT_CELL_BASE))
6618                 goto nla_put_failure;
6619
6620         if (wiphy &&
6621             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6622                 goto nla_put_failure;
6623
6624         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
6625             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
6626                 goto nla_put_failure;
6627
6628         genlmsg_end(msg, hdr);
6629         return 0;
6630
6631 nla_put_failure:
6632         genlmsg_cancel(msg, hdr);
6633         return -EMSGSIZE;
6634 }
6635
6636 static int nl80211_get_reg_dump(struct sk_buff *skb,
6637                                 struct netlink_callback *cb)
6638 {
6639         const struct ieee80211_regdomain *regdom = NULL;
6640         struct cfg80211_registered_device *rdev;
6641         int err, reg_idx, start = cb->args[2];
6642
6643         rtnl_lock();
6644
6645         if (cfg80211_regdomain && start == 0) {
6646                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6647                                           NLM_F_MULTI, NULL,
6648                                           rtnl_dereference(cfg80211_regdomain));
6649                 if (err < 0)
6650                         goto out_err;
6651         }
6652
6653         /* the global regdom is idx 0 */
6654         reg_idx = 1;
6655         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
6656                 regdom = get_wiphy_regdom(&rdev->wiphy);
6657                 if (!regdom)
6658                         continue;
6659
6660                 if (++reg_idx <= start)
6661                         continue;
6662
6663                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6664                                           NLM_F_MULTI, &rdev->wiphy, regdom);
6665                 if (err < 0) {
6666                         reg_idx--;
6667                         break;
6668                 }
6669         }
6670
6671         cb->args[2] = reg_idx;
6672         err = skb->len;
6673 out_err:
6674         rtnl_unlock();
6675         return err;
6676 }
6677
6678 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
6679 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
6680         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
6681         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
6682         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
6683         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
6684         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
6685         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
6686         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
6687 };
6688
6689 static int parse_reg_rule(struct nlattr *tb[],
6690         struct ieee80211_reg_rule *reg_rule)
6691 {
6692         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
6693         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
6694
6695         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
6696                 return -EINVAL;
6697         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
6698                 return -EINVAL;
6699         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
6700                 return -EINVAL;
6701         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
6702                 return -EINVAL;
6703         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
6704                 return -EINVAL;
6705
6706         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
6707
6708         freq_range->start_freq_khz =
6709                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
6710         freq_range->end_freq_khz =
6711                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
6712         freq_range->max_bandwidth_khz =
6713                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
6714
6715         power_rule->max_eirp =
6716                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
6717
6718         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
6719                 power_rule->max_antenna_gain =
6720                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
6721
6722         if (tb[NL80211_ATTR_DFS_CAC_TIME])
6723                 reg_rule->dfs_cac_ms =
6724                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
6725
6726         return 0;
6727 }
6728
6729 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
6730 {
6731         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
6732         struct nlattr *nl_reg_rule;
6733         char *alpha2;
6734         int rem_reg_rules, r;
6735         u32 num_rules = 0, rule_idx = 0, size_of_regd;
6736         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
6737         struct ieee80211_regdomain *rd;
6738
6739         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6740                 return -EINVAL;
6741
6742         if (!info->attrs[NL80211_ATTR_REG_RULES])
6743                 return -EINVAL;
6744
6745         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6746
6747         if (info->attrs[NL80211_ATTR_DFS_REGION])
6748                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
6749
6750         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6751                             rem_reg_rules) {
6752                 num_rules++;
6753                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
6754                         return -EINVAL;
6755         }
6756
6757         if (!reg_is_valid_request(alpha2))
6758                 return -EINVAL;
6759
6760         size_of_regd = sizeof(struct ieee80211_regdomain) +
6761                        num_rules * sizeof(struct ieee80211_reg_rule);
6762
6763         rd = kzalloc(size_of_regd, GFP_KERNEL);
6764         if (!rd)
6765                 return -ENOMEM;
6766
6767         rd->n_reg_rules = num_rules;
6768         rd->alpha2[0] = alpha2[0];
6769         rd->alpha2[1] = alpha2[1];
6770
6771         /*
6772          * Disable DFS master mode if the DFS region was
6773          * not supported or known on this kernel.
6774          */
6775         if (reg_supported_dfs_region(dfs_region))
6776                 rd->dfs_region = dfs_region;
6777
6778         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6779                             rem_reg_rules) {
6780                 r = nla_parse_nested(tb, NL80211_REG_RULE_ATTR_MAX,
6781                                      nl_reg_rule, reg_rule_policy,
6782                                      info->extack);
6783                 if (r)
6784                         goto bad_reg;
6785                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
6786                 if (r)
6787                         goto bad_reg;
6788
6789                 rule_idx++;
6790
6791                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
6792                         r = -EINVAL;
6793                         goto bad_reg;
6794                 }
6795         }
6796
6797         /* set_regdom takes ownership of rd */
6798         return set_regdom(rd, REGD_SOURCE_CRDA);
6799  bad_reg:
6800         kfree(rd);
6801         return r;
6802 }
6803 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
6804
6805 static int validate_scan_freqs(struct nlattr *freqs)
6806 {
6807         struct nlattr *attr1, *attr2;
6808         int n_channels = 0, tmp1, tmp2;
6809
6810         nla_for_each_nested(attr1, freqs, tmp1)
6811                 if (nla_len(attr1) != sizeof(u32))
6812                         return 0;
6813
6814         nla_for_each_nested(attr1, freqs, tmp1) {
6815                 n_channels++;
6816                 /*
6817                  * Some hardware has a limited channel list for
6818                  * scanning, and it is pretty much nonsensical
6819                  * to scan for a channel twice, so disallow that
6820                  * and don't require drivers to check that the
6821                  * channel list they get isn't longer than what
6822                  * they can scan, as long as they can scan all
6823                  * the channels they registered at once.
6824                  */
6825                 nla_for_each_nested(attr2, freqs, tmp2)
6826                         if (attr1 != attr2 &&
6827                             nla_get_u32(attr1) == nla_get_u32(attr2))
6828                                 return 0;
6829         }
6830
6831         return n_channels;
6832 }
6833
6834 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
6835 {
6836         return b < NUM_NL80211_BANDS && wiphy->bands[b];
6837 }
6838
6839 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
6840                             struct cfg80211_bss_selection *bss_select)
6841 {
6842         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
6843         struct nlattr *nest;
6844         int err;
6845         bool found = false;
6846         int i;
6847
6848         /* only process one nested attribute */
6849         nest = nla_data(nla);
6850         if (!nla_ok(nest, nla_len(nest)))
6851                 return -EINVAL;
6852
6853         err = nla_parse_nested(attr, NL80211_BSS_SELECT_ATTR_MAX, nest,
6854                                nl80211_bss_select_policy, NULL);
6855         if (err)
6856                 return err;
6857
6858         /* only one attribute may be given */
6859         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
6860                 if (attr[i]) {
6861                         if (found)
6862                                 return -EINVAL;
6863                         found = true;
6864                 }
6865         }
6866
6867         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
6868
6869         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
6870                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
6871
6872         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
6873                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
6874                 bss_select->param.band_pref =
6875                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
6876                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
6877                         return -EINVAL;
6878         }
6879
6880         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
6881                 struct nl80211_bss_select_rssi_adjust *adj_param;
6882
6883                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
6884                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
6885                 bss_select->param.adjust.band = adj_param->band;
6886                 bss_select->param.adjust.delta = adj_param->delta;
6887                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
6888                         return -EINVAL;
6889         }
6890
6891         /* user-space did not provide behaviour attribute */
6892         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
6893                 return -EINVAL;
6894
6895         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
6896                 return -EINVAL;
6897
6898         return 0;
6899 }
6900
6901 static int nl80211_parse_random_mac(struct nlattr **attrs,
6902                                     u8 *mac_addr, u8 *mac_addr_mask)
6903 {
6904         int i;
6905
6906         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
6907                 eth_zero_addr(mac_addr);
6908                 eth_zero_addr(mac_addr_mask);
6909                 mac_addr[0] = 0x2;
6910                 mac_addr_mask[0] = 0x3;
6911
6912                 return 0;
6913         }
6914
6915         /* need both or none */
6916         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
6917                 return -EINVAL;
6918
6919         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
6920         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
6921
6922         /* don't allow or configure an mcast address */
6923         if (!is_multicast_ether_addr(mac_addr_mask) ||
6924             is_multicast_ether_addr(mac_addr))
6925                 return -EINVAL;
6926
6927         /*
6928          * allow users to pass a MAC address that has bits set outside
6929          * of the mask, but don't bother drivers with having to deal
6930          * with such bits
6931          */
6932         for (i = 0; i < ETH_ALEN; i++)
6933                 mac_addr[i] &= mac_addr_mask[i];
6934
6935         return 0;
6936 }
6937
6938 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev)
6939 {
6940         ASSERT_WDEV_LOCK(wdev);
6941
6942         if (!cfg80211_beaconing_iface_active(wdev))
6943                 return true;
6944
6945         if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR))
6946                 return true;
6947
6948         return regulatory_pre_cac_allowed(wdev->wiphy);
6949 }
6950
6951 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
6952                                     enum nl80211_ext_feature_index feat)
6953 {
6954         if (!(flags & flag))
6955                 return true;
6956         if (wiphy_ext_feature_isset(wiphy, feat))
6957                 return true;
6958         return false;
6959 }
6960
6961 static int
6962 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
6963                          void *request, struct nlattr **attrs,
6964                          bool is_sched_scan)
6965 {
6966         u8 *mac_addr, *mac_addr_mask;
6967         u32 *flags;
6968         enum nl80211_feature_flags randomness_flag;
6969
6970         if (!attrs[NL80211_ATTR_SCAN_FLAGS])
6971                 return 0;
6972
6973         if (is_sched_scan) {
6974                 struct cfg80211_sched_scan_request *req = request;
6975
6976                 randomness_flag = wdev ?
6977                                   NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
6978                                   NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
6979                 flags = &req->flags;
6980                 mac_addr = req->mac_addr;
6981                 mac_addr_mask = req->mac_addr_mask;
6982         } else {
6983                 struct cfg80211_scan_request *req = request;
6984
6985                 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
6986                 flags = &req->flags;
6987                 mac_addr = req->mac_addr;
6988                 mac_addr_mask = req->mac_addr_mask;
6989         }
6990
6991         *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
6992
6993         if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
6994              !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
6995             !nl80211_check_scan_feat(wiphy, *flags,
6996                                      NL80211_SCAN_FLAG_LOW_SPAN,
6997                                      NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
6998             !nl80211_check_scan_feat(wiphy, *flags,
6999                                      NL80211_SCAN_FLAG_LOW_POWER,
7000                                      NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
7001             !nl80211_check_scan_feat(wiphy, *flags,
7002                                      NL80211_SCAN_FLAG_HIGH_ACCURACY,
7003                                      NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
7004             !nl80211_check_scan_feat(wiphy, *flags,
7005                                      NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
7006                                      NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
7007             !nl80211_check_scan_feat(wiphy, *flags,
7008                                      NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
7009                                      NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
7010             !nl80211_check_scan_feat(wiphy, *flags,
7011                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
7012                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
7013             !nl80211_check_scan_feat(wiphy, *flags,
7014                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
7015                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
7016             !nl80211_check_scan_feat(wiphy, *flags,
7017                                      NL80211_SCAN_FLAG_RANDOM_SN,
7018                                      NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
7019             !nl80211_check_scan_feat(wiphy, *flags,
7020                                      NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
7021                                      NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
7022                 return -EOPNOTSUPP;
7023
7024         if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
7025                 int err;
7026
7027                 if (!(wiphy->features & randomness_flag) ||
7028                     (wdev && wdev->current_bss))
7029                         return -EOPNOTSUPP;
7030
7031                 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
7032                 if (err)
7033                         return err;
7034         }
7035
7036         return 0;
7037 }
7038
7039 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
7040 {
7041         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7042         struct wireless_dev *wdev = info->user_ptr[1];
7043         struct cfg80211_scan_request *request;
7044         struct nlattr *attr;
7045         struct wiphy *wiphy;
7046         int err, tmp, n_ssids = 0, n_channels, i;
7047         size_t ie_len;
7048
7049         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7050                 return -EINVAL;
7051
7052         wiphy = &rdev->wiphy;
7053
7054         if (wdev->iftype == NL80211_IFTYPE_NAN)
7055                 return -EOPNOTSUPP;
7056
7057         if (!rdev->ops->scan)
7058                 return -EOPNOTSUPP;
7059
7060         if (rdev->scan_req || rdev->scan_msg) {
7061                 err = -EBUSY;
7062                 goto unlock;
7063         }
7064
7065         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7066                 n_channels = validate_scan_freqs(
7067                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7068                 if (!n_channels) {
7069                         err = -EINVAL;
7070                         goto unlock;
7071                 }
7072         } else {
7073                 n_channels = ieee80211_get_num_supported_channels(wiphy);
7074         }
7075
7076         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
7077                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
7078                         n_ssids++;
7079
7080         if (n_ssids > wiphy->max_scan_ssids) {
7081                 err = -EINVAL;
7082                 goto unlock;
7083         }
7084
7085         if (info->attrs[NL80211_ATTR_IE])
7086                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7087         else
7088                 ie_len = 0;
7089
7090         if (ie_len > wiphy->max_scan_ie_len) {
7091                 err = -EINVAL;
7092                 goto unlock;
7093         }
7094
7095         request = kzalloc(sizeof(*request)
7096                         + sizeof(*request->ssids) * n_ssids
7097                         + sizeof(*request->channels) * n_channels
7098                         + ie_len, GFP_KERNEL);
7099         if (!request) {
7100                 err = -ENOMEM;
7101                 goto unlock;
7102         }
7103
7104         if (n_ssids)
7105                 request->ssids = (void *)&request->channels[n_channels];
7106         request->n_ssids = n_ssids;
7107         if (ie_len) {
7108                 if (n_ssids)
7109                         request->ie = (void *)(request->ssids + n_ssids);
7110                 else
7111                         request->ie = (void *)(request->channels + n_channels);
7112         }
7113
7114         i = 0;
7115         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7116                 /* user specified, bail out if channel not found */
7117                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
7118                         struct ieee80211_channel *chan;
7119
7120                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7121
7122                         if (!chan) {
7123                                 err = -EINVAL;
7124                                 goto out_free;
7125                         }
7126
7127                         /* ignore disabled channels */
7128                         if (chan->flags & IEEE80211_CHAN_DISABLED)
7129                                 continue;
7130
7131                         request->channels[i] = chan;
7132                         i++;
7133                 }
7134         } else {
7135                 enum nl80211_band band;
7136
7137                 /* all channels */
7138                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7139                         int j;
7140
7141                         if (!wiphy->bands[band])
7142                                 continue;
7143                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7144                                 struct ieee80211_channel *chan;
7145
7146                                 chan = &wiphy->bands[band]->channels[j];
7147
7148                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
7149                                         continue;
7150
7151                                 request->channels[i] = chan;
7152                                 i++;
7153                         }
7154                 }
7155         }
7156
7157         if (!i) {
7158                 err = -EINVAL;
7159                 goto out_free;
7160         }
7161
7162         request->n_channels = i;
7163
7164         wdev_lock(wdev);
7165         if (!cfg80211_off_channel_oper_allowed(wdev)) {
7166                 struct ieee80211_channel *chan;
7167
7168                 if (request->n_channels != 1) {
7169                         wdev_unlock(wdev);
7170                         err = -EBUSY;
7171                         goto out_free;
7172                 }
7173
7174                 chan = request->channels[0];
7175                 if (chan->center_freq != wdev->chandef.chan->center_freq) {
7176                         wdev_unlock(wdev);
7177                         err = -EBUSY;
7178                         goto out_free;
7179                 }
7180         }
7181         wdev_unlock(wdev);
7182
7183         i = 0;
7184         if (n_ssids) {
7185                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
7186                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7187                                 err = -EINVAL;
7188                                 goto out_free;
7189                         }
7190                         request->ssids[i].ssid_len = nla_len(attr);
7191                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
7192                         i++;
7193                 }
7194         }
7195
7196         if (info->attrs[NL80211_ATTR_IE]) {
7197                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7198                 memcpy((void *)request->ie,
7199                        nla_data(info->attrs[NL80211_ATTR_IE]),
7200                        request->ie_len);
7201         }
7202
7203         for (i = 0; i < NUM_NL80211_BANDS; i++)
7204                 if (wiphy->bands[i])
7205                         request->rates[i] =
7206                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
7207
7208         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
7209                 nla_for_each_nested(attr,
7210                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
7211                                     tmp) {
7212                         enum nl80211_band band = nla_type(attr);
7213
7214                         if (band < 0 || band >= NUM_NL80211_BANDS) {
7215                                 err = -EINVAL;
7216                                 goto out_free;
7217                         }
7218
7219                         if (!wiphy->bands[band])
7220                                 continue;
7221
7222                         err = ieee80211_get_ratemask(wiphy->bands[band],
7223                                                      nla_data(attr),
7224                                                      nla_len(attr),
7225                                                      &request->rates[band]);
7226                         if (err)
7227                                 goto out_free;
7228                 }
7229         }
7230
7231         if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
7232                 if (!wiphy_ext_feature_isset(wiphy,
7233                                         NL80211_EXT_FEATURE_SET_SCAN_DWELL)) {
7234                         err = -EOPNOTSUPP;
7235                         goto out_free;
7236                 }
7237
7238                 request->duration =
7239                         nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
7240                 request->duration_mandatory =
7241                         nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
7242         }
7243
7244         err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
7245                                        false);
7246         if (err)
7247                 goto out_free;
7248
7249         request->no_cck =
7250                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7251
7252         /* Initial implementation used NL80211_ATTR_MAC to set the specific
7253          * BSSID to scan for. This was problematic because that same attribute
7254          * was already used for another purpose (local random MAC address). The
7255          * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
7256          * compatibility with older userspace components, also use the
7257          * NL80211_ATTR_MAC value here if it can be determined to be used for
7258          * the specific BSSID use case instead of the random MAC address
7259          * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
7260          */
7261         if (info->attrs[NL80211_ATTR_BSSID])
7262                 memcpy(request->bssid,
7263                        nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
7264         else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
7265                  info->attrs[NL80211_ATTR_MAC])
7266                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
7267                        ETH_ALEN);
7268         else
7269                 eth_broadcast_addr(request->bssid);
7270
7271         request->wdev = wdev;
7272         request->wiphy = &rdev->wiphy;
7273         request->scan_start = jiffies;
7274
7275         rdev->scan_req = request;
7276         err = rdev_scan(rdev, request);
7277
7278         if (!err) {
7279                 nl80211_send_scan_start(rdev, wdev);
7280                 if (wdev->netdev)
7281                         dev_hold(wdev->netdev);
7282         } else {
7283  out_free:
7284                 rdev->scan_req = NULL;
7285                 kfree(request);
7286         }
7287
7288  unlock:
7289         return err;
7290 }
7291
7292 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
7293 {
7294         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7295         struct wireless_dev *wdev = info->user_ptr[1];
7296
7297         if (!rdev->ops->abort_scan)
7298                 return -EOPNOTSUPP;
7299
7300         if (rdev->scan_msg)
7301                 return 0;
7302
7303         if (!rdev->scan_req)
7304                 return -ENOENT;
7305
7306         rdev_abort_scan(rdev, wdev);
7307         return 0;
7308 }
7309
7310 static int
7311 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
7312                                struct cfg80211_sched_scan_request *request,
7313                                struct nlattr **attrs)
7314 {
7315         int tmp, err, i = 0;
7316         struct nlattr *attr;
7317
7318         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7319                 u32 interval;
7320
7321                 /*
7322                  * If scan plans are not specified,
7323                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
7324                  * case one scan plan will be set with the specified scan
7325                  * interval and infinite number of iterations.
7326                  */
7327                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
7328                 if (!interval)
7329                         return -EINVAL;
7330
7331                 request->scan_plans[0].interval =
7332                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
7333                 if (!request->scan_plans[0].interval)
7334                         return -EINVAL;
7335
7336                 if (request->scan_plans[0].interval >
7337                     wiphy->max_sched_scan_plan_interval)
7338                         request->scan_plans[0].interval =
7339                                 wiphy->max_sched_scan_plan_interval;
7340
7341                 return 0;
7342         }
7343
7344         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
7345                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
7346
7347                 if (WARN_ON(i >= n_plans))
7348                         return -EINVAL;
7349
7350                 err = nla_parse_nested(plan, NL80211_SCHED_SCAN_PLAN_MAX,
7351                                        attr, nl80211_plan_policy, NULL);
7352                 if (err)
7353                         return err;
7354
7355                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
7356                         return -EINVAL;
7357
7358                 request->scan_plans[i].interval =
7359                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
7360                 if (!request->scan_plans[i].interval ||
7361                     request->scan_plans[i].interval >
7362                     wiphy->max_sched_scan_plan_interval)
7363                         return -EINVAL;
7364
7365                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
7366                         request->scan_plans[i].iterations =
7367                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
7368                         if (!request->scan_plans[i].iterations ||
7369                             (request->scan_plans[i].iterations >
7370                              wiphy->max_sched_scan_plan_iterations))
7371                                 return -EINVAL;
7372                 } else if (i < n_plans - 1) {
7373                         /*
7374                          * All scan plans but the last one must specify
7375                          * a finite number of iterations
7376                          */
7377                         return -EINVAL;
7378                 }
7379
7380                 i++;
7381         }
7382
7383         /*
7384          * The last scan plan must not specify the number of
7385          * iterations, it is supposed to run infinitely
7386          */
7387         if (request->scan_plans[n_plans - 1].iterations)
7388                 return  -EINVAL;
7389
7390         return 0;
7391 }
7392
7393 static struct cfg80211_sched_scan_request *
7394 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
7395                          struct nlattr **attrs, int max_match_sets)
7396 {
7397         struct cfg80211_sched_scan_request *request;
7398         struct nlattr *attr;
7399         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
7400         enum nl80211_band band;
7401         size_t ie_len;
7402         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
7403         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
7404
7405         if (!is_valid_ie_attr(attrs[NL80211_ATTR_IE]))
7406                 return ERR_PTR(-EINVAL);
7407
7408         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7409                 n_channels = validate_scan_freqs(
7410                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7411                 if (!n_channels)
7412                         return ERR_PTR(-EINVAL);
7413         } else {
7414                 n_channels = ieee80211_get_num_supported_channels(wiphy);
7415         }
7416
7417         if (attrs[NL80211_ATTR_SCAN_SSIDS])
7418                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7419                                     tmp)
7420                         n_ssids++;
7421
7422         if (n_ssids > wiphy->max_sched_scan_ssids)
7423                 return ERR_PTR(-EINVAL);
7424
7425         /*
7426          * First, count the number of 'real' matchsets. Due to an issue with
7427          * the old implementation, matchsets containing only the RSSI attribute
7428          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
7429          * RSSI for all matchsets, rather than their own matchset for reporting
7430          * all APs with a strong RSSI. This is needed to be compatible with
7431          * older userspace that treated a matchset with only the RSSI as the
7432          * global RSSI for all other matchsets - if there are other matchsets.
7433          */
7434         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7435                 nla_for_each_nested(attr,
7436                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7437                                     tmp) {
7438                         struct nlattr *rssi;
7439
7440                         err = nla_parse_nested(tb,
7441                                                NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7442                                                attr, nl80211_match_policy,
7443                                                NULL);
7444                         if (err)
7445                                 return ERR_PTR(err);
7446
7447                         /* SSID and BSSID are mutually exclusive */
7448                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
7449                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
7450                                 return ERR_PTR(-EINVAL);
7451
7452                         /* add other standalone attributes here */
7453                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
7454                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
7455                                 n_match_sets++;
7456                                 continue;
7457                         }
7458                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7459                         if (rssi)
7460                                 default_match_rssi = nla_get_s32(rssi);
7461                 }
7462         }
7463
7464         /* However, if there's no other matchset, add the RSSI one */
7465         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
7466                 n_match_sets = 1;
7467
7468         if (n_match_sets > max_match_sets)
7469                 return ERR_PTR(-EINVAL);
7470
7471         if (attrs[NL80211_ATTR_IE])
7472                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
7473         else
7474                 ie_len = 0;
7475
7476         if (ie_len > wiphy->max_sched_scan_ie_len)
7477                 return ERR_PTR(-EINVAL);
7478
7479         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7480                 /*
7481                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
7482                  * each scan plan already specifies its own interval
7483                  */
7484                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7485                         return ERR_PTR(-EINVAL);
7486
7487                 nla_for_each_nested(attr,
7488                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
7489                         n_plans++;
7490         } else {
7491                 /*
7492                  * The scan interval attribute is kept for backward
7493                  * compatibility. If no scan plans are specified and sched scan
7494                  * interval is specified, one scan plan will be set with this
7495                  * scan interval and infinite number of iterations.
7496                  */
7497                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7498                         return ERR_PTR(-EINVAL);
7499
7500                 n_plans = 1;
7501         }
7502
7503         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
7504                 return ERR_PTR(-EINVAL);
7505
7506         if (!wiphy_ext_feature_isset(
7507                     wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
7508             (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
7509              attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
7510                 return ERR_PTR(-EINVAL);
7511
7512         request = kzalloc(sizeof(*request)
7513                         + sizeof(*request->ssids) * n_ssids
7514                         + sizeof(*request->match_sets) * n_match_sets
7515                         + sizeof(*request->scan_plans) * n_plans
7516                         + sizeof(*request->channels) * n_channels
7517                         + ie_len, GFP_KERNEL);
7518         if (!request)
7519                 return ERR_PTR(-ENOMEM);
7520
7521         if (n_ssids)
7522                 request->ssids = (void *)&request->channels[n_channels];
7523         request->n_ssids = n_ssids;
7524         if (ie_len) {
7525                 if (n_ssids)
7526                         request->ie = (void *)(request->ssids + n_ssids);
7527                 else
7528                         request->ie = (void *)(request->channels + n_channels);
7529         }
7530
7531         if (n_match_sets) {
7532                 if (request->ie)
7533                         request->match_sets = (void *)(request->ie + ie_len);
7534                 else if (n_ssids)
7535                         request->match_sets =
7536                                 (void *)(request->ssids + n_ssids);
7537                 else
7538                         request->match_sets =
7539                                 (void *)(request->channels + n_channels);
7540         }
7541         request->n_match_sets = n_match_sets;
7542
7543         if (n_match_sets)
7544                 request->scan_plans = (void *)(request->match_sets +
7545                                                n_match_sets);
7546         else if (request->ie)
7547                 request->scan_plans = (void *)(request->ie + ie_len);
7548         else if (n_ssids)
7549                 request->scan_plans = (void *)(request->ssids + n_ssids);
7550         else
7551                 request->scan_plans = (void *)(request->channels + n_channels);
7552
7553         request->n_scan_plans = n_plans;
7554
7555         i = 0;
7556         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7557                 /* user specified, bail out if channel not found */
7558                 nla_for_each_nested(attr,
7559                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
7560                                     tmp) {
7561                         struct ieee80211_channel *chan;
7562
7563                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7564
7565                         if (!chan) {
7566                                 err = -EINVAL;
7567                                 goto out_free;
7568                         }
7569
7570                         /* ignore disabled channels */
7571                         if (chan->flags & IEEE80211_CHAN_DISABLED)
7572                                 continue;
7573
7574                         request->channels[i] = chan;
7575                         i++;
7576                 }
7577         } else {
7578                 /* all channels */
7579                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7580                         int j;
7581
7582                         if (!wiphy->bands[band])
7583                                 continue;
7584                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7585                                 struct ieee80211_channel *chan;
7586
7587                                 chan = &wiphy->bands[band]->channels[j];
7588
7589                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
7590                                         continue;
7591
7592                                 request->channels[i] = chan;
7593                                 i++;
7594                         }
7595                 }
7596         }
7597
7598         if (!i) {
7599                 err = -EINVAL;
7600                 goto out_free;
7601         }
7602
7603         request->n_channels = i;
7604
7605         i = 0;
7606         if (n_ssids) {
7607                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7608                                     tmp) {
7609                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7610                                 err = -EINVAL;
7611                                 goto out_free;
7612                         }
7613                         request->ssids[i].ssid_len = nla_len(attr);
7614                         memcpy(request->ssids[i].ssid, nla_data(attr),
7615                                nla_len(attr));
7616                         i++;
7617                 }
7618         }
7619
7620         i = 0;
7621         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7622                 nla_for_each_nested(attr,
7623                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7624                                     tmp) {
7625                         struct nlattr *ssid, *bssid, *rssi;
7626
7627                         err = nla_parse_nested(tb,
7628                                                NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7629                                                attr, nl80211_match_policy,
7630                                                NULL);
7631                         if (err)
7632                                 goto out_free;
7633                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
7634                         bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
7635                         if (ssid || bssid) {
7636                                 if (WARN_ON(i >= n_match_sets)) {
7637                                         /* this indicates a programming error,
7638                                          * the loop above should have verified
7639                                          * things properly
7640                                          */
7641                                         err = -EINVAL;
7642                                         goto out_free;
7643                                 }
7644
7645                                 if (ssid) {
7646                                         if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
7647                                                 err = -EINVAL;
7648                                                 goto out_free;
7649                                         }
7650                                         memcpy(request->match_sets[i].ssid.ssid,
7651                                                nla_data(ssid), nla_len(ssid));
7652                                         request->match_sets[i].ssid.ssid_len =
7653                                                 nla_len(ssid);
7654                                 }
7655                                 if (bssid) {
7656                                         if (nla_len(bssid) != ETH_ALEN) {
7657                                                 err = -EINVAL;
7658                                                 goto out_free;
7659                                         }
7660                                         memcpy(request->match_sets[i].bssid,
7661                                                nla_data(bssid), ETH_ALEN);
7662                                 }
7663
7664                                 /* special attribute - old implementation w/a */
7665                                 request->match_sets[i].rssi_thold =
7666                                         default_match_rssi;
7667                                 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7668                                 if (rssi)
7669                                         request->match_sets[i].rssi_thold =
7670                                                 nla_get_s32(rssi);
7671                         }
7672                         i++;
7673                 }
7674
7675                 /* there was no other matchset, so the RSSI one is alone */
7676                 if (i == 0 && n_match_sets)
7677                         request->match_sets[0].rssi_thold = default_match_rssi;
7678
7679                 request->min_rssi_thold = INT_MAX;
7680                 for (i = 0; i < n_match_sets; i++)
7681                         request->min_rssi_thold =
7682                                 min(request->match_sets[i].rssi_thold,
7683                                     request->min_rssi_thold);
7684         } else {
7685                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
7686         }
7687
7688         if (ie_len) {
7689                 request->ie_len = ie_len;
7690                 memcpy((void *)request->ie,
7691                        nla_data(attrs[NL80211_ATTR_IE]),
7692                        request->ie_len);
7693         }
7694
7695         err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
7696         if (err)
7697                 goto out_free;
7698
7699         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
7700                 request->delay =
7701                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
7702
7703         if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
7704                 request->relative_rssi = nla_get_s8(
7705                         attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
7706                 request->relative_rssi_set = true;
7707         }
7708
7709         if (request->relative_rssi_set &&
7710             attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
7711                 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
7712
7713                 rssi_adjust = nla_data(
7714                         attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
7715                 request->rssi_adjust.band = rssi_adjust->band;
7716                 request->rssi_adjust.delta = rssi_adjust->delta;
7717                 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
7718                         err = -EINVAL;
7719                         goto out_free;
7720                 }
7721         }
7722
7723         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
7724         if (err)
7725                 goto out_free;
7726
7727         request->scan_start = jiffies;
7728
7729         return request;
7730
7731 out_free:
7732         kfree(request);
7733         return ERR_PTR(err);
7734 }
7735
7736 static int nl80211_start_sched_scan(struct sk_buff *skb,
7737                                     struct genl_info *info)
7738 {
7739         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7740         struct net_device *dev = info->user_ptr[1];
7741         struct wireless_dev *wdev = dev->ieee80211_ptr;
7742         struct cfg80211_sched_scan_request *sched_scan_req;
7743         bool want_multi;
7744         int err;
7745
7746         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
7747                 return -EOPNOTSUPP;
7748
7749         want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
7750         err = cfg80211_sched_scan_req_possible(rdev, want_multi);
7751         if (err)
7752                 return err;
7753
7754         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
7755                                                   info->attrs,
7756                                                   rdev->wiphy.max_match_sets);
7757
7758         err = PTR_ERR_OR_ZERO(sched_scan_req);
7759         if (err)
7760                 goto out_err;
7761
7762         /* leave request id zero for legacy request
7763          * or if driver does not support multi-scheduled scan
7764          */
7765         if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1) {
7766                 while (!sched_scan_req->reqid)
7767                         sched_scan_req->reqid = rdev->wiphy.cookie_counter++;
7768         }
7769
7770         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
7771         if (err)
7772                 goto out_free;
7773
7774         sched_scan_req->dev = dev;
7775         sched_scan_req->wiphy = &rdev->wiphy;
7776
7777         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
7778                 sched_scan_req->owner_nlportid = info->snd_portid;
7779
7780         cfg80211_add_sched_scan_req(rdev, sched_scan_req);
7781
7782         nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
7783         return 0;
7784
7785 out_free:
7786         kfree(sched_scan_req);
7787 out_err:
7788         return err;
7789 }
7790
7791 static int nl80211_stop_sched_scan(struct sk_buff *skb,
7792                                    struct genl_info *info)
7793 {
7794         struct cfg80211_sched_scan_request *req;
7795         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7796         u64 cookie;
7797
7798         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
7799                 return -EOPNOTSUPP;
7800
7801         if (info->attrs[NL80211_ATTR_COOKIE]) {
7802                 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7803                 return __cfg80211_stop_sched_scan(rdev, cookie, false);
7804         }
7805
7806         req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
7807                                      struct cfg80211_sched_scan_request,
7808                                      list);
7809         if (!req || req->reqid ||
7810             (req->owner_nlportid &&
7811              req->owner_nlportid != info->snd_portid))
7812                 return -ENOENT;
7813
7814         return cfg80211_stop_sched_scan_req(rdev, req, false);
7815 }
7816
7817 static int nl80211_start_radar_detection(struct sk_buff *skb,
7818                                          struct genl_info *info)
7819 {
7820         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7821         struct net_device *dev = info->user_ptr[1];
7822         struct wireless_dev *wdev = dev->ieee80211_ptr;
7823         struct wiphy *wiphy = wdev->wiphy;
7824         struct cfg80211_chan_def chandef;
7825         enum nl80211_dfs_regions dfs_region;
7826         unsigned int cac_time_ms;
7827         int err;
7828
7829         dfs_region = reg_get_dfs_region(wiphy);
7830         if (dfs_region == NL80211_DFS_UNSET)
7831                 return -EINVAL;
7832
7833         err = nl80211_parse_chandef(rdev, info, &chandef);
7834         if (err)
7835                 return err;
7836
7837         if (netif_carrier_ok(dev))
7838                 return -EBUSY;
7839
7840         if (wdev->cac_started)
7841                 return -EBUSY;
7842
7843         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
7844         if (err < 0)
7845                 return err;
7846
7847         if (err == 0)
7848                 return -EINVAL;
7849
7850         if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
7851                 return -EINVAL;
7852
7853         /* CAC start is offloaded to HW and can't be started manually */
7854         if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
7855                 return -EOPNOTSUPP;
7856
7857         if (!rdev->ops->start_radar_detection)
7858                 return -EOPNOTSUPP;
7859
7860         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
7861         if (WARN_ON(!cac_time_ms))
7862                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
7863
7864         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
7865         if (!err) {
7866                 wdev->chandef = chandef;
7867                 wdev->cac_started = true;
7868                 wdev->cac_start_time = jiffies;
7869                 wdev->cac_time_ms = cac_time_ms;
7870         }
7871         return err;
7872 }
7873
7874 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
7875 {
7876         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7877         struct net_device *dev = info->user_ptr[1];
7878         struct wireless_dev *wdev = dev->ieee80211_ptr;
7879         struct cfg80211_csa_settings params;
7880         /* csa_attrs is defined static to avoid waste of stack size - this
7881          * function is called under RTNL lock, so this should not be a problem.
7882          */
7883         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
7884         int err;
7885         bool need_new_beacon = false;
7886         bool need_handle_dfs_flag = true;
7887         int len, i;
7888         u32 cs_count;
7889
7890         if (!rdev->ops->channel_switch ||
7891             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
7892                 return -EOPNOTSUPP;
7893
7894         switch (dev->ieee80211_ptr->iftype) {
7895         case NL80211_IFTYPE_AP:
7896         case NL80211_IFTYPE_P2P_GO:
7897                 need_new_beacon = true;
7898                 /* For all modes except AP the handle_dfs flag needs to be
7899                  * supplied to tell the kernel that userspace will handle radar
7900                  * events when they happen. Otherwise a switch to a channel
7901                  * requiring DFS will be rejected.
7902                  */
7903                 need_handle_dfs_flag = false;
7904
7905                 /* useless if AP is not running */
7906                 if (!wdev->beacon_interval)
7907                         return -ENOTCONN;
7908                 break;
7909         case NL80211_IFTYPE_ADHOC:
7910                 if (!wdev->ssid_len)
7911                         return -ENOTCONN;
7912                 break;
7913         case NL80211_IFTYPE_MESH_POINT:
7914                 if (!wdev->mesh_id_len)
7915                         return -ENOTCONN;
7916                 break;
7917         default:
7918                 return -EOPNOTSUPP;
7919         }
7920
7921         memset(&params, 0, sizeof(params));
7922
7923         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7924             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
7925                 return -EINVAL;
7926
7927         /* only important for AP, IBSS and mesh create IEs internally */
7928         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
7929                 return -EINVAL;
7930
7931         /* Even though the attribute is u32, the specification says
7932          * u8, so let's make sure we don't overflow.
7933          */
7934         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
7935         if (cs_count > 255)
7936                 return -EINVAL;
7937
7938         params.count = cs_count;
7939
7940         if (!need_new_beacon)
7941                 goto skip_beacons;
7942
7943         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
7944         if (err)
7945                 return err;
7946
7947         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
7948                                info->attrs[NL80211_ATTR_CSA_IES],
7949                                nl80211_policy, info->extack);
7950         if (err)
7951                 return err;
7952
7953         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
7954         if (err)
7955                 return err;
7956
7957         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
7958                 return -EINVAL;
7959
7960         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7961         if (!len || (len % sizeof(u16)))
7962                 return -EINVAL;
7963
7964         params.n_counter_offsets_beacon = len / sizeof(u16);
7965         if (rdev->wiphy.max_num_csa_counters &&
7966             (params.n_counter_offsets_beacon >
7967              rdev->wiphy.max_num_csa_counters))
7968                 return -EINVAL;
7969
7970         params.counter_offsets_beacon =
7971                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7972
7973         /* sanity checks - counters should fit and be the same */
7974         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
7975                 u16 offset = params.counter_offsets_beacon[i];
7976
7977                 if (offset >= params.beacon_csa.tail_len)
7978                         return -EINVAL;
7979
7980                 if (params.beacon_csa.tail[offset] != params.count)
7981                         return -EINVAL;
7982         }
7983
7984         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
7985                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7986                 if (!len || (len % sizeof(u16)))
7987                         return -EINVAL;
7988
7989                 params.n_counter_offsets_presp = len / sizeof(u16);
7990                 if (rdev->wiphy.max_num_csa_counters &&
7991                     (params.n_counter_offsets_presp >
7992                      rdev->wiphy.max_num_csa_counters))
7993                         return -EINVAL;
7994
7995                 params.counter_offsets_presp =
7996                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7997
7998                 /* sanity checks - counters should fit and be the same */
7999                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
8000                         u16 offset = params.counter_offsets_presp[i];
8001
8002                         if (offset >= params.beacon_csa.probe_resp_len)
8003                                 return -EINVAL;
8004
8005                         if (params.beacon_csa.probe_resp[offset] !=
8006                             params.count)
8007                                 return -EINVAL;
8008                 }
8009         }
8010
8011 skip_beacons:
8012         err = nl80211_parse_chandef(rdev, info, &params.chandef);
8013         if (err)
8014                 return err;
8015
8016         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
8017                                            wdev->iftype))
8018                 return -EINVAL;
8019
8020         err = cfg80211_chandef_dfs_required(wdev->wiphy,
8021                                             &params.chandef,
8022                                             wdev->iftype);
8023         if (err < 0)
8024                 return err;
8025
8026         if (err > 0) {
8027                 params.radar_required = true;
8028                 if (need_handle_dfs_flag &&
8029                     !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
8030                         return -EINVAL;
8031                 }
8032         }
8033
8034         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
8035                 params.block_tx = true;
8036
8037         wdev_lock(wdev);
8038         err = rdev_channel_switch(rdev, dev, &params);
8039         wdev_unlock(wdev);
8040
8041         return err;
8042 }
8043
8044 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
8045                             u32 seq, int flags,
8046                             struct cfg80211_registered_device *rdev,
8047                             struct wireless_dev *wdev,
8048                             struct cfg80211_internal_bss *intbss)
8049 {
8050         struct cfg80211_bss *res = &intbss->pub;
8051         const struct cfg80211_bss_ies *ies;
8052         void *hdr;
8053         struct nlattr *bss;
8054
8055         ASSERT_WDEV_LOCK(wdev);
8056
8057         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
8058                              NL80211_CMD_NEW_SCAN_RESULTS);
8059         if (!hdr)
8060                 return -1;
8061
8062         genl_dump_check_consistent(cb, hdr);
8063
8064         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
8065                 goto nla_put_failure;
8066         if (wdev->netdev &&
8067             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
8068                 goto nla_put_failure;
8069         if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
8070                               NL80211_ATTR_PAD))
8071                 goto nla_put_failure;
8072
8073         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
8074         if (!bss)
8075                 goto nla_put_failure;
8076         if ((!is_zero_ether_addr(res->bssid) &&
8077              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
8078                 goto nla_put_failure;
8079
8080         rcu_read_lock();
8081         /* indicate whether we have probe response data or not */
8082         if (rcu_access_pointer(res->proberesp_ies) &&
8083             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
8084                 goto fail_unlock_rcu;
8085
8086         /* this pointer prefers to be pointed to probe response data
8087          * but is always valid
8088          */
8089         ies = rcu_dereference(res->ies);
8090         if (ies) {
8091                 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
8092                                       NL80211_BSS_PAD))
8093                         goto fail_unlock_rcu;
8094                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
8095                                         ies->len, ies->data))
8096                         goto fail_unlock_rcu;
8097         }
8098
8099         /* and this pointer is always (unless driver didn't know) beacon data */
8100         ies = rcu_dereference(res->beacon_ies);
8101         if (ies && ies->from_beacon) {
8102                 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
8103                                       NL80211_BSS_PAD))
8104                         goto fail_unlock_rcu;
8105                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
8106                                         ies->len, ies->data))
8107                         goto fail_unlock_rcu;
8108         }
8109         rcu_read_unlock();
8110
8111         if (res->beacon_interval &&
8112             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
8113                 goto nla_put_failure;
8114         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
8115             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
8116             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
8117             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
8118                         jiffies_to_msecs(jiffies - intbss->ts)))
8119                 goto nla_put_failure;
8120
8121         if (intbss->parent_tsf &&
8122             (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
8123                                intbss->parent_tsf, NL80211_BSS_PAD) ||
8124              nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
8125                      intbss->parent_bssid)))
8126                 goto nla_put_failure;
8127
8128         if (intbss->ts_boottime &&
8129             nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
8130                               intbss->ts_boottime, NL80211_BSS_PAD))
8131                 goto nla_put_failure;
8132
8133         if (!nl80211_put_signal(msg, intbss->pub.chains,
8134                                 intbss->pub.chain_signal,
8135                                 NL80211_BSS_CHAIN_SIGNAL))
8136                 goto nla_put_failure;
8137
8138         switch (rdev->wiphy.signal_type) {
8139         case CFG80211_SIGNAL_TYPE_MBM:
8140                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
8141                         goto nla_put_failure;
8142                 break;
8143         case CFG80211_SIGNAL_TYPE_UNSPEC:
8144                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
8145                         goto nla_put_failure;
8146                 break;
8147         default:
8148                 break;
8149         }
8150
8151         switch (wdev->iftype) {
8152         case NL80211_IFTYPE_P2P_CLIENT:
8153         case NL80211_IFTYPE_STATION:
8154                 if (intbss == wdev->current_bss &&
8155                     nla_put_u32(msg, NL80211_BSS_STATUS,
8156                                 NL80211_BSS_STATUS_ASSOCIATED))
8157                         goto nla_put_failure;
8158                 break;
8159         case NL80211_IFTYPE_ADHOC:
8160                 if (intbss == wdev->current_bss &&
8161                     nla_put_u32(msg, NL80211_BSS_STATUS,
8162                                 NL80211_BSS_STATUS_IBSS_JOINED))
8163                         goto nla_put_failure;
8164                 break;
8165         default:
8166                 break;
8167         }
8168
8169         nla_nest_end(msg, bss);
8170
8171         genlmsg_end(msg, hdr);
8172         return 0;
8173
8174  fail_unlock_rcu:
8175         rcu_read_unlock();
8176  nla_put_failure:
8177         genlmsg_cancel(msg, hdr);
8178         return -EMSGSIZE;
8179 }
8180
8181 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
8182 {
8183         struct cfg80211_registered_device *rdev;
8184         struct cfg80211_internal_bss *scan;
8185         struct wireless_dev *wdev;
8186         int start = cb->args[2], idx = 0;
8187         int err;
8188
8189         rtnl_lock();
8190         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
8191         if (err) {
8192                 rtnl_unlock();
8193                 return err;
8194         }
8195
8196         wdev_lock(wdev);
8197         spin_lock_bh(&rdev->bss_lock);
8198
8199         /*
8200          * dump_scan will be called multiple times to break up the scan results
8201          * into multiple messages.  It is unlikely that any more bss-es will be
8202          * expired after the first call, so only call only call this on the
8203          * first dump_scan invocation.
8204          */
8205         if (start == 0)
8206                 cfg80211_bss_expire(rdev);
8207
8208         cb->seq = rdev->bss_generation;
8209
8210         list_for_each_entry(scan, &rdev->bss_list, list) {
8211                 if (++idx <= start)
8212                         continue;
8213                 if (nl80211_send_bss(skb, cb,
8214                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8215                                 rdev, wdev, scan) < 0) {
8216                         idx--;
8217                         break;
8218                 }
8219         }
8220
8221         spin_unlock_bh(&rdev->bss_lock);
8222         wdev_unlock(wdev);
8223
8224         cb->args[2] = idx;
8225         rtnl_unlock();
8226
8227         return skb->len;
8228 }
8229
8230 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
8231                                int flags, struct net_device *dev,
8232                                bool allow_radio_stats,
8233                                struct survey_info *survey)
8234 {
8235         void *hdr;
8236         struct nlattr *infoattr;
8237
8238         /* skip radio stats if userspace didn't request them */
8239         if (!survey->channel && !allow_radio_stats)
8240                 return 0;
8241
8242         hdr = nl80211hdr_put(msg, portid, seq, flags,
8243                              NL80211_CMD_NEW_SURVEY_RESULTS);
8244         if (!hdr)
8245                 return -ENOMEM;
8246
8247         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
8248                 goto nla_put_failure;
8249
8250         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
8251         if (!infoattr)
8252                 goto nla_put_failure;
8253
8254         if (survey->channel &&
8255             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
8256                         survey->channel->center_freq))
8257                 goto nla_put_failure;
8258
8259         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
8260             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
8261                 goto nla_put_failure;
8262         if ((survey->filled & SURVEY_INFO_IN_USE) &&
8263             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
8264                 goto nla_put_failure;
8265         if ((survey->filled & SURVEY_INFO_TIME) &&
8266             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
8267                         survey->time, NL80211_SURVEY_INFO_PAD))
8268                 goto nla_put_failure;
8269         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
8270             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
8271                               survey->time_busy, NL80211_SURVEY_INFO_PAD))
8272                 goto nla_put_failure;
8273         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
8274             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
8275                               survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
8276                 goto nla_put_failure;
8277         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
8278             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
8279                               survey->time_rx, NL80211_SURVEY_INFO_PAD))
8280                 goto nla_put_failure;
8281         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
8282             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
8283                               survey->time_tx, NL80211_SURVEY_INFO_PAD))
8284                 goto nla_put_failure;
8285         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
8286             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
8287                               survey->time_scan, NL80211_SURVEY_INFO_PAD))
8288                 goto nla_put_failure;
8289
8290         nla_nest_end(msg, infoattr);
8291
8292         genlmsg_end(msg, hdr);
8293         return 0;
8294
8295  nla_put_failure:
8296         genlmsg_cancel(msg, hdr);
8297         return -EMSGSIZE;
8298 }
8299
8300 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
8301 {
8302         struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
8303         struct survey_info survey;
8304         struct cfg80211_registered_device *rdev;
8305         struct wireless_dev *wdev;
8306         int survey_idx = cb->args[2];
8307         int res;
8308         bool radio_stats;
8309
8310         rtnl_lock();
8311         res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
8312         if (res)
8313                 goto out_err;
8314
8315         /* prepare_wdev_dump parsed the attributes */
8316         radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
8317
8318         if (!wdev->netdev) {
8319                 res = -EINVAL;
8320                 goto out_err;
8321         }
8322
8323         if (!rdev->ops->dump_survey) {
8324                 res = -EOPNOTSUPP;
8325                 goto out_err;
8326         }
8327
8328         while (1) {
8329                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
8330                 if (res == -ENOENT)
8331                         break;
8332                 if (res)
8333                         goto out_err;
8334
8335                 /* don't send disabled channels, but do send non-channel data */
8336                 if (survey.channel &&
8337                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
8338                         survey_idx++;
8339                         continue;
8340                 }
8341
8342                 if (nl80211_send_survey(skb,
8343                                 NETLINK_CB(cb->skb).portid,
8344                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8345                                 wdev->netdev, radio_stats, &survey) < 0)
8346                         goto out;
8347                 survey_idx++;
8348         }
8349
8350  out:
8351         cb->args[2] = survey_idx;
8352         res = skb->len;
8353  out_err:
8354         rtnl_unlock();
8355         return res;
8356 }
8357
8358 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
8359 {
8360         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
8361                                   NL80211_WPA_VERSION_2));
8362 }
8363
8364 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
8365 {
8366         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8367         struct net_device *dev = info->user_ptr[1];
8368         struct ieee80211_channel *chan;
8369         const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL;
8370         int err, ssid_len, ie_len = 0, auth_data_len = 0;
8371         enum nl80211_auth_type auth_type;
8372         struct key_parse key;
8373         bool local_state_change;
8374
8375         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8376                 return -EINVAL;
8377
8378         if (!info->attrs[NL80211_ATTR_MAC])
8379                 return -EINVAL;
8380
8381         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
8382                 return -EINVAL;
8383
8384         if (!info->attrs[NL80211_ATTR_SSID])
8385                 return -EINVAL;
8386
8387         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
8388                 return -EINVAL;
8389
8390         err = nl80211_parse_key(info, &key);
8391         if (err)
8392                 return err;
8393
8394         if (key.idx >= 0) {
8395                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
8396                         return -EINVAL;
8397                 if (!key.p.key || !key.p.key_len)
8398                         return -EINVAL;
8399                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
8400                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
8401                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
8402                      key.p.key_len != WLAN_KEY_LEN_WEP104))
8403                         return -EINVAL;
8404                 if (key.idx > 3)
8405                         return -EINVAL;
8406         } else {
8407                 key.p.key_len = 0;
8408                 key.p.key = NULL;
8409         }
8410
8411         if (key.idx >= 0) {
8412                 int i;
8413                 bool ok = false;
8414
8415                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
8416                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
8417                                 ok = true;
8418                                 break;
8419                         }
8420                 }
8421                 if (!ok)
8422                         return -EINVAL;
8423         }
8424
8425         if (!rdev->ops->auth)
8426                 return -EOPNOTSUPP;
8427
8428         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8429             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8430                 return -EOPNOTSUPP;
8431
8432         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8433         chan = nl80211_get_valid_chan(&rdev->wiphy,
8434                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8435         if (!chan)
8436                 return -EINVAL;
8437
8438         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8439         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8440
8441         if (info->attrs[NL80211_ATTR_IE]) {
8442                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8443                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8444         }
8445
8446         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8447         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
8448                 return -EINVAL;
8449
8450         if ((auth_type == NL80211_AUTHTYPE_SAE ||
8451              auth_type == NL80211_AUTHTYPE_FILS_SK ||
8452              auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
8453              auth_type == NL80211_AUTHTYPE_FILS_PK) &&
8454             !info->attrs[NL80211_ATTR_AUTH_DATA])
8455                 return -EINVAL;
8456
8457         if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
8458                 if (auth_type != NL80211_AUTHTYPE_SAE &&
8459                     auth_type != NL80211_AUTHTYPE_FILS_SK &&
8460                     auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
8461                     auth_type != NL80211_AUTHTYPE_FILS_PK)
8462                         return -EINVAL;
8463                 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
8464                 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
8465                 /* need to include at least Auth Transaction and Status Code */
8466                 if (auth_data_len < 4)
8467                         return -EINVAL;
8468         }
8469
8470         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8471
8472         /*
8473          * Since we no longer track auth state, ignore
8474          * requests to only change local state.
8475          */
8476         if (local_state_change)
8477                 return 0;
8478
8479         wdev_lock(dev->ieee80211_ptr);
8480         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
8481                                  ssid, ssid_len, ie, ie_len,
8482                                  key.p.key, key.p.key_len, key.idx,
8483                                  auth_data, auth_data_len);
8484         wdev_unlock(dev->ieee80211_ptr);
8485         return err;
8486 }
8487
8488 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
8489                                      struct genl_info *info)
8490 {
8491         if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8492                 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
8493                 return -EINVAL;
8494         }
8495
8496         if (!rdev->ops->tx_control_port ||
8497             !wiphy_ext_feature_isset(&rdev->wiphy,
8498                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
8499                 return -EOPNOTSUPP;
8500
8501         return 0;
8502 }
8503
8504 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
8505                                    struct genl_info *info,
8506                                    struct cfg80211_crypto_settings *settings,
8507                                    int cipher_limit)
8508 {
8509         memset(settings, 0, sizeof(*settings));
8510
8511         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
8512
8513         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
8514                 u16 proto;
8515
8516                 proto = nla_get_u16(
8517                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
8518                 settings->control_port_ethertype = cpu_to_be16(proto);
8519                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
8520                     proto != ETH_P_PAE)
8521                         return -EINVAL;
8522                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
8523                         settings->control_port_no_encrypt = true;
8524         } else
8525                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
8526
8527         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
8528                 int r = validate_pae_over_nl80211(rdev, info);
8529
8530                 if (r < 0)
8531                         return r;
8532
8533                 settings->control_port_over_nl80211 = true;
8534         }
8535
8536         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
8537                 void *data;
8538                 int len, i;
8539
8540                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8541                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8542                 settings->n_ciphers_pairwise = len / sizeof(u32);
8543
8544                 if (len % sizeof(u32))
8545                         return -EINVAL;
8546
8547                 if (settings->n_ciphers_pairwise > cipher_limit)
8548                         return -EINVAL;
8549
8550                 memcpy(settings->ciphers_pairwise, data, len);
8551
8552                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
8553                         if (!cfg80211_supported_cipher_suite(
8554                                         &rdev->wiphy,
8555                                         settings->ciphers_pairwise[i]))
8556                                 return -EINVAL;
8557         }
8558
8559         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
8560                 settings->cipher_group =
8561                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
8562                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
8563                                                      settings->cipher_group))
8564                         return -EINVAL;
8565         }
8566
8567         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
8568                 settings->wpa_versions =
8569                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
8570                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
8571                         return -EINVAL;
8572         }
8573
8574         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
8575                 void *data;
8576                 int len;
8577
8578                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
8579                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
8580                 settings->n_akm_suites = len / sizeof(u32);
8581
8582                 if (len % sizeof(u32))
8583                         return -EINVAL;
8584
8585                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
8586                         return -EINVAL;
8587
8588                 memcpy(settings->akm_suites, data, len);
8589         }
8590
8591         if (info->attrs[NL80211_ATTR_PMK]) {
8592                 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
8593                         return -EINVAL;
8594                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8595                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK))
8596                         return -EINVAL;
8597                 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
8598         }
8599
8600         return 0;
8601 }
8602
8603 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
8604 {
8605         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8606         struct net_device *dev = info->user_ptr[1];
8607         struct ieee80211_channel *chan;
8608         struct cfg80211_assoc_request req = {};
8609         const u8 *bssid, *ssid;
8610         int err, ssid_len = 0;
8611
8612         if (dev->ieee80211_ptr->conn_owner_nlportid &&
8613             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
8614                 return -EPERM;
8615
8616         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8617                 return -EINVAL;
8618
8619         if (!info->attrs[NL80211_ATTR_MAC] ||
8620             !info->attrs[NL80211_ATTR_SSID] ||
8621             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
8622                 return -EINVAL;
8623
8624         if (!rdev->ops->assoc)
8625                 return -EOPNOTSUPP;
8626
8627         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8628             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8629                 return -EOPNOTSUPP;
8630
8631         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8632
8633         chan = nl80211_get_valid_chan(&rdev->wiphy,
8634                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8635         if (!chan)
8636                 return -EINVAL;
8637
8638         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8639         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8640
8641         if (info->attrs[NL80211_ATTR_IE]) {
8642                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8643                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8644         }
8645
8646         if (info->attrs[NL80211_ATTR_USE_MFP]) {
8647                 enum nl80211_mfp mfp =
8648                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
8649                 if (mfp == NL80211_MFP_REQUIRED)
8650                         req.use_mfp = true;
8651                 else if (mfp != NL80211_MFP_NO)
8652                         return -EINVAL;
8653         }
8654
8655         if (info->attrs[NL80211_ATTR_PREV_BSSID])
8656                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
8657
8658         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
8659                 req.flags |= ASSOC_REQ_DISABLE_HT;
8660
8661         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8662                 memcpy(&req.ht_capa_mask,
8663                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8664                        sizeof(req.ht_capa_mask));
8665
8666         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8667                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8668                         return -EINVAL;
8669                 memcpy(&req.ht_capa,
8670                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8671                        sizeof(req.ht_capa));
8672         }
8673
8674         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
8675                 req.flags |= ASSOC_REQ_DISABLE_VHT;
8676
8677         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8678                 memcpy(&req.vht_capa_mask,
8679                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
8680                        sizeof(req.vht_capa_mask));
8681
8682         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
8683                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8684                         return -EINVAL;
8685                 memcpy(&req.vht_capa,
8686                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
8687                        sizeof(req.vht_capa));
8688         }
8689
8690         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
8691                 if (!((rdev->wiphy.features &
8692                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
8693                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
8694                     !wiphy_ext_feature_isset(&rdev->wiphy,
8695                                              NL80211_EXT_FEATURE_RRM))
8696                         return -EINVAL;
8697                 req.flags |= ASSOC_REQ_USE_RRM;
8698         }
8699
8700         if (info->attrs[NL80211_ATTR_FILS_KEK]) {
8701                 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
8702                 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
8703                 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
8704                         return -EINVAL;
8705                 req.fils_nonces =
8706                         nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
8707         }
8708
8709         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
8710         if (!err) {
8711                 wdev_lock(dev->ieee80211_ptr);
8712
8713                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
8714                                           ssid, ssid_len, &req);
8715
8716                 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8717                         dev->ieee80211_ptr->conn_owner_nlportid =
8718                                 info->snd_portid;
8719                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
8720                                bssid, ETH_ALEN);
8721                 }
8722
8723                 wdev_unlock(dev->ieee80211_ptr);
8724         }
8725
8726         return err;
8727 }
8728
8729 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
8730 {
8731         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8732         struct net_device *dev = info->user_ptr[1];
8733         const u8 *ie = NULL, *bssid;
8734         int ie_len = 0, err;
8735         u16 reason_code;
8736         bool local_state_change;
8737
8738         if (dev->ieee80211_ptr->conn_owner_nlportid &&
8739             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
8740                 return -EPERM;
8741
8742         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8743                 return -EINVAL;
8744
8745         if (!info->attrs[NL80211_ATTR_MAC])
8746                 return -EINVAL;
8747
8748         if (!info->attrs[NL80211_ATTR_REASON_CODE])
8749                 return -EINVAL;
8750
8751         if (!rdev->ops->deauth)
8752                 return -EOPNOTSUPP;
8753
8754         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8755             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8756                 return -EOPNOTSUPP;
8757
8758         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8759
8760         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8761         if (reason_code == 0) {
8762                 /* Reason Code 0 is reserved */
8763                 return -EINVAL;
8764         }
8765
8766         if (info->attrs[NL80211_ATTR_IE]) {
8767                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8768                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8769         }
8770
8771         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8772
8773         wdev_lock(dev->ieee80211_ptr);
8774         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
8775                                    local_state_change);
8776         wdev_unlock(dev->ieee80211_ptr);
8777         return err;
8778 }
8779
8780 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
8781 {
8782         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8783         struct net_device *dev = info->user_ptr[1];
8784         const u8 *ie = NULL, *bssid;
8785         int ie_len = 0, err;
8786         u16 reason_code;
8787         bool local_state_change;
8788
8789         if (dev->ieee80211_ptr->conn_owner_nlportid &&
8790             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
8791                 return -EPERM;
8792
8793         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8794                 return -EINVAL;
8795
8796         if (!info->attrs[NL80211_ATTR_MAC])
8797                 return -EINVAL;
8798
8799         if (!info->attrs[NL80211_ATTR_REASON_CODE])
8800                 return -EINVAL;
8801
8802         if (!rdev->ops->disassoc)
8803                 return -EOPNOTSUPP;
8804
8805         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8806             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8807                 return -EOPNOTSUPP;
8808
8809         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8810
8811         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8812         if (reason_code == 0) {
8813                 /* Reason Code 0 is reserved */
8814                 return -EINVAL;
8815         }
8816
8817         if (info->attrs[NL80211_ATTR_IE]) {
8818                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8819                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8820         }
8821
8822         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8823
8824         wdev_lock(dev->ieee80211_ptr);
8825         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
8826                                      local_state_change);
8827         wdev_unlock(dev->ieee80211_ptr);
8828         return err;
8829 }
8830
8831 static bool
8832 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
8833                          int mcast_rate[NUM_NL80211_BANDS],
8834                          int rateval)
8835 {
8836         struct wiphy *wiphy = &rdev->wiphy;
8837         bool found = false;
8838         int band, i;
8839
8840         for (band = 0; band < NUM_NL80211_BANDS; band++) {
8841                 struct ieee80211_supported_band *sband;
8842
8843                 sband = wiphy->bands[band];
8844                 if (!sband)
8845                         continue;
8846
8847                 for (i = 0; i < sband->n_bitrates; i++) {
8848                         if (sband->bitrates[i].bitrate == rateval) {
8849                                 mcast_rate[band] = i + 1;
8850                                 found = true;
8851                                 break;
8852                         }
8853                 }
8854         }
8855
8856         return found;
8857 }
8858
8859 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
8860 {
8861         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8862         struct net_device *dev = info->user_ptr[1];
8863         struct cfg80211_ibss_params ibss;
8864         struct wiphy *wiphy;
8865         struct cfg80211_cached_keys *connkeys = NULL;
8866         int err;
8867
8868         memset(&ibss, 0, sizeof(ibss));
8869
8870         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8871                 return -EINVAL;
8872
8873         if (!info->attrs[NL80211_ATTR_SSID] ||
8874             !nla_len(info->attrs[NL80211_ATTR_SSID]))
8875                 return -EINVAL;
8876
8877         ibss.beacon_interval = 100;
8878
8879         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
8880                 ibss.beacon_interval =
8881                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8882
8883         err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
8884                                            ibss.beacon_interval);
8885         if (err)
8886                 return err;
8887
8888         if (!rdev->ops->join_ibss)
8889                 return -EOPNOTSUPP;
8890
8891         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
8892                 return -EOPNOTSUPP;
8893
8894         wiphy = &rdev->wiphy;
8895
8896         if (info->attrs[NL80211_ATTR_MAC]) {
8897                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8898
8899                 if (!is_valid_ether_addr(ibss.bssid))
8900                         return -EINVAL;
8901         }
8902         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8903         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8904
8905         if (info->attrs[NL80211_ATTR_IE]) {
8906                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8907                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8908         }
8909
8910         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
8911         if (err)
8912                 return err;
8913
8914         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
8915                                      NL80211_IFTYPE_ADHOC))
8916                 return -EINVAL;
8917
8918         switch (ibss.chandef.width) {
8919         case NL80211_CHAN_WIDTH_5:
8920         case NL80211_CHAN_WIDTH_10:
8921         case NL80211_CHAN_WIDTH_20_NOHT:
8922                 break;
8923         case NL80211_CHAN_WIDTH_20:
8924         case NL80211_CHAN_WIDTH_40:
8925                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8926                         return -EINVAL;
8927                 break;
8928         case NL80211_CHAN_WIDTH_80:
8929         case NL80211_CHAN_WIDTH_80P80:
8930         case NL80211_CHAN_WIDTH_160:
8931                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8932                         return -EINVAL;
8933                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8934                                              NL80211_EXT_FEATURE_VHT_IBSS))
8935                         return -EINVAL;
8936                 break;
8937         default:
8938                 return -EINVAL;
8939         }
8940
8941         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
8942         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
8943
8944         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8945                 u8 *rates =
8946                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8947                 int n_rates =
8948                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8949                 struct ieee80211_supported_band *sband =
8950                         wiphy->bands[ibss.chandef.chan->band];
8951
8952                 err = ieee80211_get_ratemask(sband, rates, n_rates,
8953                                              &ibss.basic_rates);
8954                 if (err)
8955                         return err;
8956         }
8957
8958         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8959                 memcpy(&ibss.ht_capa_mask,
8960                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8961                        sizeof(ibss.ht_capa_mask));
8962
8963         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8964                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8965                         return -EINVAL;
8966                 memcpy(&ibss.ht_capa,
8967                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8968                        sizeof(ibss.ht_capa));
8969         }
8970
8971         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
8972             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
8973                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
8974                 return -EINVAL;
8975
8976         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
8977                 bool no_ht = false;
8978
8979                 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
8980                 if (IS_ERR(connkeys))
8981                         return PTR_ERR(connkeys);
8982
8983                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
8984                     no_ht) {
8985                         kzfree(connkeys);
8986                         return -EINVAL;
8987                 }
8988         }
8989
8990         ibss.control_port =
8991                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
8992
8993         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
8994                 int r = validate_pae_over_nl80211(rdev, info);
8995
8996                 if (r < 0)
8997                         return r;
8998
8999                 ibss.control_port_over_nl80211 = true;
9000         }
9001
9002         ibss.userspace_handles_dfs =
9003                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
9004
9005         wdev_lock(dev->ieee80211_ptr);
9006         err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
9007         if (err)
9008                 kzfree(connkeys);
9009         else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
9010                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
9011         wdev_unlock(dev->ieee80211_ptr);
9012
9013         return err;
9014 }
9015
9016 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
9017 {
9018         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9019         struct net_device *dev = info->user_ptr[1];
9020
9021         if (!rdev->ops->leave_ibss)
9022                 return -EOPNOTSUPP;
9023
9024         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
9025                 return -EOPNOTSUPP;
9026
9027         return cfg80211_leave_ibss(rdev, dev, false);
9028 }
9029
9030 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
9031 {
9032         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9033         struct net_device *dev = info->user_ptr[1];
9034         int mcast_rate[NUM_NL80211_BANDS];
9035         u32 nla_rate;
9036         int err;
9037
9038         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
9039             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
9040             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
9041                 return -EOPNOTSUPP;
9042
9043         if (!rdev->ops->set_mcast_rate)
9044                 return -EOPNOTSUPP;
9045
9046         memset(mcast_rate, 0, sizeof(mcast_rate));
9047
9048         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
9049                 return -EINVAL;
9050
9051         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
9052         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
9053                 return -EINVAL;
9054
9055         err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
9056
9057         return err;
9058 }
9059
9060 static struct sk_buff *
9061 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
9062                             struct wireless_dev *wdev, int approxlen,
9063                             u32 portid, u32 seq, enum nl80211_commands cmd,
9064                             enum nl80211_attrs attr,
9065                             const struct nl80211_vendor_cmd_info *info,
9066                             gfp_t gfp)
9067 {
9068         struct sk_buff *skb;
9069         void *hdr;
9070         struct nlattr *data;
9071
9072         skb = nlmsg_new(approxlen + 100, gfp);
9073         if (!skb)
9074                 return NULL;
9075
9076         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
9077         if (!hdr) {
9078                 kfree_skb(skb);
9079                 return NULL;
9080         }
9081
9082         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
9083                 goto nla_put_failure;
9084
9085         if (info) {
9086                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
9087                                 info->vendor_id))
9088                         goto nla_put_failure;
9089                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
9090                                 info->subcmd))
9091                         goto nla_put_failure;
9092         }
9093
9094         if (wdev) {
9095                 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
9096                                       wdev_id(wdev), NL80211_ATTR_PAD))
9097                         goto nla_put_failure;
9098                 if (wdev->netdev &&
9099                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
9100                                 wdev->netdev->ifindex))
9101                         goto nla_put_failure;
9102         }
9103
9104         data = nla_nest_start(skb, attr);
9105         if (!data)
9106                 goto nla_put_failure;
9107
9108         ((void **)skb->cb)[0] = rdev;
9109         ((void **)skb->cb)[1] = hdr;
9110         ((void **)skb->cb)[2] = data;
9111
9112         return skb;
9113
9114  nla_put_failure:
9115         kfree_skb(skb);
9116         return NULL;
9117 }
9118
9119 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
9120                                            struct wireless_dev *wdev,
9121                                            enum nl80211_commands cmd,
9122                                            enum nl80211_attrs attr,
9123                                            int vendor_event_idx,
9124                                            int approxlen, gfp_t gfp)
9125 {
9126         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
9127         const struct nl80211_vendor_cmd_info *info;
9128
9129         switch (cmd) {
9130         case NL80211_CMD_TESTMODE:
9131                 if (WARN_ON(vendor_event_idx != -1))
9132                         return NULL;
9133                 info = NULL;
9134                 break;
9135         case NL80211_CMD_VENDOR:
9136                 if (WARN_ON(vendor_event_idx < 0 ||
9137                             vendor_event_idx >= wiphy->n_vendor_events))
9138                         return NULL;
9139                 info = &wiphy->vendor_events[vendor_event_idx];
9140                 break;
9141         default:
9142                 WARN_ON(1);
9143                 return NULL;
9144         }
9145
9146         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, 0, 0,
9147                                            cmd, attr, info, gfp);
9148 }
9149 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
9150
9151 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
9152 {
9153         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
9154         void *hdr = ((void **)skb->cb)[1];
9155         struct nlattr *data = ((void **)skb->cb)[2];
9156         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
9157
9158         /* clear CB data for netlink core to own from now on */
9159         memset(skb->cb, 0, sizeof(skb->cb));
9160
9161         nla_nest_end(skb, data);
9162         genlmsg_end(skb, hdr);
9163
9164         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
9165                 mcgrp = NL80211_MCGRP_VENDOR;
9166
9167         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
9168                                 mcgrp, gfp);
9169 }
9170 EXPORT_SYMBOL(__cfg80211_send_event_skb);
9171
9172 #ifdef CONFIG_NL80211_TESTMODE
9173 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
9174 {
9175         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9176         struct wireless_dev *wdev =
9177                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
9178         int err;
9179
9180         if (!rdev->ops->testmode_cmd)
9181                 return -EOPNOTSUPP;
9182
9183         if (IS_ERR(wdev)) {
9184                 err = PTR_ERR(wdev);
9185                 if (err != -EINVAL)
9186                         return err;
9187                 wdev = NULL;
9188         } else if (wdev->wiphy != &rdev->wiphy) {
9189                 return -EINVAL;
9190         }
9191
9192         if (!info->attrs[NL80211_ATTR_TESTDATA])
9193                 return -EINVAL;
9194
9195         rdev->cur_cmd_info = info;
9196         err = rdev_testmode_cmd(rdev, wdev,
9197                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
9198                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
9199         rdev->cur_cmd_info = NULL;
9200
9201         return err;
9202 }
9203
9204 static int nl80211_testmode_dump(struct sk_buff *skb,
9205                                  struct netlink_callback *cb)
9206 {
9207         struct cfg80211_registered_device *rdev;
9208         int err;
9209         long phy_idx;
9210         void *data = NULL;
9211         int data_len = 0;
9212
9213         rtnl_lock();
9214
9215         if (cb->args[0]) {
9216                 /*
9217                  * 0 is a valid index, but not valid for args[0],
9218                  * so we need to offset by 1.
9219                  */
9220                 phy_idx = cb->args[0] - 1;
9221
9222                 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
9223                 if (!rdev) {
9224                         err = -ENOENT;
9225                         goto out_err;
9226                 }
9227         } else {
9228                 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
9229
9230                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
9231                                   attrbuf, nl80211_fam.maxattr,
9232                                   nl80211_policy, NULL);
9233                 if (err)
9234                         goto out_err;
9235
9236                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
9237                 if (IS_ERR(rdev)) {
9238                         err = PTR_ERR(rdev);
9239                         goto out_err;
9240                 }
9241                 phy_idx = rdev->wiphy_idx;
9242
9243                 if (attrbuf[NL80211_ATTR_TESTDATA])
9244                         cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
9245         }
9246
9247         if (cb->args[1]) {
9248                 data = nla_data((void *)cb->args[1]);
9249                 data_len = nla_len((void *)cb->args[1]);
9250         }
9251
9252         if (!rdev->ops->testmode_dump) {
9253                 err = -EOPNOTSUPP;
9254                 goto out_err;
9255         }
9256
9257         while (1) {
9258                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
9259                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
9260                                            NL80211_CMD_TESTMODE);
9261                 struct nlattr *tmdata;
9262
9263                 if (!hdr)
9264                         break;
9265
9266                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
9267                         genlmsg_cancel(skb, hdr);
9268                         break;
9269                 }
9270
9271                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
9272                 if (!tmdata) {
9273                         genlmsg_cancel(skb, hdr);
9274                         break;
9275                 }
9276                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
9277                 nla_nest_end(skb, tmdata);
9278
9279                 if (err == -ENOBUFS || err == -ENOENT) {
9280                         genlmsg_cancel(skb, hdr);
9281                         break;
9282                 } else if (err) {
9283                         genlmsg_cancel(skb, hdr);
9284                         goto out_err;
9285                 }
9286
9287                 genlmsg_end(skb, hdr);
9288         }
9289
9290         err = skb->len;
9291         /* see above */
9292         cb->args[0] = phy_idx + 1;
9293  out_err:
9294         rtnl_unlock();
9295         return err;
9296 }
9297 #endif
9298
9299 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
9300 {
9301         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9302         struct net_device *dev = info->user_ptr[1];
9303         struct cfg80211_connect_params connect;
9304         struct wiphy *wiphy;
9305         struct cfg80211_cached_keys *connkeys = NULL;
9306         int err;
9307
9308         memset(&connect, 0, sizeof(connect));
9309
9310         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
9311                 return -EINVAL;
9312
9313         if (!info->attrs[NL80211_ATTR_SSID] ||
9314             !nla_len(info->attrs[NL80211_ATTR_SSID]))
9315                 return -EINVAL;
9316
9317         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
9318                 connect.auth_type =
9319                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9320                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
9321                                              NL80211_CMD_CONNECT))
9322                         return -EINVAL;
9323         } else
9324                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
9325
9326         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
9327
9328         if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
9329             !wiphy_ext_feature_isset(&rdev->wiphy,
9330                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
9331                 return -EINVAL;
9332         connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
9333
9334         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
9335                                       NL80211_MAX_NR_CIPHER_SUITES);
9336         if (err)
9337                 return err;
9338
9339         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9340             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9341                 return -EOPNOTSUPP;
9342
9343         wiphy = &rdev->wiphy;
9344
9345         connect.bg_scan_period = -1;
9346         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
9347                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
9348                 connect.bg_scan_period =
9349                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
9350         }
9351
9352         if (info->attrs[NL80211_ATTR_MAC])
9353                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9354         else if (info->attrs[NL80211_ATTR_MAC_HINT])
9355                 connect.bssid_hint =
9356                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
9357         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9358         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9359
9360         if (info->attrs[NL80211_ATTR_IE]) {
9361                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9362                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9363         }
9364
9365         if (info->attrs[NL80211_ATTR_USE_MFP]) {
9366                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
9367                 if (connect.mfp == NL80211_MFP_OPTIONAL &&
9368                     !wiphy_ext_feature_isset(&rdev->wiphy,
9369                                              NL80211_EXT_FEATURE_MFP_OPTIONAL))
9370                         return -EOPNOTSUPP;
9371
9372                 if (connect.mfp != NL80211_MFP_REQUIRED &&
9373                     connect.mfp != NL80211_MFP_NO &&
9374                     connect.mfp != NL80211_MFP_OPTIONAL)
9375                         return -EINVAL;
9376         } else {
9377                 connect.mfp = NL80211_MFP_NO;
9378         }
9379
9380         if (info->attrs[NL80211_ATTR_PREV_BSSID])
9381                 connect.prev_bssid =
9382                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
9383
9384         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9385                 connect.channel = nl80211_get_valid_chan(
9386                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
9387                 if (!connect.channel)
9388                         return -EINVAL;
9389         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
9390                 connect.channel_hint = nl80211_get_valid_chan(
9391                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
9392                 if (!connect.channel_hint)
9393                         return -EINVAL;
9394         }
9395
9396         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
9397                 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
9398                 if (IS_ERR(connkeys))
9399                         return PTR_ERR(connkeys);
9400         }
9401
9402         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
9403                 connect.flags |= ASSOC_REQ_DISABLE_HT;
9404
9405         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9406                 memcpy(&connect.ht_capa_mask,
9407                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
9408                        sizeof(connect.ht_capa_mask));
9409
9410         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9411                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
9412                         kzfree(connkeys);
9413                         return -EINVAL;
9414                 }
9415                 memcpy(&connect.ht_capa,
9416                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9417                        sizeof(connect.ht_capa));
9418         }
9419
9420         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
9421                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
9422
9423         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
9424                 memcpy(&connect.vht_capa_mask,
9425                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
9426                        sizeof(connect.vht_capa_mask));
9427
9428         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
9429                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
9430                         kzfree(connkeys);
9431                         return -EINVAL;
9432                 }
9433                 memcpy(&connect.vht_capa,
9434                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
9435                        sizeof(connect.vht_capa));
9436         }
9437
9438         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
9439                 if (!((rdev->wiphy.features &
9440                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
9441                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
9442                     !wiphy_ext_feature_isset(&rdev->wiphy,
9443                                              NL80211_EXT_FEATURE_RRM)) {
9444                         kzfree(connkeys);
9445                         return -EINVAL;
9446                 }
9447                 connect.flags |= ASSOC_REQ_USE_RRM;
9448         }
9449
9450         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
9451         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
9452                 kzfree(connkeys);
9453                 return -EOPNOTSUPP;
9454         }
9455
9456         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
9457                 /* bss selection makes no sense if bssid is set */
9458                 if (connect.bssid) {
9459                         kzfree(connkeys);
9460                         return -EINVAL;
9461                 }
9462
9463                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
9464                                        wiphy, &connect.bss_select);
9465                 if (err) {
9466                         kzfree(connkeys);
9467                         return err;
9468                 }
9469         }
9470
9471         if (wiphy_ext_feature_isset(&rdev->wiphy,
9472                                     NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
9473             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
9474             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
9475             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
9476             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9477                 connect.fils_erp_username =
9478                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9479                 connect.fils_erp_username_len =
9480                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9481                 connect.fils_erp_realm =
9482                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9483                 connect.fils_erp_realm_len =
9484                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9485                 connect.fils_erp_next_seq_num =
9486                         nla_get_u16(
9487                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
9488                 connect.fils_erp_rrk =
9489                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9490                 connect.fils_erp_rrk_len =
9491                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9492         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
9493                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
9494                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
9495                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9496                 kzfree(connkeys);
9497                 return -EINVAL;
9498         }
9499
9500         if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
9501                 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9502                         kzfree(connkeys);
9503                         GENL_SET_ERR_MSG(info,
9504                                          "external auth requires connection ownership");
9505                         return -EINVAL;
9506                 }
9507                 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
9508         }
9509
9510         wdev_lock(dev->ieee80211_ptr);
9511
9512         err = cfg80211_connect(rdev, dev, &connect, connkeys,
9513                                connect.prev_bssid);
9514         if (err)
9515                 kzfree(connkeys);
9516
9517         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9518                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
9519                 if (connect.bssid)
9520                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
9521                                connect.bssid, ETH_ALEN);
9522                 else
9523                         memset(dev->ieee80211_ptr->disconnect_bssid,
9524                                0, ETH_ALEN);
9525         }
9526
9527         wdev_unlock(dev->ieee80211_ptr);
9528
9529         return err;
9530 }
9531
9532 static int nl80211_update_connect_params(struct sk_buff *skb,
9533                                          struct genl_info *info)
9534 {
9535         struct cfg80211_connect_params connect = {};
9536         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9537         struct net_device *dev = info->user_ptr[1];
9538         struct wireless_dev *wdev = dev->ieee80211_ptr;
9539         bool fils_sk_offload;
9540         u32 auth_type;
9541         u32 changed = 0;
9542         int ret;
9543
9544         if (!rdev->ops->update_connect_params)
9545                 return -EOPNOTSUPP;
9546
9547         if (info->attrs[NL80211_ATTR_IE]) {
9548                 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
9549                         return -EINVAL;
9550                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9551                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9552                 changed |= UPDATE_ASSOC_IES;
9553         }
9554
9555         fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
9556                                                   NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
9557
9558         /*
9559          * when driver supports fils-sk offload all attributes must be
9560          * provided. So the else covers "fils-sk-not-all" and
9561          * "no-fils-sk-any".
9562          */
9563         if (fils_sk_offload &&
9564             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
9565             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
9566             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
9567             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9568                 connect.fils_erp_username =
9569                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9570                 connect.fils_erp_username_len =
9571                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9572                 connect.fils_erp_realm =
9573                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9574                 connect.fils_erp_realm_len =
9575                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9576                 connect.fils_erp_next_seq_num =
9577                         nla_get_u16(
9578                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
9579                 connect.fils_erp_rrk =
9580                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9581                 connect.fils_erp_rrk_len =
9582                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9583                 changed |= UPDATE_FILS_ERP_INFO;
9584         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
9585                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
9586                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
9587                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9588                 return -EINVAL;
9589         }
9590
9591         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
9592                 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9593                 if (!nl80211_valid_auth_type(rdev, auth_type,
9594                                              NL80211_CMD_CONNECT))
9595                         return -EINVAL;
9596
9597                 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
9598                     fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
9599                         return -EINVAL;
9600
9601                 connect.auth_type = auth_type;
9602                 changed |= UPDATE_AUTH_TYPE;
9603         }
9604
9605         wdev_lock(dev->ieee80211_ptr);
9606         if (!wdev->current_bss)
9607                 ret = -ENOLINK;
9608         else
9609                 ret = rdev_update_connect_params(rdev, dev, &connect, changed);
9610         wdev_unlock(dev->ieee80211_ptr);
9611
9612         return ret;
9613 }
9614
9615 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
9616 {
9617         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9618         struct net_device *dev = info->user_ptr[1];
9619         u16 reason;
9620         int ret;
9621
9622         if (dev->ieee80211_ptr->conn_owner_nlportid &&
9623             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9624                 return -EPERM;
9625
9626         if (!info->attrs[NL80211_ATTR_REASON_CODE])
9627                 reason = WLAN_REASON_DEAUTH_LEAVING;
9628         else
9629                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9630
9631         if (reason == 0)
9632                 return -EINVAL;
9633
9634         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9635             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9636                 return -EOPNOTSUPP;
9637
9638         wdev_lock(dev->ieee80211_ptr);
9639         ret = cfg80211_disconnect(rdev, dev, reason, true);
9640         wdev_unlock(dev->ieee80211_ptr);
9641         return ret;
9642 }
9643
9644 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
9645 {
9646         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9647         struct net *net;
9648         int err;
9649
9650         if (info->attrs[NL80211_ATTR_PID]) {
9651                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
9652
9653                 net = get_net_ns_by_pid(pid);
9654         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
9655                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
9656
9657                 net = get_net_ns_by_fd(fd);
9658         } else {
9659                 return -EINVAL;
9660         }
9661
9662         if (IS_ERR(net))
9663                 return PTR_ERR(net);
9664
9665         err = 0;
9666
9667         /* check if anything to do */
9668         if (!net_eq(wiphy_net(&rdev->wiphy), net))
9669                 err = cfg80211_switch_netns(rdev, net);
9670
9671         put_net(net);
9672         return err;
9673 }
9674
9675 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
9676 {
9677         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9678         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
9679                         struct cfg80211_pmksa *pmksa) = NULL;
9680         struct net_device *dev = info->user_ptr[1];
9681         struct cfg80211_pmksa pmksa;
9682
9683         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
9684
9685         if (!info->attrs[NL80211_ATTR_PMKID])
9686                 return -EINVAL;
9687
9688         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
9689
9690         if (info->attrs[NL80211_ATTR_MAC]) {
9691                 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9692         } else if (info->attrs[NL80211_ATTR_SSID] &&
9693                    info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
9694                    (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
9695                     info->attrs[NL80211_ATTR_PMK])) {
9696                 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9697                 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9698                 pmksa.cache_id =
9699                         nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
9700         } else {
9701                 return -EINVAL;
9702         }
9703         if (info->attrs[NL80211_ATTR_PMK]) {
9704                 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
9705                 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
9706         }
9707
9708         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9709             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9710                 return -EOPNOTSUPP;
9711
9712         switch (info->genlhdr->cmd) {
9713         case NL80211_CMD_SET_PMKSA:
9714                 rdev_ops = rdev->ops->set_pmksa;
9715                 break;
9716         case NL80211_CMD_DEL_PMKSA:
9717                 rdev_ops = rdev->ops->del_pmksa;
9718                 break;
9719         default:
9720                 WARN_ON(1);
9721                 break;
9722         }
9723
9724         if (!rdev_ops)
9725                 return -EOPNOTSUPP;
9726
9727         return rdev_ops(&rdev->wiphy, dev, &pmksa);
9728 }
9729
9730 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
9731 {
9732         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9733         struct net_device *dev = info->user_ptr[1];
9734
9735         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9736             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9737                 return -EOPNOTSUPP;
9738
9739         if (!rdev->ops->flush_pmksa)
9740                 return -EOPNOTSUPP;
9741
9742         return rdev_flush_pmksa(rdev, dev);
9743 }
9744
9745 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
9746 {
9747         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9748         struct net_device *dev = info->user_ptr[1];
9749         u8 action_code, dialog_token;
9750         u32 peer_capability = 0;
9751         u16 status_code;
9752         u8 *peer;
9753         bool initiator;
9754
9755         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
9756             !rdev->ops->tdls_mgmt)
9757                 return -EOPNOTSUPP;
9758
9759         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
9760             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
9761             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
9762             !info->attrs[NL80211_ATTR_IE] ||
9763             !info->attrs[NL80211_ATTR_MAC])
9764                 return -EINVAL;
9765
9766         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9767         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
9768         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
9769         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
9770         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
9771         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
9772                 peer_capability =
9773                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
9774
9775         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
9776                               dialog_token, status_code, peer_capability,
9777                               initiator,
9778                               nla_data(info->attrs[NL80211_ATTR_IE]),
9779                               nla_len(info->attrs[NL80211_ATTR_IE]));
9780 }
9781
9782 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
9783 {
9784         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9785         struct net_device *dev = info->user_ptr[1];
9786         enum nl80211_tdls_operation operation;
9787         u8 *peer;
9788
9789         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
9790             !rdev->ops->tdls_oper)
9791                 return -EOPNOTSUPP;
9792
9793         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
9794             !info->attrs[NL80211_ATTR_MAC])
9795                 return -EINVAL;
9796
9797         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
9798         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9799
9800         return rdev_tdls_oper(rdev, dev, peer, operation);
9801 }
9802
9803 static int nl80211_remain_on_channel(struct sk_buff *skb,
9804                                      struct genl_info *info)
9805 {
9806         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9807         struct wireless_dev *wdev = info->user_ptr[1];
9808         struct cfg80211_chan_def chandef;
9809         const struct cfg80211_chan_def *compat_chandef;
9810         struct sk_buff *msg;
9811         void *hdr;
9812         u64 cookie;
9813         u32 duration;
9814         int err;
9815
9816         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
9817             !info->attrs[NL80211_ATTR_DURATION])
9818                 return -EINVAL;
9819
9820         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
9821
9822         if (!rdev->ops->remain_on_channel ||
9823             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
9824                 return -EOPNOTSUPP;
9825
9826         /*
9827          * We should be on that channel for at least a minimum amount of
9828          * time (10ms) but no longer than the driver supports.
9829          */
9830         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
9831             duration > rdev->wiphy.max_remain_on_channel_duration)
9832                 return -EINVAL;
9833
9834         err = nl80211_parse_chandef(rdev, info, &chandef);
9835         if (err)
9836                 return err;
9837
9838         wdev_lock(wdev);
9839         if (!cfg80211_off_channel_oper_allowed(wdev) &&
9840             !cfg80211_chandef_identical(&wdev->chandef, &chandef)) {
9841                 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef,
9842                                                              &chandef);
9843                 if (compat_chandef != &chandef) {
9844                         wdev_unlock(wdev);
9845                         return -EBUSY;
9846                 }
9847         }
9848         wdev_unlock(wdev);
9849
9850         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9851         if (!msg)
9852                 return -ENOMEM;
9853
9854         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9855                              NL80211_CMD_REMAIN_ON_CHANNEL);
9856         if (!hdr) {
9857                 err = -ENOBUFS;
9858                 goto free_msg;
9859         }
9860
9861         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
9862                                      duration, &cookie);
9863
9864         if (err)
9865                 goto free_msg;
9866
9867         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
9868                               NL80211_ATTR_PAD))
9869                 goto nla_put_failure;
9870
9871         genlmsg_end(msg, hdr);
9872
9873         return genlmsg_reply(msg, info);
9874
9875  nla_put_failure:
9876         err = -ENOBUFS;
9877  free_msg:
9878         nlmsg_free(msg);
9879         return err;
9880 }
9881
9882 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
9883                                             struct genl_info *info)
9884 {
9885         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9886         struct wireless_dev *wdev = info->user_ptr[1];
9887         u64 cookie;
9888
9889         if (!info->attrs[NL80211_ATTR_COOKIE])
9890                 return -EINVAL;
9891
9892         if (!rdev->ops->cancel_remain_on_channel)
9893                 return -EOPNOTSUPP;
9894
9895         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9896
9897         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
9898 }
9899
9900 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
9901                                        struct genl_info *info)
9902 {
9903         struct cfg80211_bitrate_mask mask;
9904         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9905         struct net_device *dev = info->user_ptr[1];
9906         int err;
9907
9908         if (!rdev->ops->set_bitrate_mask)
9909                 return -EOPNOTSUPP;
9910
9911         err = nl80211_parse_tx_bitrate_mask(info, &mask);
9912         if (err)
9913                 return err;
9914
9915         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
9916 }
9917
9918 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
9919 {
9920         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9921         struct wireless_dev *wdev = info->user_ptr[1];
9922         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
9923
9924         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
9925                 return -EINVAL;
9926
9927         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
9928                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
9929
9930         switch (wdev->iftype) {
9931         case NL80211_IFTYPE_STATION:
9932         case NL80211_IFTYPE_ADHOC:
9933         case NL80211_IFTYPE_P2P_CLIENT:
9934         case NL80211_IFTYPE_AP:
9935         case NL80211_IFTYPE_AP_VLAN:
9936         case NL80211_IFTYPE_MESH_POINT:
9937         case NL80211_IFTYPE_P2P_GO:
9938         case NL80211_IFTYPE_P2P_DEVICE:
9939                 break;
9940         case NL80211_IFTYPE_NAN:
9941         default:
9942                 return -EOPNOTSUPP;
9943         }
9944
9945         /* not much point in registering if we can't reply */
9946         if (!rdev->ops->mgmt_tx)
9947                 return -EOPNOTSUPP;
9948
9949         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
9950                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
9951                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
9952 }
9953
9954 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
9955 {
9956         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9957         struct wireless_dev *wdev = info->user_ptr[1];
9958         struct cfg80211_chan_def chandef;
9959         int err;
9960         void *hdr = NULL;
9961         u64 cookie;
9962         struct sk_buff *msg = NULL;
9963         struct cfg80211_mgmt_tx_params params = {
9964                 .dont_wait_for_ack =
9965                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
9966         };
9967
9968         if (!info->attrs[NL80211_ATTR_FRAME])
9969                 return -EINVAL;
9970
9971         if (!rdev->ops->mgmt_tx)
9972                 return -EOPNOTSUPP;
9973
9974         switch (wdev->iftype) {
9975         case NL80211_IFTYPE_P2P_DEVICE:
9976                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
9977                         return -EINVAL;
9978         case NL80211_IFTYPE_STATION:
9979         case NL80211_IFTYPE_ADHOC:
9980         case NL80211_IFTYPE_P2P_CLIENT:
9981         case NL80211_IFTYPE_AP:
9982         case NL80211_IFTYPE_AP_VLAN:
9983         case NL80211_IFTYPE_MESH_POINT:
9984         case NL80211_IFTYPE_P2P_GO:
9985                 break;
9986         case NL80211_IFTYPE_NAN:
9987         default:
9988                 return -EOPNOTSUPP;
9989         }
9990
9991         if (info->attrs[NL80211_ATTR_DURATION]) {
9992                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
9993                         return -EINVAL;
9994                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
9995
9996                 /*
9997                  * We should wait on the channel for at least a minimum amount
9998                  * of time (10ms) but no longer than the driver supports.
9999                  */
10000                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
10001                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
10002                         return -EINVAL;
10003         }
10004
10005         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
10006
10007         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
10008                 return -EINVAL;
10009
10010         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
10011
10012         /* get the channel if any has been specified, otherwise pass NULL to
10013          * the driver. The latter will use the current one
10014          */
10015         chandef.chan = NULL;
10016         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
10017                 err = nl80211_parse_chandef(rdev, info, &chandef);
10018                 if (err)
10019                         return err;
10020         }
10021
10022         if (!chandef.chan && params.offchan)
10023                 return -EINVAL;
10024
10025         wdev_lock(wdev);
10026         if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) {
10027                 wdev_unlock(wdev);
10028                 return -EBUSY;
10029         }
10030         wdev_unlock(wdev);
10031
10032         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
10033         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
10034
10035         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
10036                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
10037                 int i;
10038
10039                 if (len % sizeof(u16))
10040                         return -EINVAL;
10041
10042                 params.n_csa_offsets = len / sizeof(u16);
10043                 params.csa_offsets =
10044                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
10045
10046                 /* check that all the offsets fit the frame */
10047                 for (i = 0; i < params.n_csa_offsets; i++) {
10048                         if (params.csa_offsets[i] >= params.len)
10049                                 return -EINVAL;
10050                 }
10051         }
10052
10053         if (!params.dont_wait_for_ack) {
10054                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10055                 if (!msg)
10056                         return -ENOMEM;
10057
10058                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10059                                      NL80211_CMD_FRAME);
10060                 if (!hdr) {
10061                         err = -ENOBUFS;
10062                         goto free_msg;
10063                 }
10064         }
10065
10066         params.chan = chandef.chan;
10067         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
10068         if (err)
10069                 goto free_msg;
10070
10071         if (msg) {
10072                 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
10073                                       NL80211_ATTR_PAD))
10074                         goto nla_put_failure;
10075
10076                 genlmsg_end(msg, hdr);
10077                 return genlmsg_reply(msg, info);
10078         }
10079
10080         return 0;
10081
10082  nla_put_failure:
10083         err = -ENOBUFS;
10084  free_msg:
10085         nlmsg_free(msg);
10086         return err;
10087 }
10088
10089 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
10090 {
10091         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10092         struct wireless_dev *wdev = info->user_ptr[1];
10093         u64 cookie;
10094
10095         if (!info->attrs[NL80211_ATTR_COOKIE])
10096                 return -EINVAL;
10097
10098         if (!rdev->ops->mgmt_tx_cancel_wait)
10099                 return -EOPNOTSUPP;
10100
10101         switch (wdev->iftype) {
10102         case NL80211_IFTYPE_STATION:
10103         case NL80211_IFTYPE_ADHOC:
10104         case NL80211_IFTYPE_P2P_CLIENT:
10105         case NL80211_IFTYPE_AP:
10106         case NL80211_IFTYPE_AP_VLAN:
10107         case NL80211_IFTYPE_P2P_GO:
10108         case NL80211_IFTYPE_P2P_DEVICE:
10109                 break;
10110         case NL80211_IFTYPE_NAN:
10111         default:
10112                 return -EOPNOTSUPP;
10113         }
10114
10115         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
10116
10117         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
10118 }
10119
10120 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
10121 {
10122         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10123         struct wireless_dev *wdev;
10124         struct net_device *dev = info->user_ptr[1];
10125         u8 ps_state;
10126         bool state;
10127         int err;
10128
10129         if (!info->attrs[NL80211_ATTR_PS_STATE])
10130                 return -EINVAL;
10131
10132         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
10133
10134         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
10135                 return -EINVAL;
10136
10137         wdev = dev->ieee80211_ptr;
10138
10139         if (!rdev->ops->set_power_mgmt)
10140                 return -EOPNOTSUPP;
10141
10142         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
10143
10144         if (state == wdev->ps)
10145                 return 0;
10146
10147         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
10148         if (!err)
10149                 wdev->ps = state;
10150         return err;
10151 }
10152
10153 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
10154 {
10155         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10156         enum nl80211_ps_state ps_state;
10157         struct wireless_dev *wdev;
10158         struct net_device *dev = info->user_ptr[1];
10159         struct sk_buff *msg;
10160         void *hdr;
10161         int err;
10162
10163         wdev = dev->ieee80211_ptr;
10164
10165         if (!rdev->ops->set_power_mgmt)
10166                 return -EOPNOTSUPP;
10167
10168         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10169         if (!msg)
10170                 return -ENOMEM;
10171
10172         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10173                              NL80211_CMD_GET_POWER_SAVE);
10174         if (!hdr) {
10175                 err = -ENOBUFS;
10176                 goto free_msg;
10177         }
10178
10179         if (wdev->ps)
10180                 ps_state = NL80211_PS_ENABLED;
10181         else
10182                 ps_state = NL80211_PS_DISABLED;
10183
10184         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
10185                 goto nla_put_failure;
10186
10187         genlmsg_end(msg, hdr);
10188         return genlmsg_reply(msg, info);
10189
10190  nla_put_failure:
10191         err = -ENOBUFS;
10192  free_msg:
10193         nlmsg_free(msg);
10194         return err;
10195 }
10196
10197 static const struct nla_policy
10198 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
10199         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
10200         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
10201         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
10202         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
10203         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
10204         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
10205         [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
10206 };
10207
10208 static int nl80211_set_cqm_txe(struct genl_info *info,
10209                                u32 rate, u32 pkts, u32 intvl)
10210 {
10211         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10212         struct net_device *dev = info->user_ptr[1];
10213         struct wireless_dev *wdev = dev->ieee80211_ptr;
10214
10215         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
10216                 return -EINVAL;
10217
10218         if (!rdev->ops->set_cqm_txe_config)
10219                 return -EOPNOTSUPP;
10220
10221         if (wdev->iftype != NL80211_IFTYPE_STATION &&
10222             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
10223                 return -EOPNOTSUPP;
10224
10225         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
10226 }
10227
10228 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
10229                                     struct net_device *dev)
10230 {
10231         struct wireless_dev *wdev = dev->ieee80211_ptr;
10232         s32 last, low, high;
10233         u32 hyst;
10234         int i, n, low_index;
10235         int err;
10236
10237         /* RSSI reporting disabled? */
10238         if (!wdev->cqm_config)
10239                 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
10240
10241         /*
10242          * Obtain current RSSI value if possible, if not and no RSSI threshold
10243          * event has been received yet, we should receive an event after a
10244          * connection is established and enough beacons received to calculate
10245          * the average.
10246          */
10247         if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss &&
10248             rdev->ops->get_station) {
10249                 struct station_info sinfo = {};
10250                 u8 *mac_addr;
10251
10252                 mac_addr = wdev->current_bss->pub.bssid;
10253
10254                 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
10255                 if (err)
10256                         return err;
10257
10258                 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
10259                         wdev->cqm_config->last_rssi_event_value =
10260                                 (s8) sinfo.rx_beacon_signal_avg;
10261         }
10262
10263         last = wdev->cqm_config->last_rssi_event_value;
10264         hyst = wdev->cqm_config->rssi_hyst;
10265         n = wdev->cqm_config->n_rssi_thresholds;
10266
10267         for (i = 0; i < n; i++)
10268                 if (last < wdev->cqm_config->rssi_thresholds[i])
10269                         break;
10270
10271         low_index = i - 1;
10272         if (low_index >= 0) {
10273                 low_index = array_index_nospec(low_index, n);
10274                 low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;
10275         } else {
10276                 low = S32_MIN;
10277         }
10278         if (i < n) {
10279                 i = array_index_nospec(i, n);
10280                 high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;
10281         } else {
10282                 high = S32_MAX;
10283         }
10284
10285         return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
10286 }
10287
10288 static int nl80211_set_cqm_rssi(struct genl_info *info,
10289                                 const s32 *thresholds, int n_thresholds,
10290                                 u32 hysteresis)
10291 {
10292         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10293         struct net_device *dev = info->user_ptr[1];
10294         struct wireless_dev *wdev = dev->ieee80211_ptr;
10295         int i, err;
10296         s32 prev = S32_MIN;
10297
10298         /* Check all values negative and sorted */
10299         for (i = 0; i < n_thresholds; i++) {
10300                 if (thresholds[i] > 0 || thresholds[i] <= prev)
10301                         return -EINVAL;
10302
10303                 prev = thresholds[i];
10304         }
10305
10306         if (wdev->iftype != NL80211_IFTYPE_STATION &&
10307             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
10308                 return -EOPNOTSUPP;
10309
10310         wdev_lock(wdev);
10311         cfg80211_cqm_config_free(wdev);
10312         wdev_unlock(wdev);
10313
10314         if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
10315                 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
10316                         return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
10317
10318                 return rdev_set_cqm_rssi_config(rdev, dev,
10319                                                 thresholds[0], hysteresis);
10320         }
10321
10322         if (!wiphy_ext_feature_isset(&rdev->wiphy,
10323                                      NL80211_EXT_FEATURE_CQM_RSSI_LIST))
10324                 return -EOPNOTSUPP;
10325
10326         if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
10327                 n_thresholds = 0;
10328
10329         wdev_lock(wdev);
10330         if (n_thresholds) {
10331                 struct cfg80211_cqm_config *cqm_config;
10332
10333                 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) +
10334                                      n_thresholds * sizeof(s32), GFP_KERNEL);
10335                 if (!cqm_config) {
10336                         err = -ENOMEM;
10337                         goto unlock;
10338                 }
10339
10340                 cqm_config->rssi_hyst = hysteresis;
10341                 cqm_config->n_rssi_thresholds = n_thresholds;
10342                 memcpy(cqm_config->rssi_thresholds, thresholds,
10343                        n_thresholds * sizeof(s32));
10344
10345                 wdev->cqm_config = cqm_config;
10346         }
10347
10348         err = cfg80211_cqm_rssi_update(rdev, dev);
10349
10350 unlock:
10351         wdev_unlock(wdev);
10352
10353         return err;
10354 }
10355
10356 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
10357 {
10358         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
10359         struct nlattr *cqm;
10360         int err;
10361
10362         cqm = info->attrs[NL80211_ATTR_CQM];
10363         if (!cqm)
10364                 return -EINVAL;
10365
10366         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
10367                                nl80211_attr_cqm_policy, info->extack);
10368         if (err)
10369                 return err;
10370
10371         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
10372             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
10373                 const s32 *thresholds =
10374                         nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
10375                 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
10376                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
10377
10378                 if (len % 4)
10379                         return -EINVAL;
10380
10381                 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
10382                                             hysteresis);
10383         }
10384
10385         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
10386             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
10387             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
10388                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
10389                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
10390                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
10391
10392                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
10393         }
10394
10395         return -EINVAL;
10396 }
10397
10398 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
10399 {
10400         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10401         struct net_device *dev = info->user_ptr[1];
10402         struct ocb_setup setup = {};
10403         int err;
10404
10405         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
10406         if (err)
10407                 return err;
10408
10409         return cfg80211_join_ocb(rdev, dev, &setup);
10410 }
10411
10412 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
10413 {
10414         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10415         struct net_device *dev = info->user_ptr[1];
10416
10417         return cfg80211_leave_ocb(rdev, dev);
10418 }
10419
10420 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
10421 {
10422         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10423         struct net_device *dev = info->user_ptr[1];
10424         struct mesh_config cfg;
10425         struct mesh_setup setup;
10426         int err;
10427
10428         /* start with default */
10429         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
10430         memcpy(&setup, &default_mesh_setup, sizeof(setup));
10431
10432         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
10433                 /* and parse parameters if given */
10434                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
10435                 if (err)
10436                         return err;
10437         }
10438
10439         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
10440             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
10441                 return -EINVAL;
10442
10443         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
10444         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
10445
10446         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
10447             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
10448                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
10449                         return -EINVAL;
10450
10451         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
10452                 setup.beacon_interval =
10453                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
10454
10455                 err = cfg80211_validate_beacon_int(rdev,
10456                                                    NL80211_IFTYPE_MESH_POINT,
10457                                                    setup.beacon_interval);
10458                 if (err)
10459                         return err;
10460         }
10461
10462         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
10463                 setup.dtim_period =
10464                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
10465                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
10466                         return -EINVAL;
10467         }
10468
10469         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
10470                 /* parse additional setup parameters if given */
10471                 err = nl80211_parse_mesh_setup(info, &setup);
10472                 if (err)
10473                         return err;
10474         }
10475
10476         if (setup.user_mpm)
10477                 cfg.auto_open_plinks = false;
10478
10479         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
10480                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
10481                 if (err)
10482                         return err;
10483         } else {
10484                 /* __cfg80211_join_mesh() will sort it out */
10485                 setup.chandef.chan = NULL;
10486         }
10487
10488         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
10489                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10490                 int n_rates =
10491                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10492                 struct ieee80211_supported_band *sband;
10493
10494                 if (!setup.chandef.chan)
10495                         return -EINVAL;
10496
10497                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
10498
10499                 err = ieee80211_get_ratemask(sband, rates, n_rates,
10500                                              &setup.basic_rates);
10501                 if (err)
10502                         return err;
10503         }
10504
10505         if (info->attrs[NL80211_ATTR_TX_RATES]) {
10506                 err = nl80211_parse_tx_bitrate_mask(info, &setup.beacon_rate);
10507                 if (err)
10508                         return err;
10509
10510                 if (!setup.chandef.chan)
10511                         return -EINVAL;
10512
10513                 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
10514                                               &setup.beacon_rate);
10515                 if (err)
10516                         return err;
10517         }
10518
10519         setup.userspace_handles_dfs =
10520                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
10521
10522         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
10523                 int r = validate_pae_over_nl80211(rdev, info);
10524
10525                 if (r < 0)
10526                         return r;
10527
10528                 setup.control_port_over_nl80211 = true;
10529         }
10530
10531         wdev_lock(dev->ieee80211_ptr);
10532         err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
10533         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
10534                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
10535         wdev_unlock(dev->ieee80211_ptr);
10536
10537         return err;
10538 }
10539
10540 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
10541 {
10542         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10543         struct net_device *dev = info->user_ptr[1];
10544
10545         return cfg80211_leave_mesh(rdev, dev);
10546 }
10547
10548 #ifdef CONFIG_PM
10549 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
10550                                         struct cfg80211_registered_device *rdev)
10551 {
10552         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
10553         struct nlattr *nl_pats, *nl_pat;
10554         int i, pat_len;
10555
10556         if (!wowlan->n_patterns)
10557                 return 0;
10558
10559         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
10560         if (!nl_pats)
10561                 return -ENOBUFS;
10562
10563         for (i = 0; i < wowlan->n_patterns; i++) {
10564                 nl_pat = nla_nest_start(msg, i + 1);
10565                 if (!nl_pat)
10566                         return -ENOBUFS;
10567                 pat_len = wowlan->patterns[i].pattern_len;
10568                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
10569                             wowlan->patterns[i].mask) ||
10570                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
10571                             wowlan->patterns[i].pattern) ||
10572                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
10573                                 wowlan->patterns[i].pkt_offset))
10574                         return -ENOBUFS;
10575                 nla_nest_end(msg, nl_pat);
10576         }
10577         nla_nest_end(msg, nl_pats);
10578
10579         return 0;
10580 }
10581
10582 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
10583                                    struct cfg80211_wowlan_tcp *tcp)
10584 {
10585         struct nlattr *nl_tcp;
10586
10587         if (!tcp)
10588                 return 0;
10589
10590         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
10591         if (!nl_tcp)
10592                 return -ENOBUFS;
10593
10594         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
10595             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
10596             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
10597             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
10598             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
10599             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
10600                     tcp->payload_len, tcp->payload) ||
10601             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
10602                         tcp->data_interval) ||
10603             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
10604                     tcp->wake_len, tcp->wake_data) ||
10605             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
10606                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
10607                 return -ENOBUFS;
10608
10609         if (tcp->payload_seq.len &&
10610             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
10611                     sizeof(tcp->payload_seq), &tcp->payload_seq))
10612                 return -ENOBUFS;
10613
10614         if (tcp->payload_tok.len &&
10615             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
10616                     sizeof(tcp->payload_tok) + tcp->tokens_size,
10617                     &tcp->payload_tok))
10618                 return -ENOBUFS;
10619
10620         nla_nest_end(msg, nl_tcp);
10621
10622         return 0;
10623 }
10624
10625 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
10626                                   struct cfg80211_sched_scan_request *req)
10627 {
10628         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
10629         int i;
10630
10631         if (!req)
10632                 return 0;
10633
10634         nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
10635         if (!nd)
10636                 return -ENOBUFS;
10637
10638         if (req->n_scan_plans == 1 &&
10639             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
10640                         req->scan_plans[0].interval * 1000))
10641                 return -ENOBUFS;
10642
10643         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
10644                 return -ENOBUFS;
10645
10646         if (req->relative_rssi_set) {
10647                 struct nl80211_bss_select_rssi_adjust rssi_adjust;
10648
10649                 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
10650                                req->relative_rssi))
10651                         return -ENOBUFS;
10652
10653                 rssi_adjust.band = req->rssi_adjust.band;
10654                 rssi_adjust.delta = req->rssi_adjust.delta;
10655                 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
10656                             sizeof(rssi_adjust), &rssi_adjust))
10657                         return -ENOBUFS;
10658         }
10659
10660         freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
10661         if (!freqs)
10662                 return -ENOBUFS;
10663
10664         for (i = 0; i < req->n_channels; i++) {
10665                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
10666                         return -ENOBUFS;
10667         }
10668
10669         nla_nest_end(msg, freqs);
10670
10671         if (req->n_match_sets) {
10672                 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
10673                 if (!matches)
10674                         return -ENOBUFS;
10675
10676                 for (i = 0; i < req->n_match_sets; i++) {
10677                         match = nla_nest_start(msg, i);
10678                         if (!match)
10679                                 return -ENOBUFS;
10680
10681                         if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
10682                                     req->match_sets[i].ssid.ssid_len,
10683                                     req->match_sets[i].ssid.ssid))
10684                                 return -ENOBUFS;
10685                         nla_nest_end(msg, match);
10686                 }
10687                 nla_nest_end(msg, matches);
10688         }
10689
10690         scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
10691         if (!scan_plans)
10692                 return -ENOBUFS;
10693
10694         for (i = 0; i < req->n_scan_plans; i++) {
10695                 scan_plan = nla_nest_start(msg, i + 1);
10696                 if (!scan_plan)
10697                         return -ENOBUFS;
10698
10699                 if (!scan_plan ||
10700                     nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
10701                                 req->scan_plans[i].interval) ||
10702                     (req->scan_plans[i].iterations &&
10703                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
10704                                  req->scan_plans[i].iterations)))
10705                         return -ENOBUFS;
10706                 nla_nest_end(msg, scan_plan);
10707         }
10708         nla_nest_end(msg, scan_plans);
10709
10710         nla_nest_end(msg, nd);
10711
10712         return 0;
10713 }
10714
10715 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
10716 {
10717         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10718         struct sk_buff *msg;
10719         void *hdr;
10720         u32 size = NLMSG_DEFAULT_SIZE;
10721
10722         if (!rdev->wiphy.wowlan)
10723                 return -EOPNOTSUPP;
10724
10725         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
10726                 /* adjust size to have room for all the data */
10727                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
10728                         rdev->wiphy.wowlan_config->tcp->payload_len +
10729                         rdev->wiphy.wowlan_config->tcp->wake_len +
10730                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
10731         }
10732
10733         msg = nlmsg_new(size, GFP_KERNEL);
10734         if (!msg)
10735                 return -ENOMEM;
10736
10737         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10738                              NL80211_CMD_GET_WOWLAN);
10739         if (!hdr)
10740                 goto nla_put_failure;
10741
10742         if (rdev->wiphy.wowlan_config) {
10743                 struct nlattr *nl_wowlan;
10744
10745                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
10746                 if (!nl_wowlan)
10747                         goto nla_put_failure;
10748
10749                 if ((rdev->wiphy.wowlan_config->any &&
10750                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
10751                     (rdev->wiphy.wowlan_config->disconnect &&
10752                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
10753                     (rdev->wiphy.wowlan_config->magic_pkt &&
10754                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
10755                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
10756                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
10757                     (rdev->wiphy.wowlan_config->eap_identity_req &&
10758                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
10759                     (rdev->wiphy.wowlan_config->four_way_handshake &&
10760                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
10761                     (rdev->wiphy.wowlan_config->rfkill_release &&
10762                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
10763                         goto nla_put_failure;
10764
10765                 if (nl80211_send_wowlan_patterns(msg, rdev))
10766                         goto nla_put_failure;
10767
10768                 if (nl80211_send_wowlan_tcp(msg,
10769                                             rdev->wiphy.wowlan_config->tcp))
10770                         goto nla_put_failure;
10771
10772                 if (nl80211_send_wowlan_nd(
10773                             msg,
10774                             rdev->wiphy.wowlan_config->nd_config))
10775                         goto nla_put_failure;
10776
10777                 nla_nest_end(msg, nl_wowlan);
10778         }
10779
10780         genlmsg_end(msg, hdr);
10781         return genlmsg_reply(msg, info);
10782
10783 nla_put_failure:
10784         nlmsg_free(msg);
10785         return -ENOBUFS;
10786 }
10787
10788 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
10789                                     struct nlattr *attr,
10790                                     struct cfg80211_wowlan *trig)
10791 {
10792         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
10793         struct cfg80211_wowlan_tcp *cfg;
10794         struct nl80211_wowlan_tcp_data_token *tok = NULL;
10795         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
10796         u32 size;
10797         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
10798         int err, port;
10799
10800         if (!rdev->wiphy.wowlan->tcp)
10801                 return -EINVAL;
10802
10803         err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TCP, attr,
10804                                nl80211_wowlan_tcp_policy, NULL);
10805         if (err)
10806                 return err;
10807
10808         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
10809             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
10810             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
10811             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
10812             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
10813             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
10814             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
10815             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
10816                 return -EINVAL;
10817
10818         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
10819         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
10820                 return -EINVAL;
10821
10822         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
10823                         rdev->wiphy.wowlan->tcp->data_interval_max ||
10824             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
10825                 return -EINVAL;
10826
10827         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
10828         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
10829                 return -EINVAL;
10830
10831         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
10832         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
10833                 return -EINVAL;
10834
10835         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
10836                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
10837
10838                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
10839                 tokens_size = tokln - sizeof(*tok);
10840
10841                 if (!tok->len || tokens_size % tok->len)
10842                         return -EINVAL;
10843                 if (!rdev->wiphy.wowlan->tcp->tok)
10844                         return -EINVAL;
10845                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
10846                         return -EINVAL;
10847                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
10848                         return -EINVAL;
10849                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
10850                         return -EINVAL;
10851                 if (tok->offset + tok->len > data_size)
10852                         return -EINVAL;
10853         }
10854
10855         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
10856                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
10857                 if (!rdev->wiphy.wowlan->tcp->seq)
10858                         return -EINVAL;
10859                 if (seq->len == 0 || seq->len > 4)
10860                         return -EINVAL;
10861                 if (seq->len + seq->offset > data_size)
10862                         return -EINVAL;
10863         }
10864
10865         size = sizeof(*cfg);
10866         size += data_size;
10867         size += wake_size + wake_mask_size;
10868         size += tokens_size;
10869
10870         cfg = kzalloc(size, GFP_KERNEL);
10871         if (!cfg)
10872                 return -ENOMEM;
10873         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
10874         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
10875         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
10876                ETH_ALEN);
10877         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
10878                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
10879         else
10880                 port = 0;
10881 #ifdef CONFIG_INET
10882         /* allocate a socket and port for it and use it */
10883         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
10884                             IPPROTO_TCP, &cfg->sock, 1);
10885         if (err) {
10886                 kfree(cfg);
10887                 return err;
10888         }
10889         if (inet_csk_get_port(cfg->sock->sk, port)) {
10890                 sock_release(cfg->sock);
10891                 kfree(cfg);
10892                 return -EADDRINUSE;
10893         }
10894         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
10895 #else
10896         if (!port) {
10897                 kfree(cfg);
10898                 return -EINVAL;
10899         }
10900         cfg->src_port = port;
10901 #endif
10902
10903         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
10904         cfg->payload_len = data_size;
10905         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
10906         memcpy((void *)cfg->payload,
10907                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
10908                data_size);
10909         if (seq)
10910                 cfg->payload_seq = *seq;
10911         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
10912         cfg->wake_len = wake_size;
10913         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
10914         memcpy((void *)cfg->wake_data,
10915                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
10916                wake_size);
10917         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
10918                          data_size + wake_size;
10919         memcpy((void *)cfg->wake_mask,
10920                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
10921                wake_mask_size);
10922         if (tok) {
10923                 cfg->tokens_size = tokens_size;
10924                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
10925         }
10926
10927         trig->tcp = cfg;
10928
10929         return 0;
10930 }
10931
10932 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
10933                                    const struct wiphy_wowlan_support *wowlan,
10934                                    struct nlattr *attr,
10935                                    struct cfg80211_wowlan *trig)
10936 {
10937         struct nlattr **tb;
10938         int err;
10939
10940         tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
10941         if (!tb)
10942                 return -ENOMEM;
10943
10944         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
10945                 err = -EOPNOTSUPP;
10946                 goto out;
10947         }
10948
10949         err = nla_parse_nested(tb, NL80211_ATTR_MAX, attr, nl80211_policy,
10950                                NULL);
10951         if (err)
10952                 goto out;
10953
10954         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
10955                                                    wowlan->max_nd_match_sets);
10956         err = PTR_ERR_OR_ZERO(trig->nd_config);
10957         if (err)
10958                 trig->nd_config = NULL;
10959
10960 out:
10961         kfree(tb);
10962         return err;
10963 }
10964
10965 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
10966 {
10967         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10968         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
10969         struct cfg80211_wowlan new_triggers = {};
10970         struct cfg80211_wowlan *ntrig;
10971         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
10972         int err, i;
10973         bool prev_enabled = rdev->wiphy.wowlan_config;
10974         bool regular = false;
10975
10976         if (!wowlan)
10977                 return -EOPNOTSUPP;
10978
10979         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
10980                 cfg80211_rdev_free_wowlan(rdev);
10981                 rdev->wiphy.wowlan_config = NULL;
10982                 goto set_wakeup;
10983         }
10984
10985         err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TRIG,
10986                                info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
10987                                nl80211_wowlan_policy, info->extack);
10988         if (err)
10989                 return err;
10990
10991         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
10992                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
10993                         return -EINVAL;
10994                 new_triggers.any = true;
10995         }
10996
10997         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
10998                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
10999                         return -EINVAL;
11000                 new_triggers.disconnect = true;
11001                 regular = true;
11002         }
11003
11004         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
11005                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
11006                         return -EINVAL;
11007                 new_triggers.magic_pkt = true;
11008                 regular = true;
11009         }
11010
11011         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
11012                 return -EINVAL;
11013
11014         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
11015                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
11016                         return -EINVAL;
11017                 new_triggers.gtk_rekey_failure = true;
11018                 regular = true;
11019         }
11020
11021         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
11022                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
11023                         return -EINVAL;
11024                 new_triggers.eap_identity_req = true;
11025                 regular = true;
11026         }
11027
11028         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
11029                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
11030                         return -EINVAL;
11031                 new_triggers.four_way_handshake = true;
11032                 regular = true;
11033         }
11034
11035         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
11036                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
11037                         return -EINVAL;
11038                 new_triggers.rfkill_release = true;
11039                 regular = true;
11040         }
11041
11042         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
11043                 struct nlattr *pat;
11044                 int n_patterns = 0;
11045                 int rem, pat_len, mask_len, pkt_offset;
11046                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
11047
11048                 regular = true;
11049
11050                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
11051                                     rem)
11052                         n_patterns++;
11053                 if (n_patterns > wowlan->n_patterns)
11054                         return -EINVAL;
11055
11056                 new_triggers.patterns = kcalloc(n_patterns,
11057                                                 sizeof(new_triggers.patterns[0]),
11058                                                 GFP_KERNEL);
11059                 if (!new_triggers.patterns)
11060                         return -ENOMEM;
11061
11062                 new_triggers.n_patterns = n_patterns;
11063                 i = 0;
11064
11065                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
11066                                     rem) {
11067                         u8 *mask_pat;
11068
11069                         err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
11070                                                nl80211_packet_pattern_policy,
11071                                                info->extack);
11072                         if (err)
11073                                 goto error;
11074
11075                         err = -EINVAL;
11076                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
11077                             !pat_tb[NL80211_PKTPAT_PATTERN])
11078                                 goto error;
11079                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
11080                         mask_len = DIV_ROUND_UP(pat_len, 8);
11081                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
11082                                 goto error;
11083                         if (pat_len > wowlan->pattern_max_len ||
11084                             pat_len < wowlan->pattern_min_len)
11085                                 goto error;
11086
11087                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
11088                                 pkt_offset = 0;
11089                         else
11090                                 pkt_offset = nla_get_u32(
11091                                         pat_tb[NL80211_PKTPAT_OFFSET]);
11092                         if (pkt_offset > wowlan->max_pkt_offset)
11093                                 goto error;
11094                         new_triggers.patterns[i].pkt_offset = pkt_offset;
11095
11096                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
11097                         if (!mask_pat) {
11098                                 err = -ENOMEM;
11099                                 goto error;
11100                         }
11101                         new_triggers.patterns[i].mask = mask_pat;
11102                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
11103                                mask_len);
11104                         mask_pat += mask_len;
11105                         new_triggers.patterns[i].pattern = mask_pat;
11106                         new_triggers.patterns[i].pattern_len = pat_len;
11107                         memcpy(mask_pat,
11108                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
11109                                pat_len);
11110                         i++;
11111                 }
11112         }
11113
11114         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
11115                 regular = true;
11116                 err = nl80211_parse_wowlan_tcp(
11117                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
11118                         &new_triggers);
11119                 if (err)
11120                         goto error;
11121         }
11122
11123         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
11124                 regular = true;
11125                 err = nl80211_parse_wowlan_nd(
11126                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
11127                         &new_triggers);
11128                 if (err)
11129                         goto error;
11130         }
11131
11132         /* The 'any' trigger means the device continues operating more or less
11133          * as in its normal operation mode and wakes up the host on most of the
11134          * normal interrupts (like packet RX, ...)
11135          * It therefore makes little sense to combine with the more constrained
11136          * wakeup trigger modes.
11137          */
11138         if (new_triggers.any && regular) {
11139                 err = -EINVAL;
11140                 goto error;
11141         }
11142
11143         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
11144         if (!ntrig) {
11145                 err = -ENOMEM;
11146                 goto error;
11147         }
11148         cfg80211_rdev_free_wowlan(rdev);
11149         rdev->wiphy.wowlan_config = ntrig;
11150
11151  set_wakeup:
11152         if (rdev->ops->set_wakeup &&
11153             prev_enabled != !!rdev->wiphy.wowlan_config)
11154                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
11155
11156         return 0;
11157  error:
11158         for (i = 0; i < new_triggers.n_patterns; i++)
11159                 kfree(new_triggers.patterns[i].mask);
11160         kfree(new_triggers.patterns);
11161         if (new_triggers.tcp && new_triggers.tcp->sock)
11162                 sock_release(new_triggers.tcp->sock);
11163         kfree(new_triggers.tcp);
11164         kfree(new_triggers.nd_config);
11165         return err;
11166 }
11167 #endif
11168
11169 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
11170                                        struct cfg80211_registered_device *rdev)
11171 {
11172         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
11173         int i, j, pat_len;
11174         struct cfg80211_coalesce_rules *rule;
11175
11176         if (!rdev->coalesce->n_rules)
11177                 return 0;
11178
11179         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
11180         if (!nl_rules)
11181                 return -ENOBUFS;
11182
11183         for (i = 0; i < rdev->coalesce->n_rules; i++) {
11184                 nl_rule = nla_nest_start(msg, i + 1);
11185                 if (!nl_rule)
11186                         return -ENOBUFS;
11187
11188                 rule = &rdev->coalesce->rules[i];
11189                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
11190                                 rule->delay))
11191                         return -ENOBUFS;
11192
11193                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
11194                                 rule->condition))
11195                         return -ENOBUFS;
11196
11197                 nl_pats = nla_nest_start(msg,
11198                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
11199                 if (!nl_pats)
11200                         return -ENOBUFS;
11201
11202                 for (j = 0; j < rule->n_patterns; j++) {
11203                         nl_pat = nla_nest_start(msg, j + 1);
11204                         if (!nl_pat)
11205                                 return -ENOBUFS;
11206                         pat_len = rule->patterns[j].pattern_len;
11207                         if (nla_put(msg, NL80211_PKTPAT_MASK,
11208                                     DIV_ROUND_UP(pat_len, 8),
11209                                     rule->patterns[j].mask) ||
11210                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
11211                                     rule->patterns[j].pattern) ||
11212                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
11213                                         rule->patterns[j].pkt_offset))
11214                                 return -ENOBUFS;
11215                         nla_nest_end(msg, nl_pat);
11216                 }
11217                 nla_nest_end(msg, nl_pats);
11218                 nla_nest_end(msg, nl_rule);
11219         }
11220         nla_nest_end(msg, nl_rules);
11221
11222         return 0;
11223 }
11224
11225 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
11226 {
11227         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11228         struct sk_buff *msg;
11229         void *hdr;
11230
11231         if (!rdev->wiphy.coalesce)
11232                 return -EOPNOTSUPP;
11233
11234         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11235         if (!msg)
11236                 return -ENOMEM;
11237
11238         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11239                              NL80211_CMD_GET_COALESCE);
11240         if (!hdr)
11241                 goto nla_put_failure;
11242
11243         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
11244                 goto nla_put_failure;
11245
11246         genlmsg_end(msg, hdr);
11247         return genlmsg_reply(msg, info);
11248
11249 nla_put_failure:
11250         nlmsg_free(msg);
11251         return -ENOBUFS;
11252 }
11253
11254 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
11255 {
11256         struct cfg80211_coalesce *coalesce = rdev->coalesce;
11257         int i, j;
11258         struct cfg80211_coalesce_rules *rule;
11259
11260         if (!coalesce)
11261                 return;
11262
11263         for (i = 0; i < coalesce->n_rules; i++) {
11264                 rule = &coalesce->rules[i];
11265                 for (j = 0; j < rule->n_patterns; j++)
11266                         kfree(rule->patterns[j].mask);
11267                 kfree(rule->patterns);
11268         }
11269         kfree(coalesce->rules);
11270         kfree(coalesce);
11271         rdev->coalesce = NULL;
11272 }
11273
11274 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
11275                                        struct nlattr *rule,
11276                                        struct cfg80211_coalesce_rules *new_rule)
11277 {
11278         int err, i;
11279         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
11280         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
11281         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
11282         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
11283
11284         err = nla_parse_nested(tb, NL80211_ATTR_COALESCE_RULE_MAX, rule,
11285                                nl80211_coalesce_policy, NULL);
11286         if (err)
11287                 return err;
11288
11289         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
11290                 new_rule->delay =
11291                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
11292         if (new_rule->delay > coalesce->max_delay)
11293                 return -EINVAL;
11294
11295         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
11296                 new_rule->condition =
11297                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
11298         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
11299             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
11300                 return -EINVAL;
11301
11302         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
11303                 return -EINVAL;
11304
11305         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
11306                             rem)
11307                 n_patterns++;
11308         if (n_patterns > coalesce->n_patterns)
11309                 return -EINVAL;
11310
11311         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
11312                                      GFP_KERNEL);
11313         if (!new_rule->patterns)
11314                 return -ENOMEM;
11315
11316         new_rule->n_patterns = n_patterns;
11317         i = 0;
11318
11319         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
11320                             rem) {
11321                 u8 *mask_pat;
11322
11323                 err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
11324                                        nl80211_packet_pattern_policy, NULL);
11325                 if (err)
11326                         return err;
11327
11328                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
11329                     !pat_tb[NL80211_PKTPAT_PATTERN])
11330                         return -EINVAL;
11331                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
11332                 mask_len = DIV_ROUND_UP(pat_len, 8);
11333                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
11334                         return -EINVAL;
11335                 if (pat_len > coalesce->pattern_max_len ||
11336                     pat_len < coalesce->pattern_min_len)
11337                         return -EINVAL;
11338
11339                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
11340                         pkt_offset = 0;
11341                 else
11342                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
11343                 if (pkt_offset > coalesce->max_pkt_offset)
11344                         return -EINVAL;
11345                 new_rule->patterns[i].pkt_offset = pkt_offset;
11346
11347                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
11348                 if (!mask_pat)
11349                         return -ENOMEM;
11350
11351                 new_rule->patterns[i].mask = mask_pat;
11352                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
11353                        mask_len);
11354
11355                 mask_pat += mask_len;
11356                 new_rule->patterns[i].pattern = mask_pat;
11357                 new_rule->patterns[i].pattern_len = pat_len;
11358                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
11359                        pat_len);
11360                 i++;
11361         }
11362
11363         return 0;
11364 }
11365
11366 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
11367 {
11368         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11369         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
11370         struct cfg80211_coalesce new_coalesce = {};
11371         struct cfg80211_coalesce *n_coalesce;
11372         int err, rem_rule, n_rules = 0, i, j;
11373         struct nlattr *rule;
11374         struct cfg80211_coalesce_rules *tmp_rule;
11375
11376         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
11377                 return -EOPNOTSUPP;
11378
11379         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
11380                 cfg80211_rdev_free_coalesce(rdev);
11381                 rdev_set_coalesce(rdev, NULL);
11382                 return 0;
11383         }
11384
11385         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
11386                             rem_rule)
11387                 n_rules++;
11388         if (n_rules > coalesce->n_rules)
11389                 return -EINVAL;
11390
11391         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
11392                                      GFP_KERNEL);
11393         if (!new_coalesce.rules)
11394                 return -ENOMEM;
11395
11396         new_coalesce.n_rules = n_rules;
11397         i = 0;
11398
11399         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
11400                             rem_rule) {
11401                 err = nl80211_parse_coalesce_rule(rdev, rule,
11402                                                   &new_coalesce.rules[i]);
11403                 if (err)
11404                         goto error;
11405
11406                 i++;
11407         }
11408
11409         err = rdev_set_coalesce(rdev, &new_coalesce);
11410         if (err)
11411                 goto error;
11412
11413         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
11414         if (!n_coalesce) {
11415                 err = -ENOMEM;
11416                 goto error;
11417         }
11418         cfg80211_rdev_free_coalesce(rdev);
11419         rdev->coalesce = n_coalesce;
11420
11421         return 0;
11422 error:
11423         for (i = 0; i < new_coalesce.n_rules; i++) {
11424                 tmp_rule = &new_coalesce.rules[i];
11425                 for (j = 0; j < tmp_rule->n_patterns; j++)
11426                         kfree(tmp_rule->patterns[j].mask);
11427                 kfree(tmp_rule->patterns);
11428         }
11429         kfree(new_coalesce.rules);
11430
11431         return err;
11432 }
11433
11434 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
11435 {
11436         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11437         struct net_device *dev = info->user_ptr[1];
11438         struct wireless_dev *wdev = dev->ieee80211_ptr;
11439         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
11440         struct cfg80211_gtk_rekey_data rekey_data;
11441         int err;
11442
11443         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
11444                 return -EINVAL;
11445
11446         err = nla_parse_nested(tb, MAX_NL80211_REKEY_DATA,
11447                                info->attrs[NL80211_ATTR_REKEY_DATA],
11448                                nl80211_rekey_policy, info->extack);
11449         if (err)
11450                 return err;
11451
11452         if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
11453             !tb[NL80211_REKEY_DATA_KCK])
11454                 return -EINVAL;
11455         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
11456                 return -ERANGE;
11457         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
11458                 return -ERANGE;
11459         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
11460                 return -ERANGE;
11461
11462         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
11463         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
11464         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
11465
11466         wdev_lock(wdev);
11467         if (!wdev->current_bss) {
11468                 err = -ENOTCONN;
11469                 goto out;
11470         }
11471
11472         if (!rdev->ops->set_rekey_data) {
11473                 err = -EOPNOTSUPP;
11474                 goto out;
11475         }
11476
11477         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
11478  out:
11479         wdev_unlock(wdev);
11480         return err;
11481 }
11482
11483 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
11484                                              struct genl_info *info)
11485 {
11486         struct net_device *dev = info->user_ptr[1];
11487         struct wireless_dev *wdev = dev->ieee80211_ptr;
11488
11489         if (wdev->iftype != NL80211_IFTYPE_AP &&
11490             wdev->iftype != NL80211_IFTYPE_P2P_GO)
11491                 return -EINVAL;
11492
11493         if (wdev->ap_unexpected_nlportid)
11494                 return -EBUSY;
11495
11496         wdev->ap_unexpected_nlportid = info->snd_portid;
11497         return 0;
11498 }
11499
11500 static int nl80211_probe_client(struct sk_buff *skb,
11501                                 struct genl_info *info)
11502 {
11503         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11504         struct net_device *dev = info->user_ptr[1];
11505         struct wireless_dev *wdev = dev->ieee80211_ptr;
11506         struct sk_buff *msg;
11507         void *hdr;
11508         const u8 *addr;
11509         u64 cookie;
11510         int err;
11511
11512         if (wdev->iftype != NL80211_IFTYPE_AP &&
11513             wdev->iftype != NL80211_IFTYPE_P2P_GO)
11514                 return -EOPNOTSUPP;
11515
11516         if (!info->attrs[NL80211_ATTR_MAC])
11517                 return -EINVAL;
11518
11519         if (!rdev->ops->probe_client)
11520                 return -EOPNOTSUPP;
11521
11522         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11523         if (!msg)
11524                 return -ENOMEM;
11525
11526         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11527                              NL80211_CMD_PROBE_CLIENT);
11528         if (!hdr) {
11529                 err = -ENOBUFS;
11530                 goto free_msg;
11531         }
11532
11533         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
11534
11535         err = rdev_probe_client(rdev, dev, addr, &cookie);
11536         if (err)
11537                 goto free_msg;
11538
11539         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11540                               NL80211_ATTR_PAD))
11541                 goto nla_put_failure;
11542
11543         genlmsg_end(msg, hdr);
11544
11545         return genlmsg_reply(msg, info);
11546
11547  nla_put_failure:
11548         err = -ENOBUFS;
11549  free_msg:
11550         nlmsg_free(msg);
11551         return err;
11552 }
11553
11554 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
11555 {
11556         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11557         struct cfg80211_beacon_registration *reg, *nreg;
11558         int rv;
11559
11560         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
11561                 return -EOPNOTSUPP;
11562
11563         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
11564         if (!nreg)
11565                 return -ENOMEM;
11566
11567         /* First, check if already registered. */
11568         spin_lock_bh(&rdev->beacon_registrations_lock);
11569         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
11570                 if (reg->nlportid == info->snd_portid) {
11571                         rv = -EALREADY;
11572                         goto out_err;
11573                 }
11574         }
11575         /* Add it to the list */
11576         nreg->nlportid = info->snd_portid;
11577         list_add(&nreg->list, &rdev->beacon_registrations);
11578
11579         spin_unlock_bh(&rdev->beacon_registrations_lock);
11580
11581         return 0;
11582 out_err:
11583         spin_unlock_bh(&rdev->beacon_registrations_lock);
11584         kfree(nreg);
11585         return rv;
11586 }
11587
11588 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
11589 {
11590         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11591         struct wireless_dev *wdev = info->user_ptr[1];
11592         int err;
11593
11594         if (!rdev->ops->start_p2p_device)
11595                 return -EOPNOTSUPP;
11596
11597         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11598                 return -EOPNOTSUPP;
11599
11600         if (wdev_running(wdev))
11601                 return 0;
11602
11603         if (rfkill_blocked(rdev->rfkill))
11604                 return -ERFKILL;
11605
11606         err = rdev_start_p2p_device(rdev, wdev);
11607         if (err)
11608                 return err;
11609
11610         wdev->is_running = true;
11611         rdev->opencount++;
11612
11613         return 0;
11614 }
11615
11616 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
11617 {
11618         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11619         struct wireless_dev *wdev = info->user_ptr[1];
11620
11621         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11622                 return -EOPNOTSUPP;
11623
11624         if (!rdev->ops->stop_p2p_device)
11625                 return -EOPNOTSUPP;
11626
11627         cfg80211_stop_p2p_device(rdev, wdev);
11628
11629         return 0;
11630 }
11631
11632 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
11633 {
11634         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11635         struct wireless_dev *wdev = info->user_ptr[1];
11636         struct cfg80211_nan_conf conf = {};
11637         int err;
11638
11639         if (wdev->iftype != NL80211_IFTYPE_NAN)
11640                 return -EOPNOTSUPP;
11641
11642         if (wdev_running(wdev))
11643                 return -EEXIST;
11644
11645         if (rfkill_blocked(rdev->rfkill))
11646                 return -ERFKILL;
11647
11648         if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
11649                 return -EINVAL;
11650
11651         conf.master_pref =
11652                 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
11653         if (!conf.master_pref)
11654                 return -EINVAL;
11655
11656         if (info->attrs[NL80211_ATTR_BANDS]) {
11657                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
11658
11659                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
11660                         return -EOPNOTSUPP;
11661
11662                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
11663                         return -EINVAL;
11664
11665                 conf.bands = bands;
11666         }
11667
11668         err = rdev_start_nan(rdev, wdev, &conf);
11669         if (err)
11670                 return err;
11671
11672         wdev->is_running = true;
11673         rdev->opencount++;
11674
11675         return 0;
11676 }
11677
11678 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
11679 {
11680         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11681         struct wireless_dev *wdev = info->user_ptr[1];
11682
11683         if (wdev->iftype != NL80211_IFTYPE_NAN)
11684                 return -EOPNOTSUPP;
11685
11686         cfg80211_stop_nan(rdev, wdev);
11687
11688         return 0;
11689 }
11690
11691 static int validate_nan_filter(struct nlattr *filter_attr)
11692 {
11693         struct nlattr *attr;
11694         int len = 0, n_entries = 0, rem;
11695
11696         nla_for_each_nested(attr, filter_attr, rem) {
11697                 len += nla_len(attr);
11698                 n_entries++;
11699         }
11700
11701         if (len >= U8_MAX)
11702                 return -EINVAL;
11703
11704         return n_entries;
11705 }
11706
11707 static int handle_nan_filter(struct nlattr *attr_filter,
11708                              struct cfg80211_nan_func *func,
11709                              bool tx)
11710 {
11711         struct nlattr *attr;
11712         int n_entries, rem, i;
11713         struct cfg80211_nan_func_filter *filter;
11714
11715         n_entries = validate_nan_filter(attr_filter);
11716         if (n_entries < 0)
11717                 return n_entries;
11718
11719         BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
11720
11721         filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
11722         if (!filter)
11723                 return -ENOMEM;
11724
11725         i = 0;
11726         nla_for_each_nested(attr, attr_filter, rem) {
11727                 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
11728                 filter[i].len = nla_len(attr);
11729                 i++;
11730         }
11731         if (tx) {
11732                 func->num_tx_filters = n_entries;
11733                 func->tx_filters = filter;
11734         } else {
11735                 func->num_rx_filters = n_entries;
11736                 func->rx_filters = filter;
11737         }
11738
11739         return 0;
11740 }
11741
11742 static int nl80211_nan_add_func(struct sk_buff *skb,
11743                                 struct genl_info *info)
11744 {
11745         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11746         struct wireless_dev *wdev = info->user_ptr[1];
11747         struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
11748         struct cfg80211_nan_func *func;
11749         struct sk_buff *msg = NULL;
11750         void *hdr = NULL;
11751         int err = 0;
11752
11753         if (wdev->iftype != NL80211_IFTYPE_NAN)
11754                 return -EOPNOTSUPP;
11755
11756         if (!wdev_running(wdev))
11757                 return -ENOTCONN;
11758
11759         if (!info->attrs[NL80211_ATTR_NAN_FUNC])
11760                 return -EINVAL;
11761
11762         err = nla_parse_nested(tb, NL80211_NAN_FUNC_ATTR_MAX,
11763                                info->attrs[NL80211_ATTR_NAN_FUNC],
11764                                nl80211_nan_func_policy, info->extack);
11765         if (err)
11766                 return err;
11767
11768         func = kzalloc(sizeof(*func), GFP_KERNEL);
11769         if (!func)
11770                 return -ENOMEM;
11771
11772         func->cookie = wdev->wiphy->cookie_counter++;
11773
11774         if (!tb[NL80211_NAN_FUNC_TYPE] ||
11775             nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]) > NL80211_NAN_FUNC_MAX_TYPE) {
11776                 err = -EINVAL;
11777                 goto out;
11778         }
11779
11780
11781         func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
11782
11783         if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
11784                 err = -EINVAL;
11785                 goto out;
11786         }
11787
11788         memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
11789                sizeof(func->service_id));
11790
11791         func->close_range =
11792                 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
11793
11794         if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
11795                 func->serv_spec_info_len =
11796                         nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
11797                 func->serv_spec_info =
11798                         kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
11799                                 func->serv_spec_info_len,
11800                                 GFP_KERNEL);
11801                 if (!func->serv_spec_info) {
11802                         err = -ENOMEM;
11803                         goto out;
11804                 }
11805         }
11806
11807         if (tb[NL80211_NAN_FUNC_TTL])
11808                 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
11809
11810         switch (func->type) {
11811         case NL80211_NAN_FUNC_PUBLISH:
11812                 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
11813                         err = -EINVAL;
11814                         goto out;
11815                 }
11816
11817                 func->publish_type =
11818                         nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
11819                 func->publish_bcast =
11820                         nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
11821
11822                 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
11823                         func->publish_bcast) {
11824                         err = -EINVAL;
11825                         goto out;
11826                 }
11827                 break;
11828         case NL80211_NAN_FUNC_SUBSCRIBE:
11829                 func->subscribe_active =
11830                         nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
11831                 break;
11832         case NL80211_NAN_FUNC_FOLLOW_UP:
11833                 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
11834                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
11835                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
11836                         err = -EINVAL;
11837                         goto out;
11838                 }
11839
11840                 func->followup_id =
11841                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
11842                 func->followup_reqid =
11843                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
11844                 memcpy(func->followup_dest.addr,
11845                        nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
11846                        sizeof(func->followup_dest.addr));
11847                 if (func->ttl) {
11848                         err = -EINVAL;
11849                         goto out;
11850                 }
11851                 break;
11852         default:
11853                 err = -EINVAL;
11854                 goto out;
11855         }
11856
11857         if (tb[NL80211_NAN_FUNC_SRF]) {
11858                 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
11859
11860                 err = nla_parse_nested(srf_tb, NL80211_NAN_SRF_ATTR_MAX,
11861                                        tb[NL80211_NAN_FUNC_SRF],
11862                                        nl80211_nan_srf_policy, info->extack);
11863                 if (err)
11864                         goto out;
11865
11866                 func->srf_include =
11867                         nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
11868
11869                 if (srf_tb[NL80211_NAN_SRF_BF]) {
11870                         if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
11871                             !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
11872                                 err = -EINVAL;
11873                                 goto out;
11874                         }
11875
11876                         func->srf_bf_len =
11877                                 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
11878                         func->srf_bf =
11879                                 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
11880                                         func->srf_bf_len, GFP_KERNEL);
11881                         if (!func->srf_bf) {
11882                                 err = -ENOMEM;
11883                                 goto out;
11884                         }
11885
11886                         func->srf_bf_idx =
11887                                 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
11888                 } else {
11889                         struct nlattr *attr, *mac_attr =
11890                                 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
11891                         int n_entries, rem, i = 0;
11892
11893                         if (!mac_attr) {
11894                                 err = -EINVAL;
11895                                 goto out;
11896                         }
11897
11898                         n_entries = validate_acl_mac_addrs(mac_attr);
11899                         if (n_entries <= 0) {
11900                                 err = -EINVAL;
11901                                 goto out;
11902                         }
11903
11904                         func->srf_num_macs = n_entries;
11905                         func->srf_macs =
11906                                 kcalloc(n_entries, sizeof(*func->srf_macs),
11907                                         GFP_KERNEL);
11908                         if (!func->srf_macs) {
11909                                 err = -ENOMEM;
11910                                 goto out;
11911                         }
11912
11913                         nla_for_each_nested(attr, mac_attr, rem)
11914                                 memcpy(func->srf_macs[i++].addr, nla_data(attr),
11915                                        sizeof(*func->srf_macs));
11916                 }
11917         }
11918
11919         if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
11920                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
11921                                         func, true);
11922                 if (err)
11923                         goto out;
11924         }
11925
11926         if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
11927                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
11928                                         func, false);
11929                 if (err)
11930                         goto out;
11931         }
11932
11933         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11934         if (!msg) {
11935                 err = -ENOMEM;
11936                 goto out;
11937         }
11938
11939         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11940                              NL80211_CMD_ADD_NAN_FUNCTION);
11941         /* This can't really happen - we just allocated 4KB */
11942         if (WARN_ON(!hdr)) {
11943                 err = -ENOMEM;
11944                 goto out;
11945         }
11946
11947         err = rdev_add_nan_func(rdev, wdev, func);
11948 out:
11949         if (err < 0) {
11950                 cfg80211_free_nan_func(func);
11951                 nlmsg_free(msg);
11952                 return err;
11953         }
11954
11955         /* propagate the instance id and cookie to userspace  */
11956         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
11957                               NL80211_ATTR_PAD))
11958                 goto nla_put_failure;
11959
11960         func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
11961         if (!func_attr)
11962                 goto nla_put_failure;
11963
11964         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
11965                        func->instance_id))
11966                 goto nla_put_failure;
11967
11968         nla_nest_end(msg, func_attr);
11969
11970         genlmsg_end(msg, hdr);
11971         return genlmsg_reply(msg, info);
11972
11973 nla_put_failure:
11974         nlmsg_free(msg);
11975         return -ENOBUFS;
11976 }
11977
11978 static int nl80211_nan_del_func(struct sk_buff *skb,
11979                                struct genl_info *info)
11980 {
11981         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11982         struct wireless_dev *wdev = info->user_ptr[1];
11983         u64 cookie;
11984
11985         if (wdev->iftype != NL80211_IFTYPE_NAN)
11986                 return -EOPNOTSUPP;
11987
11988         if (!wdev_running(wdev))
11989                 return -ENOTCONN;
11990
11991         if (!info->attrs[NL80211_ATTR_COOKIE])
11992                 return -EINVAL;
11993
11994         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
11995
11996         rdev_del_nan_func(rdev, wdev, cookie);
11997
11998         return 0;
11999 }
12000
12001 static int nl80211_nan_change_config(struct sk_buff *skb,
12002                                      struct genl_info *info)
12003 {
12004         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12005         struct wireless_dev *wdev = info->user_ptr[1];
12006         struct cfg80211_nan_conf conf = {};
12007         u32 changed = 0;
12008
12009         if (wdev->iftype != NL80211_IFTYPE_NAN)
12010                 return -EOPNOTSUPP;
12011
12012         if (!wdev_running(wdev))
12013                 return -ENOTCONN;
12014
12015         if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
12016                 conf.master_pref =
12017                         nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
12018                 if (conf.master_pref <= 1 || conf.master_pref == 255)
12019                         return -EINVAL;
12020
12021                 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
12022         }
12023
12024         if (info->attrs[NL80211_ATTR_BANDS]) {
12025                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
12026
12027                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
12028                         return -EOPNOTSUPP;
12029
12030                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
12031                         return -EINVAL;
12032
12033                 conf.bands = bands;
12034                 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
12035         }
12036
12037         if (!changed)
12038                 return -EINVAL;
12039
12040         return rdev_nan_change_conf(rdev, wdev, &conf, changed);
12041 }
12042
12043 void cfg80211_nan_match(struct wireless_dev *wdev,
12044                         struct cfg80211_nan_match_params *match, gfp_t gfp)
12045 {
12046         struct wiphy *wiphy = wdev->wiphy;
12047         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12048         struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
12049         struct sk_buff *msg;
12050         void *hdr;
12051
12052         if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
12053                 return;
12054
12055         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12056         if (!msg)
12057                 return;
12058
12059         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
12060         if (!hdr) {
12061                 nlmsg_free(msg);
12062                 return;
12063         }
12064
12065         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12066             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12067                                          wdev->netdev->ifindex)) ||
12068             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12069                               NL80211_ATTR_PAD))
12070                 goto nla_put_failure;
12071
12072         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
12073                               NL80211_ATTR_PAD) ||
12074             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
12075                 goto nla_put_failure;
12076
12077         match_attr = nla_nest_start(msg, NL80211_ATTR_NAN_MATCH);
12078         if (!match_attr)
12079                 goto nla_put_failure;
12080
12081         local_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_LOCAL);
12082         if (!local_func_attr)
12083                 goto nla_put_failure;
12084
12085         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
12086                 goto nla_put_failure;
12087
12088         nla_nest_end(msg, local_func_attr);
12089
12090         peer_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_PEER);
12091         if (!peer_func_attr)
12092                 goto nla_put_failure;
12093
12094         if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
12095             nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
12096                 goto nla_put_failure;
12097
12098         if (match->info && match->info_len &&
12099             nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
12100                     match->info))
12101                 goto nla_put_failure;
12102
12103         nla_nest_end(msg, peer_func_attr);
12104         nla_nest_end(msg, match_attr);
12105         genlmsg_end(msg, hdr);
12106
12107         if (!wdev->owner_nlportid)
12108                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12109                                         msg, 0, NL80211_MCGRP_NAN, gfp);
12110         else
12111                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
12112                                 wdev->owner_nlportid);
12113
12114         return;
12115
12116 nla_put_failure:
12117         nlmsg_free(msg);
12118 }
12119 EXPORT_SYMBOL(cfg80211_nan_match);
12120
12121 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
12122                                   u8 inst_id,
12123                                   enum nl80211_nan_func_term_reason reason,
12124                                   u64 cookie, gfp_t gfp)
12125 {
12126         struct wiphy *wiphy = wdev->wiphy;
12127         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12128         struct sk_buff *msg;
12129         struct nlattr *func_attr;
12130         void *hdr;
12131
12132         if (WARN_ON(!inst_id))
12133                 return;
12134
12135         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12136         if (!msg)
12137                 return;
12138
12139         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
12140         if (!hdr) {
12141                 nlmsg_free(msg);
12142                 return;
12143         }
12144
12145         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12146             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12147                                          wdev->netdev->ifindex)) ||
12148             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12149                               NL80211_ATTR_PAD))
12150                 goto nla_put_failure;
12151
12152         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12153                               NL80211_ATTR_PAD))
12154                 goto nla_put_failure;
12155
12156         func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
12157         if (!func_attr)
12158                 goto nla_put_failure;
12159
12160         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
12161             nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
12162                 goto nla_put_failure;
12163
12164         nla_nest_end(msg, func_attr);
12165         genlmsg_end(msg, hdr);
12166
12167         if (!wdev->owner_nlportid)
12168                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12169                                         msg, 0, NL80211_MCGRP_NAN, gfp);
12170         else
12171                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
12172                                 wdev->owner_nlportid);
12173
12174         return;
12175
12176 nla_put_failure:
12177         nlmsg_free(msg);
12178 }
12179 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
12180
12181 static int nl80211_get_protocol_features(struct sk_buff *skb,
12182                                          struct genl_info *info)
12183 {
12184         void *hdr;
12185         struct sk_buff *msg;
12186
12187         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12188         if (!msg)
12189                 return -ENOMEM;
12190
12191         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12192                              NL80211_CMD_GET_PROTOCOL_FEATURES);
12193         if (!hdr)
12194                 goto nla_put_failure;
12195
12196         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
12197                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
12198                 goto nla_put_failure;
12199
12200         genlmsg_end(msg, hdr);
12201         return genlmsg_reply(msg, info);
12202
12203  nla_put_failure:
12204         kfree_skb(msg);
12205         return -ENOBUFS;
12206 }
12207
12208 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
12209 {
12210         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12211         struct cfg80211_update_ft_ies_params ft_params;
12212         struct net_device *dev = info->user_ptr[1];
12213
12214         if (!rdev->ops->update_ft_ies)
12215                 return -EOPNOTSUPP;
12216
12217         if (!info->attrs[NL80211_ATTR_MDID] ||
12218             !info->attrs[NL80211_ATTR_IE] ||
12219             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
12220                 return -EINVAL;
12221
12222         memset(&ft_params, 0, sizeof(ft_params));
12223         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
12224         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12225         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12226
12227         return rdev_update_ft_ies(rdev, dev, &ft_params);
12228 }
12229
12230 static int nl80211_crit_protocol_start(struct sk_buff *skb,
12231                                        struct genl_info *info)
12232 {
12233         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12234         struct wireless_dev *wdev = info->user_ptr[1];
12235         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
12236         u16 duration;
12237         int ret;
12238
12239         if (!rdev->ops->crit_proto_start)
12240                 return -EOPNOTSUPP;
12241
12242         if (WARN_ON(!rdev->ops->crit_proto_stop))
12243                 return -EINVAL;
12244
12245         if (rdev->crit_proto_nlportid)
12246                 return -EBUSY;
12247
12248         /* determine protocol if provided */
12249         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
12250                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
12251
12252         if (proto >= NUM_NL80211_CRIT_PROTO)
12253                 return -EINVAL;
12254
12255         /* timeout must be provided */
12256         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
12257                 return -EINVAL;
12258
12259         duration =
12260                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
12261
12262         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
12263                 return -ERANGE;
12264
12265         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
12266         if (!ret)
12267                 rdev->crit_proto_nlportid = info->snd_portid;
12268
12269         return ret;
12270 }
12271
12272 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
12273                                       struct genl_info *info)
12274 {
12275         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12276         struct wireless_dev *wdev = info->user_ptr[1];
12277
12278         if (!rdev->ops->crit_proto_stop)
12279                 return -EOPNOTSUPP;
12280
12281         if (rdev->crit_proto_nlportid) {
12282                 rdev->crit_proto_nlportid = 0;
12283                 rdev_crit_proto_stop(rdev, wdev);
12284         }
12285         return 0;
12286 }
12287
12288 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
12289 {
12290         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12291         struct wireless_dev *wdev =
12292                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
12293         int i, err;
12294         u32 vid, subcmd;
12295
12296         if (!rdev->wiphy.vendor_commands)
12297                 return -EOPNOTSUPP;
12298
12299         if (IS_ERR(wdev)) {
12300                 err = PTR_ERR(wdev);
12301                 if (err != -EINVAL)
12302                         return err;
12303                 wdev = NULL;
12304         } else if (wdev->wiphy != &rdev->wiphy) {
12305                 return -EINVAL;
12306         }
12307
12308         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
12309             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
12310                 return -EINVAL;
12311
12312         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
12313         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
12314         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
12315                 const struct wiphy_vendor_command *vcmd;
12316                 void *data = NULL;
12317                 int len = 0;
12318
12319                 vcmd = &rdev->wiphy.vendor_commands[i];
12320
12321                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
12322                         continue;
12323
12324                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
12325                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
12326                         if (!wdev)
12327                                 return -EINVAL;
12328                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
12329                             !wdev->netdev)
12330                                 return -EINVAL;
12331
12332                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
12333                                 if (!wdev_running(wdev))
12334                                         return -ENETDOWN;
12335                         }
12336
12337                         if (!vcmd->doit)
12338                                 return -EOPNOTSUPP;
12339                 } else {
12340                         wdev = NULL;
12341                 }
12342
12343                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
12344                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
12345                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
12346                 }
12347
12348                 rdev->cur_cmd_info = info;
12349                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
12350                                                           data, len);
12351                 rdev->cur_cmd_info = NULL;
12352                 return err;
12353         }
12354
12355         return -EOPNOTSUPP;
12356 }
12357
12358 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
12359                                        struct netlink_callback *cb,
12360                                        struct cfg80211_registered_device **rdev,
12361                                        struct wireless_dev **wdev)
12362 {
12363         struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
12364         u32 vid, subcmd;
12365         unsigned int i;
12366         int vcmd_idx = -1;
12367         int err;
12368         void *data = NULL;
12369         unsigned int data_len = 0;
12370
12371         if (cb->args[0]) {
12372                 /* subtract the 1 again here */
12373                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
12374                 struct wireless_dev *tmp;
12375
12376                 if (!wiphy)
12377                         return -ENODEV;
12378                 *rdev = wiphy_to_rdev(wiphy);
12379                 *wdev = NULL;
12380
12381                 if (cb->args[1]) {
12382                         list_for_each_entry(tmp, &wiphy->wdev_list, list) {
12383                                 if (tmp->identifier == cb->args[1] - 1) {
12384                                         *wdev = tmp;
12385                                         break;
12386                                 }
12387                         }
12388                 }
12389
12390                 /* keep rtnl locked in successful case */
12391                 return 0;
12392         }
12393
12394         err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, attrbuf,
12395                           nl80211_fam.maxattr, nl80211_policy, NULL);
12396         if (err)
12397                 return err;
12398
12399         if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
12400             !attrbuf[NL80211_ATTR_VENDOR_SUBCMD])
12401                 return -EINVAL;
12402
12403         *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf);
12404         if (IS_ERR(*wdev))
12405                 *wdev = NULL;
12406
12407         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
12408         if (IS_ERR(*rdev))
12409                 return PTR_ERR(*rdev);
12410
12411         vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
12412         subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
12413
12414         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
12415                 const struct wiphy_vendor_command *vcmd;
12416
12417                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
12418
12419                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
12420                         continue;
12421
12422                 if (!vcmd->dumpit)
12423                         return -EOPNOTSUPP;
12424
12425                 vcmd_idx = i;
12426                 break;
12427         }
12428
12429         if (vcmd_idx < 0)
12430                 return -EOPNOTSUPP;
12431
12432         if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
12433                 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
12434                 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
12435         }
12436
12437         /* 0 is the first index - add 1 to parse only once */
12438         cb->args[0] = (*rdev)->wiphy_idx + 1;
12439         /* add 1 to know if it was NULL */
12440         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
12441         cb->args[2] = vcmd_idx;
12442         cb->args[3] = (unsigned long)data;
12443         cb->args[4] = data_len;
12444
12445         /* keep rtnl locked in successful case */
12446         return 0;
12447 }
12448
12449 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
12450                                    struct netlink_callback *cb)
12451 {
12452         struct cfg80211_registered_device *rdev;
12453         struct wireless_dev *wdev;
12454         unsigned int vcmd_idx;
12455         const struct wiphy_vendor_command *vcmd;
12456         void *data;
12457         int data_len;
12458         int err;
12459         struct nlattr *vendor_data;
12460
12461         rtnl_lock();
12462         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
12463         if (err)
12464                 goto out;
12465
12466         vcmd_idx = cb->args[2];
12467         data = (void *)cb->args[3];
12468         data_len = cb->args[4];
12469         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
12470
12471         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
12472                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
12473                 if (!wdev) {
12474                         err = -EINVAL;
12475                         goto out;
12476                 }
12477                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
12478                     !wdev->netdev) {
12479                         err = -EINVAL;
12480                         goto out;
12481                 }
12482
12483                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
12484                         if (!wdev_running(wdev)) {
12485                                 err = -ENETDOWN;
12486                                 goto out;
12487                         }
12488                 }
12489         }
12490
12491         while (1) {
12492                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
12493                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
12494                                            NL80211_CMD_VENDOR);
12495                 if (!hdr)
12496                         break;
12497
12498                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12499                     (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
12500                                                wdev_id(wdev),
12501                                                NL80211_ATTR_PAD))) {
12502                         genlmsg_cancel(skb, hdr);
12503                         break;
12504                 }
12505
12506                 vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA);
12507                 if (!vendor_data) {
12508                         genlmsg_cancel(skb, hdr);
12509                         break;
12510                 }
12511
12512                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
12513                                    (unsigned long *)&cb->args[5]);
12514                 nla_nest_end(skb, vendor_data);
12515
12516                 if (err == -ENOBUFS || err == -ENOENT) {
12517                         genlmsg_cancel(skb, hdr);
12518                         break;
12519                 } else if (err) {
12520                         genlmsg_cancel(skb, hdr);
12521                         goto out;
12522                 }
12523
12524                 genlmsg_end(skb, hdr);
12525         }
12526
12527         err = skb->len;
12528  out:
12529         rtnl_unlock();
12530         return err;
12531 }
12532
12533 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
12534                                            enum nl80211_commands cmd,
12535                                            enum nl80211_attrs attr,
12536                                            int approxlen)
12537 {
12538         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12539
12540         if (WARN_ON(!rdev->cur_cmd_info))
12541                 return NULL;
12542
12543         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
12544                                            rdev->cur_cmd_info->snd_portid,
12545                                            rdev->cur_cmd_info->snd_seq,
12546                                            cmd, attr, NULL, GFP_KERNEL);
12547 }
12548 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
12549
12550 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
12551 {
12552         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
12553         void *hdr = ((void **)skb->cb)[1];
12554         struct nlattr *data = ((void **)skb->cb)[2];
12555
12556         /* clear CB data for netlink core to own from now on */
12557         memset(skb->cb, 0, sizeof(skb->cb));
12558
12559         if (WARN_ON(!rdev->cur_cmd_info)) {
12560                 kfree_skb(skb);
12561                 return -EINVAL;
12562         }
12563
12564         nla_nest_end(skb, data);
12565         genlmsg_end(skb, hdr);
12566         return genlmsg_reply(skb, rdev->cur_cmd_info);
12567 }
12568 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
12569
12570 static int nl80211_set_qos_map(struct sk_buff *skb,
12571                                struct genl_info *info)
12572 {
12573         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12574         struct cfg80211_qos_map *qos_map = NULL;
12575         struct net_device *dev = info->user_ptr[1];
12576         u8 *pos, len, num_des, des_len, des;
12577         int ret;
12578
12579         if (!rdev->ops->set_qos_map)
12580                 return -EOPNOTSUPP;
12581
12582         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
12583                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
12584                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
12585
12586                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
12587                     len > IEEE80211_QOS_MAP_LEN_MAX)
12588                         return -EINVAL;
12589
12590                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
12591                 if (!qos_map)
12592                         return -ENOMEM;
12593
12594                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
12595                 if (num_des) {
12596                         des_len = num_des *
12597                                 sizeof(struct cfg80211_dscp_exception);
12598                         memcpy(qos_map->dscp_exception, pos, des_len);
12599                         qos_map->num_des = num_des;
12600                         for (des = 0; des < num_des; des++) {
12601                                 if (qos_map->dscp_exception[des].up > 7) {
12602                                         kfree(qos_map);
12603                                         return -EINVAL;
12604                                 }
12605                         }
12606                         pos += des_len;
12607                 }
12608                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
12609         }
12610
12611         wdev_lock(dev->ieee80211_ptr);
12612         ret = nl80211_key_allowed(dev->ieee80211_ptr);
12613         if (!ret)
12614                 ret = rdev_set_qos_map(rdev, dev, qos_map);
12615         wdev_unlock(dev->ieee80211_ptr);
12616
12617         kfree(qos_map);
12618         return ret;
12619 }
12620
12621 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
12622 {
12623         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12624         struct net_device *dev = info->user_ptr[1];
12625         struct wireless_dev *wdev = dev->ieee80211_ptr;
12626         const u8 *peer;
12627         u8 tsid, up;
12628         u16 admitted_time = 0;
12629         int err;
12630
12631         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
12632                 return -EOPNOTSUPP;
12633
12634         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
12635             !info->attrs[NL80211_ATTR_USER_PRIO])
12636                 return -EINVAL;
12637
12638         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
12639         if (tsid >= IEEE80211_NUM_TIDS)
12640                 return -EINVAL;
12641
12642         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
12643         if (up >= IEEE80211_NUM_UPS)
12644                 return -EINVAL;
12645
12646         /* WMM uses TIDs 0-7 even for TSPEC */
12647         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
12648                 /* TODO: handle 802.11 TSPEC/admission control
12649                  * need more attributes for that (e.g. BA session requirement);
12650                  * change the WMM adminssion test above to allow both then
12651                  */
12652                 return -EINVAL;
12653         }
12654
12655         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12656
12657         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
12658                 admitted_time =
12659                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
12660                 if (!admitted_time)
12661                         return -EINVAL;
12662         }
12663
12664         wdev_lock(wdev);
12665         switch (wdev->iftype) {
12666         case NL80211_IFTYPE_STATION:
12667         case NL80211_IFTYPE_P2P_CLIENT:
12668                 if (wdev->current_bss)
12669                         break;
12670                 err = -ENOTCONN;
12671                 goto out;
12672         default:
12673                 err = -EOPNOTSUPP;
12674                 goto out;
12675         }
12676
12677         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
12678
12679  out:
12680         wdev_unlock(wdev);
12681         return err;
12682 }
12683
12684 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
12685 {
12686         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12687         struct net_device *dev = info->user_ptr[1];
12688         struct wireless_dev *wdev = dev->ieee80211_ptr;
12689         const u8 *peer;
12690         u8 tsid;
12691         int err;
12692
12693         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
12694                 return -EINVAL;
12695
12696         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
12697         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12698
12699         wdev_lock(wdev);
12700         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
12701         wdev_unlock(wdev);
12702
12703         return err;
12704 }
12705
12706 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
12707                                        struct genl_info *info)
12708 {
12709         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12710         struct net_device *dev = info->user_ptr[1];
12711         struct wireless_dev *wdev = dev->ieee80211_ptr;
12712         struct cfg80211_chan_def chandef = {};
12713         const u8 *addr;
12714         u8 oper_class;
12715         int err;
12716
12717         if (!rdev->ops->tdls_channel_switch ||
12718             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
12719                 return -EOPNOTSUPP;
12720
12721         switch (dev->ieee80211_ptr->iftype) {
12722         case NL80211_IFTYPE_STATION:
12723         case NL80211_IFTYPE_P2P_CLIENT:
12724                 break;
12725         default:
12726                 return -EOPNOTSUPP;
12727         }
12728
12729         if (!info->attrs[NL80211_ATTR_MAC] ||
12730             !info->attrs[NL80211_ATTR_OPER_CLASS])
12731                 return -EINVAL;
12732
12733         err = nl80211_parse_chandef(rdev, info, &chandef);
12734         if (err)
12735                 return err;
12736
12737         /*
12738          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
12739          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
12740          * specification is not defined for them.
12741          */
12742         if (chandef.chan->band == NL80211_BAND_2GHZ &&
12743             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
12744             chandef.width != NL80211_CHAN_WIDTH_20)
12745                 return -EINVAL;
12746
12747         /* we will be active on the TDLS link */
12748         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
12749                                            wdev->iftype))
12750                 return -EINVAL;
12751
12752         /* don't allow switching to DFS channels */
12753         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
12754                 return -EINVAL;
12755
12756         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12757         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
12758
12759         wdev_lock(wdev);
12760         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
12761         wdev_unlock(wdev);
12762
12763         return err;
12764 }
12765
12766 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
12767                                               struct genl_info *info)
12768 {
12769         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12770         struct net_device *dev = info->user_ptr[1];
12771         struct wireless_dev *wdev = dev->ieee80211_ptr;
12772         const u8 *addr;
12773
12774         if (!rdev->ops->tdls_channel_switch ||
12775             !rdev->ops->tdls_cancel_channel_switch ||
12776             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
12777                 return -EOPNOTSUPP;
12778
12779         switch (dev->ieee80211_ptr->iftype) {
12780         case NL80211_IFTYPE_STATION:
12781         case NL80211_IFTYPE_P2P_CLIENT:
12782                 break;
12783         default:
12784                 return -EOPNOTSUPP;
12785         }
12786
12787         if (!info->attrs[NL80211_ATTR_MAC])
12788                 return -EINVAL;
12789
12790         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12791
12792         wdev_lock(wdev);
12793         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
12794         wdev_unlock(wdev);
12795
12796         return 0;
12797 }
12798
12799 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
12800                                             struct genl_info *info)
12801 {
12802         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12803         struct net_device *dev = info->user_ptr[1];
12804         struct wireless_dev *wdev = dev->ieee80211_ptr;
12805         const struct nlattr *nla;
12806         bool enabled;
12807
12808         if (!rdev->ops->set_multicast_to_unicast)
12809                 return -EOPNOTSUPP;
12810
12811         if (wdev->iftype != NL80211_IFTYPE_AP &&
12812             wdev->iftype != NL80211_IFTYPE_P2P_GO)
12813                 return -EOPNOTSUPP;
12814
12815         nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
12816         enabled = nla_get_flag(nla);
12817
12818         return rdev_set_multicast_to_unicast(rdev, dev, enabled);
12819 }
12820
12821 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
12822 {
12823         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12824         struct net_device *dev = info->user_ptr[1];
12825         struct wireless_dev *wdev = dev->ieee80211_ptr;
12826         struct cfg80211_pmk_conf pmk_conf = {};
12827         int ret;
12828
12829         if (wdev->iftype != NL80211_IFTYPE_STATION &&
12830             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12831                 return -EOPNOTSUPP;
12832
12833         if (!wiphy_ext_feature_isset(&rdev->wiphy,
12834                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
12835                 return -EOPNOTSUPP;
12836
12837         if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
12838                 return -EINVAL;
12839
12840         wdev_lock(wdev);
12841         if (!wdev->current_bss) {
12842                 ret = -ENOTCONN;
12843                 goto out;
12844         }
12845
12846         pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
12847         if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) {
12848                 ret = -EINVAL;
12849                 goto out;
12850         }
12851
12852         pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
12853         pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
12854         if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
12855             pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
12856                 ret = -EINVAL;
12857                 goto out;
12858         }
12859
12860         if (info->attrs[NL80211_ATTR_PMKR0_NAME]) {
12861                 int r0_name_len = nla_len(info->attrs[NL80211_ATTR_PMKR0_NAME]);
12862
12863                 if (r0_name_len != WLAN_PMK_NAME_LEN) {
12864                         ret = -EINVAL;
12865                         goto out;
12866                 }
12867
12868                 pmk_conf.pmk_r0_name =
12869                         nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
12870         }
12871
12872         ret = rdev_set_pmk(rdev, dev, &pmk_conf);
12873 out:
12874         wdev_unlock(wdev);
12875         return ret;
12876 }
12877
12878 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
12879 {
12880         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12881         struct net_device *dev = info->user_ptr[1];
12882         struct wireless_dev *wdev = dev->ieee80211_ptr;
12883         const u8 *aa;
12884         int ret;
12885
12886         if (wdev->iftype != NL80211_IFTYPE_STATION &&
12887             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12888                 return -EOPNOTSUPP;
12889
12890         if (!wiphy_ext_feature_isset(&rdev->wiphy,
12891                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
12892                 return -EOPNOTSUPP;
12893
12894         if (!info->attrs[NL80211_ATTR_MAC])
12895                 return -EINVAL;
12896
12897         wdev_lock(wdev);
12898         aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
12899         ret = rdev_del_pmk(rdev, dev, aa);
12900         wdev_unlock(wdev);
12901
12902         return ret;
12903 }
12904
12905 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
12906 {
12907         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12908         struct net_device *dev = info->user_ptr[1];
12909         struct cfg80211_external_auth_params params;
12910
12911         if (!rdev->ops->external_auth)
12912                 return -EOPNOTSUPP;
12913
12914         if (!info->attrs[NL80211_ATTR_SSID])
12915                 return -EINVAL;
12916
12917         if (!info->attrs[NL80211_ATTR_BSSID])
12918                 return -EINVAL;
12919
12920         if (!info->attrs[NL80211_ATTR_STATUS_CODE])
12921                 return -EINVAL;
12922
12923         memset(&params, 0, sizeof(params));
12924
12925         params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12926         if (params.ssid.ssid_len == 0 ||
12927             params.ssid.ssid_len > IEEE80211_MAX_SSID_LEN)
12928                 return -EINVAL;
12929         memcpy(params.ssid.ssid, nla_data(info->attrs[NL80211_ATTR_SSID]),
12930                params.ssid.ssid_len);
12931
12932         memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
12933                ETH_ALEN);
12934
12935         params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
12936
12937         return rdev_external_auth(rdev, dev, &params);
12938 }
12939
12940 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
12941 {
12942         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12943         struct net_device *dev = info->user_ptr[1];
12944         struct wireless_dev *wdev = dev->ieee80211_ptr;
12945         const u8 *buf;
12946         size_t len;
12947         u8 *dest;
12948         u16 proto;
12949         bool noencrypt;
12950         int err;
12951
12952         if (!wiphy_ext_feature_isset(&rdev->wiphy,
12953                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
12954                 return -EOPNOTSUPP;
12955
12956         if (!rdev->ops->tx_control_port)
12957                 return -EOPNOTSUPP;
12958
12959         if (!info->attrs[NL80211_ATTR_FRAME] ||
12960             !info->attrs[NL80211_ATTR_MAC] ||
12961             !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
12962                 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
12963                 return -EINVAL;
12964         }
12965
12966         wdev_lock(wdev);
12967
12968         switch (wdev->iftype) {
12969         case NL80211_IFTYPE_AP:
12970         case NL80211_IFTYPE_P2P_GO:
12971         case NL80211_IFTYPE_MESH_POINT:
12972                 break;
12973         case NL80211_IFTYPE_ADHOC:
12974         case NL80211_IFTYPE_STATION:
12975         case NL80211_IFTYPE_P2P_CLIENT:
12976                 if (wdev->current_bss)
12977                         break;
12978                 err = -ENOTCONN;
12979                 goto out;
12980         default:
12981                 err = -EOPNOTSUPP;
12982                 goto out;
12983         }
12984
12985         wdev_unlock(wdev);
12986
12987         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
12988         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
12989         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
12990         proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
12991         noencrypt =
12992                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
12993
12994         return rdev_tx_control_port(rdev, dev, buf, len,
12995                                     dest, cpu_to_be16(proto), noencrypt);
12996
12997  out:
12998         wdev_unlock(wdev);
12999         return err;
13000 }
13001
13002 #define NL80211_FLAG_NEED_WIPHY         0x01
13003 #define NL80211_FLAG_NEED_NETDEV        0x02
13004 #define NL80211_FLAG_NEED_RTNL          0x04
13005 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
13006 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
13007                                          NL80211_FLAG_CHECK_NETDEV_UP)
13008 #define NL80211_FLAG_NEED_WDEV          0x10
13009 /* If a netdev is associated, it must be UP, P2P must be started */
13010 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
13011                                          NL80211_FLAG_CHECK_NETDEV_UP)
13012 #define NL80211_FLAG_CLEAR_SKB          0x20
13013
13014 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
13015                             struct genl_info *info)
13016 {
13017         struct cfg80211_registered_device *rdev;
13018         struct wireless_dev *wdev;
13019         struct net_device *dev;
13020         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
13021
13022         if (rtnl)
13023                 rtnl_lock();
13024
13025         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
13026                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
13027                 if (IS_ERR(rdev)) {
13028                         if (rtnl)
13029                                 rtnl_unlock();
13030                         return PTR_ERR(rdev);
13031                 }
13032                 info->user_ptr[0] = rdev;
13033         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
13034                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
13035                 ASSERT_RTNL();
13036
13037                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
13038                                                   info->attrs);
13039                 if (IS_ERR(wdev)) {
13040                         if (rtnl)
13041                                 rtnl_unlock();
13042                         return PTR_ERR(wdev);
13043                 }
13044
13045                 dev = wdev->netdev;
13046                 rdev = wiphy_to_rdev(wdev->wiphy);
13047
13048                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
13049                         if (!dev) {
13050                                 if (rtnl)
13051                                         rtnl_unlock();
13052                                 return -EINVAL;
13053                         }
13054
13055                         info->user_ptr[1] = dev;
13056                 } else {
13057                         info->user_ptr[1] = wdev;
13058                 }
13059
13060                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
13061                     !wdev_running(wdev)) {
13062                         if (rtnl)
13063                                 rtnl_unlock();
13064                         return -ENETDOWN;
13065                 }
13066
13067                 if (dev)
13068                         dev_hold(dev);
13069
13070                 info->user_ptr[0] = rdev;
13071         }
13072
13073         return 0;
13074 }
13075
13076 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
13077                               struct genl_info *info)
13078 {
13079         if (info->user_ptr[1]) {
13080                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
13081                         struct wireless_dev *wdev = info->user_ptr[1];
13082
13083                         if (wdev->netdev)
13084                                 dev_put(wdev->netdev);
13085                 } else {
13086                         dev_put(info->user_ptr[1]);
13087                 }
13088         }
13089
13090         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
13091                 rtnl_unlock();
13092
13093         /* If needed, clear the netlink message payload from the SKB
13094          * as it might contain key data that shouldn't stick around on
13095          * the heap after the SKB is freed. The netlink message header
13096          * is still needed for further processing, so leave it intact.
13097          */
13098         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
13099                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
13100
13101                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
13102         }
13103 }
13104
13105 static const struct genl_ops nl80211_ops[] = {
13106         {
13107                 .cmd = NL80211_CMD_GET_WIPHY,
13108                 .doit = nl80211_get_wiphy,
13109                 .dumpit = nl80211_dump_wiphy,
13110                 .done = nl80211_dump_wiphy_done,
13111                 .policy = nl80211_policy,
13112                 /* can be retrieved by unprivileged users */
13113                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13114                                   NL80211_FLAG_NEED_RTNL,
13115         },
13116         {
13117                 .cmd = NL80211_CMD_SET_WIPHY,
13118                 .doit = nl80211_set_wiphy,
13119                 .policy = nl80211_policy,
13120                 .flags = GENL_UNS_ADMIN_PERM,
13121                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13122         },
13123         {
13124                 .cmd = NL80211_CMD_GET_INTERFACE,
13125                 .doit = nl80211_get_interface,
13126                 .dumpit = nl80211_dump_interface,
13127                 .policy = nl80211_policy,
13128                 /* can be retrieved by unprivileged users */
13129                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13130                                   NL80211_FLAG_NEED_RTNL,
13131         },
13132         {
13133                 .cmd = NL80211_CMD_SET_INTERFACE,
13134                 .doit = nl80211_set_interface,
13135                 .policy = nl80211_policy,
13136                 .flags = GENL_UNS_ADMIN_PERM,
13137                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13138                                   NL80211_FLAG_NEED_RTNL,
13139         },
13140         {
13141                 .cmd = NL80211_CMD_NEW_INTERFACE,
13142                 .doit = nl80211_new_interface,
13143                 .policy = nl80211_policy,
13144                 .flags = GENL_UNS_ADMIN_PERM,
13145                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13146                                   NL80211_FLAG_NEED_RTNL,
13147         },
13148         {
13149                 .cmd = NL80211_CMD_DEL_INTERFACE,
13150                 .doit = nl80211_del_interface,
13151                 .policy = nl80211_policy,
13152                 .flags = GENL_UNS_ADMIN_PERM,
13153                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13154                                   NL80211_FLAG_NEED_RTNL,
13155         },
13156         {
13157                 .cmd = NL80211_CMD_GET_KEY,
13158                 .doit = nl80211_get_key,
13159                 .policy = nl80211_policy,
13160                 .flags = GENL_UNS_ADMIN_PERM,
13161                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13162                                   NL80211_FLAG_NEED_RTNL,
13163         },
13164         {
13165                 .cmd = NL80211_CMD_SET_KEY,
13166                 .doit = nl80211_set_key,
13167                 .policy = nl80211_policy,
13168                 .flags = GENL_UNS_ADMIN_PERM,
13169                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13170                                   NL80211_FLAG_NEED_RTNL |
13171                                   NL80211_FLAG_CLEAR_SKB,
13172         },
13173         {
13174                 .cmd = NL80211_CMD_NEW_KEY,
13175                 .doit = nl80211_new_key,
13176                 .policy = nl80211_policy,
13177                 .flags = GENL_UNS_ADMIN_PERM,
13178                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13179                                   NL80211_FLAG_NEED_RTNL |
13180                                   NL80211_FLAG_CLEAR_SKB,
13181         },
13182         {
13183                 .cmd = NL80211_CMD_DEL_KEY,
13184                 .doit = nl80211_del_key,
13185                 .policy = nl80211_policy,
13186                 .flags = GENL_UNS_ADMIN_PERM,
13187                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13188                                   NL80211_FLAG_NEED_RTNL,
13189         },
13190         {
13191                 .cmd = NL80211_CMD_SET_BEACON,
13192                 .policy = nl80211_policy,
13193                 .flags = GENL_UNS_ADMIN_PERM,
13194                 .doit = nl80211_set_beacon,
13195                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13196                                   NL80211_FLAG_NEED_RTNL,
13197         },
13198         {
13199                 .cmd = NL80211_CMD_START_AP,
13200                 .policy = nl80211_policy,
13201                 .flags = GENL_UNS_ADMIN_PERM,
13202                 .doit = nl80211_start_ap,
13203                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13204                                   NL80211_FLAG_NEED_RTNL,
13205         },
13206         {
13207                 .cmd = NL80211_CMD_STOP_AP,
13208                 .policy = nl80211_policy,
13209                 .flags = GENL_UNS_ADMIN_PERM,
13210                 .doit = nl80211_stop_ap,
13211                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13212                                   NL80211_FLAG_NEED_RTNL,
13213         },
13214         {
13215                 .cmd = NL80211_CMD_GET_STATION,
13216                 .doit = nl80211_get_station,
13217                 .dumpit = nl80211_dump_station,
13218                 .policy = nl80211_policy,
13219                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13220                                   NL80211_FLAG_NEED_RTNL,
13221         },
13222         {
13223                 .cmd = NL80211_CMD_SET_STATION,
13224                 .doit = nl80211_set_station,
13225                 .policy = nl80211_policy,
13226                 .flags = GENL_UNS_ADMIN_PERM,
13227                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13228                                   NL80211_FLAG_NEED_RTNL,
13229         },
13230         {
13231                 .cmd = NL80211_CMD_NEW_STATION,
13232                 .doit = nl80211_new_station,
13233                 .policy = nl80211_policy,
13234                 .flags = GENL_UNS_ADMIN_PERM,
13235                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13236                                   NL80211_FLAG_NEED_RTNL,
13237         },
13238         {
13239                 .cmd = NL80211_CMD_DEL_STATION,
13240                 .doit = nl80211_del_station,
13241                 .policy = nl80211_policy,
13242                 .flags = GENL_UNS_ADMIN_PERM,
13243                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13244                                   NL80211_FLAG_NEED_RTNL,
13245         },
13246         {
13247                 .cmd = NL80211_CMD_GET_MPATH,
13248                 .doit = nl80211_get_mpath,
13249                 .dumpit = nl80211_dump_mpath,
13250                 .policy = nl80211_policy,
13251                 .flags = GENL_UNS_ADMIN_PERM,
13252                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13253                                   NL80211_FLAG_NEED_RTNL,
13254         },
13255         {
13256                 .cmd = NL80211_CMD_GET_MPP,
13257                 .doit = nl80211_get_mpp,
13258                 .dumpit = nl80211_dump_mpp,
13259                 .policy = nl80211_policy,
13260                 .flags = GENL_UNS_ADMIN_PERM,
13261                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13262                                   NL80211_FLAG_NEED_RTNL,
13263         },
13264         {
13265                 .cmd = NL80211_CMD_SET_MPATH,
13266                 .doit = nl80211_set_mpath,
13267                 .policy = nl80211_policy,
13268                 .flags = GENL_UNS_ADMIN_PERM,
13269                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13270                                   NL80211_FLAG_NEED_RTNL,
13271         },
13272         {
13273                 .cmd = NL80211_CMD_NEW_MPATH,
13274                 .doit = nl80211_new_mpath,
13275                 .policy = nl80211_policy,
13276                 .flags = GENL_UNS_ADMIN_PERM,
13277                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13278                                   NL80211_FLAG_NEED_RTNL,
13279         },
13280         {
13281                 .cmd = NL80211_CMD_DEL_MPATH,
13282                 .doit = nl80211_del_mpath,
13283                 .policy = nl80211_policy,
13284                 .flags = GENL_UNS_ADMIN_PERM,
13285                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13286                                   NL80211_FLAG_NEED_RTNL,
13287         },
13288         {
13289                 .cmd = NL80211_CMD_SET_BSS,
13290                 .doit = nl80211_set_bss,
13291                 .policy = nl80211_policy,
13292                 .flags = GENL_UNS_ADMIN_PERM,
13293                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13294                                   NL80211_FLAG_NEED_RTNL,
13295         },
13296         {
13297                 .cmd = NL80211_CMD_GET_REG,
13298                 .doit = nl80211_get_reg_do,
13299                 .dumpit = nl80211_get_reg_dump,
13300                 .policy = nl80211_policy,
13301                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13302                 /* can be retrieved by unprivileged users */
13303         },
13304 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
13305         {
13306                 .cmd = NL80211_CMD_SET_REG,
13307                 .doit = nl80211_set_reg,
13308                 .policy = nl80211_policy,
13309                 .flags = GENL_ADMIN_PERM,
13310                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13311         },
13312 #endif
13313         {
13314                 .cmd = NL80211_CMD_REQ_SET_REG,
13315                 .doit = nl80211_req_set_reg,
13316                 .policy = nl80211_policy,
13317                 .flags = GENL_ADMIN_PERM,
13318         },
13319         {
13320                 .cmd = NL80211_CMD_RELOAD_REGDB,
13321                 .doit = nl80211_reload_regdb,
13322                 .policy = nl80211_policy,
13323                 .flags = GENL_ADMIN_PERM,
13324         },
13325         {
13326                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
13327                 .doit = nl80211_get_mesh_config,
13328                 .policy = nl80211_policy,
13329                 /* can be retrieved by unprivileged users */
13330                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13331                                   NL80211_FLAG_NEED_RTNL,
13332         },
13333         {
13334                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
13335                 .doit = nl80211_update_mesh_config,
13336                 .policy = nl80211_policy,
13337                 .flags = GENL_UNS_ADMIN_PERM,
13338                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13339                                   NL80211_FLAG_NEED_RTNL,
13340         },
13341         {
13342                 .cmd = NL80211_CMD_TRIGGER_SCAN,
13343                 .doit = nl80211_trigger_scan,
13344                 .policy = nl80211_policy,
13345                 .flags = GENL_UNS_ADMIN_PERM,
13346                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13347                                   NL80211_FLAG_NEED_RTNL,
13348         },
13349         {
13350                 .cmd = NL80211_CMD_ABORT_SCAN,
13351                 .doit = nl80211_abort_scan,
13352                 .policy = nl80211_policy,
13353                 .flags = GENL_UNS_ADMIN_PERM,
13354                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13355                                   NL80211_FLAG_NEED_RTNL,
13356         },
13357         {
13358                 .cmd = NL80211_CMD_GET_SCAN,
13359                 .policy = nl80211_policy,
13360                 .dumpit = nl80211_dump_scan,
13361         },
13362         {
13363                 .cmd = NL80211_CMD_START_SCHED_SCAN,
13364                 .doit = nl80211_start_sched_scan,
13365                 .policy = nl80211_policy,
13366                 .flags = GENL_UNS_ADMIN_PERM,
13367                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13368                                   NL80211_FLAG_NEED_RTNL,
13369         },
13370         {
13371                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
13372                 .doit = nl80211_stop_sched_scan,
13373                 .policy = nl80211_policy,
13374                 .flags = GENL_UNS_ADMIN_PERM,
13375                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13376                                   NL80211_FLAG_NEED_RTNL,
13377         },
13378         {
13379                 .cmd = NL80211_CMD_AUTHENTICATE,
13380                 .doit = nl80211_authenticate,
13381                 .policy = nl80211_policy,
13382                 .flags = GENL_UNS_ADMIN_PERM,
13383                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13384                                   NL80211_FLAG_NEED_RTNL |
13385                                   NL80211_FLAG_CLEAR_SKB,
13386         },
13387         {
13388                 .cmd = NL80211_CMD_ASSOCIATE,
13389                 .doit = nl80211_associate,
13390                 .policy = nl80211_policy,
13391                 .flags = GENL_UNS_ADMIN_PERM,
13392                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13393                                   NL80211_FLAG_NEED_RTNL,
13394         },
13395         {
13396                 .cmd = NL80211_CMD_DEAUTHENTICATE,
13397                 .doit = nl80211_deauthenticate,
13398                 .policy = nl80211_policy,
13399                 .flags = GENL_UNS_ADMIN_PERM,
13400                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13401                                   NL80211_FLAG_NEED_RTNL,
13402         },
13403         {
13404                 .cmd = NL80211_CMD_DISASSOCIATE,
13405                 .doit = nl80211_disassociate,
13406                 .policy = nl80211_policy,
13407                 .flags = GENL_UNS_ADMIN_PERM,
13408                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13409                                   NL80211_FLAG_NEED_RTNL,
13410         },
13411         {
13412                 .cmd = NL80211_CMD_JOIN_IBSS,
13413                 .doit = nl80211_join_ibss,
13414                 .policy = nl80211_policy,
13415                 .flags = GENL_UNS_ADMIN_PERM,
13416                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13417                                   NL80211_FLAG_NEED_RTNL,
13418         },
13419         {
13420                 .cmd = NL80211_CMD_LEAVE_IBSS,
13421                 .doit = nl80211_leave_ibss,
13422                 .policy = nl80211_policy,
13423                 .flags = GENL_UNS_ADMIN_PERM,
13424                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13425                                   NL80211_FLAG_NEED_RTNL,
13426         },
13427 #ifdef CONFIG_NL80211_TESTMODE
13428         {
13429                 .cmd = NL80211_CMD_TESTMODE,
13430                 .doit = nl80211_testmode_do,
13431                 .dumpit = nl80211_testmode_dump,
13432                 .policy = nl80211_policy,
13433                 .flags = GENL_UNS_ADMIN_PERM,
13434                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13435                                   NL80211_FLAG_NEED_RTNL,
13436         },
13437 #endif
13438         {
13439                 .cmd = NL80211_CMD_CONNECT,
13440                 .doit = nl80211_connect,
13441                 .policy = nl80211_policy,
13442                 .flags = GENL_UNS_ADMIN_PERM,
13443                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13444                                   NL80211_FLAG_NEED_RTNL,
13445         },
13446         {
13447                 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
13448                 .doit = nl80211_update_connect_params,
13449                 .policy = nl80211_policy,
13450                 .flags = GENL_ADMIN_PERM,
13451                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13452                                   NL80211_FLAG_NEED_RTNL,
13453         },
13454         {
13455                 .cmd = NL80211_CMD_DISCONNECT,
13456                 .doit = nl80211_disconnect,
13457                 .policy = nl80211_policy,
13458                 .flags = GENL_UNS_ADMIN_PERM,
13459                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13460                                   NL80211_FLAG_NEED_RTNL,
13461         },
13462         {
13463                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
13464                 .doit = nl80211_wiphy_netns,
13465                 .policy = nl80211_policy,
13466                 .flags = GENL_UNS_ADMIN_PERM,
13467                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13468                                   NL80211_FLAG_NEED_RTNL,
13469         },
13470         {
13471                 .cmd = NL80211_CMD_GET_SURVEY,
13472                 .policy = nl80211_policy,
13473                 .dumpit = nl80211_dump_survey,
13474         },
13475         {
13476                 .cmd = NL80211_CMD_SET_PMKSA,
13477                 .doit = nl80211_setdel_pmksa,
13478                 .policy = nl80211_policy,
13479                 .flags = GENL_UNS_ADMIN_PERM,
13480                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13481                                   NL80211_FLAG_NEED_RTNL,
13482         },
13483         {
13484                 .cmd = NL80211_CMD_DEL_PMKSA,
13485                 .doit = nl80211_setdel_pmksa,
13486                 .policy = nl80211_policy,
13487                 .flags = GENL_UNS_ADMIN_PERM,
13488                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13489                                   NL80211_FLAG_NEED_RTNL,
13490         },
13491         {
13492                 .cmd = NL80211_CMD_FLUSH_PMKSA,
13493                 .doit = nl80211_flush_pmksa,
13494                 .policy = nl80211_policy,
13495                 .flags = GENL_UNS_ADMIN_PERM,
13496                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13497                                   NL80211_FLAG_NEED_RTNL,
13498         },
13499         {
13500                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
13501                 .doit = nl80211_remain_on_channel,
13502                 .policy = nl80211_policy,
13503                 .flags = GENL_UNS_ADMIN_PERM,
13504                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13505                                   NL80211_FLAG_NEED_RTNL,
13506         },
13507         {
13508                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
13509                 .doit = nl80211_cancel_remain_on_channel,
13510                 .policy = nl80211_policy,
13511                 .flags = GENL_UNS_ADMIN_PERM,
13512                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13513                                   NL80211_FLAG_NEED_RTNL,
13514         },
13515         {
13516                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
13517                 .doit = nl80211_set_tx_bitrate_mask,
13518                 .policy = nl80211_policy,
13519                 .flags = GENL_UNS_ADMIN_PERM,
13520                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13521                                   NL80211_FLAG_NEED_RTNL,
13522         },
13523         {
13524                 .cmd = NL80211_CMD_REGISTER_FRAME,
13525                 .doit = nl80211_register_mgmt,
13526                 .policy = nl80211_policy,
13527                 .flags = GENL_UNS_ADMIN_PERM,
13528                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13529                                   NL80211_FLAG_NEED_RTNL,
13530         },
13531         {
13532                 .cmd = NL80211_CMD_FRAME,
13533                 .doit = nl80211_tx_mgmt,
13534                 .policy = nl80211_policy,
13535                 .flags = GENL_UNS_ADMIN_PERM,
13536                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13537                                   NL80211_FLAG_NEED_RTNL,
13538         },
13539         {
13540                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
13541                 .doit = nl80211_tx_mgmt_cancel_wait,
13542                 .policy = nl80211_policy,
13543                 .flags = GENL_UNS_ADMIN_PERM,
13544                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13545                                   NL80211_FLAG_NEED_RTNL,
13546         },
13547         {
13548                 .cmd = NL80211_CMD_SET_POWER_SAVE,
13549                 .doit = nl80211_set_power_save,
13550                 .policy = nl80211_policy,
13551                 .flags = GENL_UNS_ADMIN_PERM,
13552                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13553                                   NL80211_FLAG_NEED_RTNL,
13554         },
13555         {
13556                 .cmd = NL80211_CMD_GET_POWER_SAVE,
13557                 .doit = nl80211_get_power_save,
13558                 .policy = nl80211_policy,
13559                 /* can be retrieved by unprivileged users */
13560                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13561                                   NL80211_FLAG_NEED_RTNL,
13562         },
13563         {
13564                 .cmd = NL80211_CMD_SET_CQM,
13565                 .doit = nl80211_set_cqm,
13566                 .policy = nl80211_policy,
13567                 .flags = GENL_UNS_ADMIN_PERM,
13568                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13569                                   NL80211_FLAG_NEED_RTNL,
13570         },
13571         {
13572                 .cmd = NL80211_CMD_SET_CHANNEL,
13573                 .doit = nl80211_set_channel,
13574                 .policy = nl80211_policy,
13575                 .flags = GENL_UNS_ADMIN_PERM,
13576                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13577                                   NL80211_FLAG_NEED_RTNL,
13578         },
13579         {
13580                 .cmd = NL80211_CMD_SET_WDS_PEER,
13581                 .doit = nl80211_set_wds_peer,
13582                 .policy = nl80211_policy,
13583                 .flags = GENL_UNS_ADMIN_PERM,
13584                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13585                                   NL80211_FLAG_NEED_RTNL,
13586         },
13587         {
13588                 .cmd = NL80211_CMD_JOIN_MESH,
13589                 .doit = nl80211_join_mesh,
13590                 .policy = nl80211_policy,
13591                 .flags = GENL_UNS_ADMIN_PERM,
13592                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13593                                   NL80211_FLAG_NEED_RTNL,
13594         },
13595         {
13596                 .cmd = NL80211_CMD_LEAVE_MESH,
13597                 .doit = nl80211_leave_mesh,
13598                 .policy = nl80211_policy,
13599                 .flags = GENL_UNS_ADMIN_PERM,
13600                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13601                                   NL80211_FLAG_NEED_RTNL,
13602         },
13603         {
13604                 .cmd = NL80211_CMD_JOIN_OCB,
13605                 .doit = nl80211_join_ocb,
13606                 .policy = nl80211_policy,
13607                 .flags = GENL_UNS_ADMIN_PERM,
13608                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13609                                   NL80211_FLAG_NEED_RTNL,
13610         },
13611         {
13612                 .cmd = NL80211_CMD_LEAVE_OCB,
13613                 .doit = nl80211_leave_ocb,
13614                 .policy = nl80211_policy,
13615                 .flags = GENL_UNS_ADMIN_PERM,
13616                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13617                                   NL80211_FLAG_NEED_RTNL,
13618         },
13619 #ifdef CONFIG_PM
13620         {
13621                 .cmd = NL80211_CMD_GET_WOWLAN,
13622                 .doit = nl80211_get_wowlan,
13623                 .policy = nl80211_policy,
13624                 /* can be retrieved by unprivileged users */
13625                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13626                                   NL80211_FLAG_NEED_RTNL,
13627         },
13628         {
13629                 .cmd = NL80211_CMD_SET_WOWLAN,
13630                 .doit = nl80211_set_wowlan,
13631                 .policy = nl80211_policy,
13632                 .flags = GENL_UNS_ADMIN_PERM,
13633                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13634                                   NL80211_FLAG_NEED_RTNL,
13635         },
13636 #endif
13637         {
13638                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
13639                 .doit = nl80211_set_rekey_data,
13640                 .policy = nl80211_policy,
13641                 .flags = GENL_UNS_ADMIN_PERM,
13642                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13643                                   NL80211_FLAG_NEED_RTNL |
13644                                   NL80211_FLAG_CLEAR_SKB,
13645         },
13646         {
13647                 .cmd = NL80211_CMD_TDLS_MGMT,
13648                 .doit = nl80211_tdls_mgmt,
13649                 .policy = nl80211_policy,
13650                 .flags = GENL_UNS_ADMIN_PERM,
13651                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13652                                   NL80211_FLAG_NEED_RTNL,
13653         },
13654         {
13655                 .cmd = NL80211_CMD_TDLS_OPER,
13656                 .doit = nl80211_tdls_oper,
13657                 .policy = nl80211_policy,
13658                 .flags = GENL_UNS_ADMIN_PERM,
13659                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13660                                   NL80211_FLAG_NEED_RTNL,
13661         },
13662         {
13663                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
13664                 .doit = nl80211_register_unexpected_frame,
13665                 .policy = nl80211_policy,
13666                 .flags = GENL_UNS_ADMIN_PERM,
13667                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13668                                   NL80211_FLAG_NEED_RTNL,
13669         },
13670         {
13671                 .cmd = NL80211_CMD_PROBE_CLIENT,
13672                 .doit = nl80211_probe_client,
13673                 .policy = nl80211_policy,
13674                 .flags = GENL_UNS_ADMIN_PERM,
13675                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13676                                   NL80211_FLAG_NEED_RTNL,
13677         },
13678         {
13679                 .cmd = NL80211_CMD_REGISTER_BEACONS,
13680                 .doit = nl80211_register_beacons,
13681                 .policy = nl80211_policy,
13682                 .flags = GENL_UNS_ADMIN_PERM,
13683                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13684                                   NL80211_FLAG_NEED_RTNL,
13685         },
13686         {
13687                 .cmd = NL80211_CMD_SET_NOACK_MAP,
13688                 .doit = nl80211_set_noack_map,
13689                 .policy = nl80211_policy,
13690                 .flags = GENL_UNS_ADMIN_PERM,
13691                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13692                                   NL80211_FLAG_NEED_RTNL,
13693         },
13694         {
13695                 .cmd = NL80211_CMD_START_P2P_DEVICE,
13696                 .doit = nl80211_start_p2p_device,
13697                 .policy = nl80211_policy,
13698                 .flags = GENL_UNS_ADMIN_PERM,
13699                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13700                                   NL80211_FLAG_NEED_RTNL,
13701         },
13702         {
13703                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
13704                 .doit = nl80211_stop_p2p_device,
13705                 .policy = nl80211_policy,
13706                 .flags = GENL_UNS_ADMIN_PERM,
13707                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13708                                   NL80211_FLAG_NEED_RTNL,
13709         },
13710         {
13711                 .cmd = NL80211_CMD_START_NAN,
13712                 .doit = nl80211_start_nan,
13713                 .policy = nl80211_policy,
13714                 .flags = GENL_ADMIN_PERM,
13715                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13716                                   NL80211_FLAG_NEED_RTNL,
13717         },
13718         {
13719                 .cmd = NL80211_CMD_STOP_NAN,
13720                 .doit = nl80211_stop_nan,
13721                 .policy = nl80211_policy,
13722                 .flags = GENL_ADMIN_PERM,
13723                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13724                                   NL80211_FLAG_NEED_RTNL,
13725         },
13726         {
13727                 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
13728                 .doit = nl80211_nan_add_func,
13729                 .policy = nl80211_policy,
13730                 .flags = GENL_ADMIN_PERM,
13731                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13732                                   NL80211_FLAG_NEED_RTNL,
13733         },
13734         {
13735                 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
13736                 .doit = nl80211_nan_del_func,
13737                 .policy = nl80211_policy,
13738                 .flags = GENL_ADMIN_PERM,
13739                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13740                                   NL80211_FLAG_NEED_RTNL,
13741         },
13742         {
13743                 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
13744                 .doit = nl80211_nan_change_config,
13745                 .policy = nl80211_policy,
13746                 .flags = GENL_ADMIN_PERM,
13747                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13748                                   NL80211_FLAG_NEED_RTNL,
13749         },
13750         {
13751                 .cmd = NL80211_CMD_SET_MCAST_RATE,
13752                 .doit = nl80211_set_mcast_rate,
13753                 .policy = nl80211_policy,
13754                 .flags = GENL_UNS_ADMIN_PERM,
13755                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13756                                   NL80211_FLAG_NEED_RTNL,
13757         },
13758         {
13759                 .cmd = NL80211_CMD_SET_MAC_ACL,
13760                 .doit = nl80211_set_mac_acl,
13761                 .policy = nl80211_policy,
13762                 .flags = GENL_UNS_ADMIN_PERM,
13763                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13764                                   NL80211_FLAG_NEED_RTNL,
13765         },
13766         {
13767                 .cmd = NL80211_CMD_RADAR_DETECT,
13768                 .doit = nl80211_start_radar_detection,
13769                 .policy = nl80211_policy,
13770                 .flags = GENL_UNS_ADMIN_PERM,
13771                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13772                                   NL80211_FLAG_NEED_RTNL,
13773         },
13774         {
13775                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
13776                 .doit = nl80211_get_protocol_features,
13777                 .policy = nl80211_policy,
13778         },
13779         {
13780                 .cmd = NL80211_CMD_UPDATE_FT_IES,
13781                 .doit = nl80211_update_ft_ies,
13782                 .policy = nl80211_policy,
13783                 .flags = GENL_UNS_ADMIN_PERM,
13784                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13785                                   NL80211_FLAG_NEED_RTNL,
13786         },
13787         {
13788                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
13789                 .doit = nl80211_crit_protocol_start,
13790                 .policy = nl80211_policy,
13791                 .flags = GENL_UNS_ADMIN_PERM,
13792                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13793                                   NL80211_FLAG_NEED_RTNL,
13794         },
13795         {
13796                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
13797                 .doit = nl80211_crit_protocol_stop,
13798                 .policy = nl80211_policy,
13799                 .flags = GENL_UNS_ADMIN_PERM,
13800                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13801                                   NL80211_FLAG_NEED_RTNL,
13802         },
13803         {
13804                 .cmd = NL80211_CMD_GET_COALESCE,
13805                 .doit = nl80211_get_coalesce,
13806                 .policy = nl80211_policy,
13807                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13808                                   NL80211_FLAG_NEED_RTNL,
13809         },
13810         {
13811                 .cmd = NL80211_CMD_SET_COALESCE,
13812                 .doit = nl80211_set_coalesce,
13813                 .policy = nl80211_policy,
13814                 .flags = GENL_UNS_ADMIN_PERM,
13815                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13816                                   NL80211_FLAG_NEED_RTNL,
13817         },
13818         {
13819                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
13820                 .doit = nl80211_channel_switch,
13821                 .policy = nl80211_policy,
13822                 .flags = GENL_UNS_ADMIN_PERM,
13823                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13824                                   NL80211_FLAG_NEED_RTNL,
13825         },
13826         {
13827                 .cmd = NL80211_CMD_VENDOR,
13828                 .doit = nl80211_vendor_cmd,
13829                 .dumpit = nl80211_vendor_cmd_dump,
13830                 .policy = nl80211_policy,
13831                 .flags = GENL_UNS_ADMIN_PERM,
13832                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13833                                   NL80211_FLAG_NEED_RTNL,
13834         },
13835         {
13836                 .cmd = NL80211_CMD_SET_QOS_MAP,
13837                 .doit = nl80211_set_qos_map,
13838                 .policy = nl80211_policy,
13839                 .flags = GENL_UNS_ADMIN_PERM,
13840                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13841                                   NL80211_FLAG_NEED_RTNL,
13842         },
13843         {
13844                 .cmd = NL80211_CMD_ADD_TX_TS,
13845                 .doit = nl80211_add_tx_ts,
13846                 .policy = nl80211_policy,
13847                 .flags = GENL_UNS_ADMIN_PERM,
13848                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13849                                   NL80211_FLAG_NEED_RTNL,
13850         },
13851         {
13852                 .cmd = NL80211_CMD_DEL_TX_TS,
13853                 .doit = nl80211_del_tx_ts,
13854                 .policy = nl80211_policy,
13855                 .flags = GENL_UNS_ADMIN_PERM,
13856                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13857                                   NL80211_FLAG_NEED_RTNL,
13858         },
13859         {
13860                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
13861                 .doit = nl80211_tdls_channel_switch,
13862                 .policy = nl80211_policy,
13863                 .flags = GENL_UNS_ADMIN_PERM,
13864                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13865                                   NL80211_FLAG_NEED_RTNL,
13866         },
13867         {
13868                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
13869                 .doit = nl80211_tdls_cancel_channel_switch,
13870                 .policy = nl80211_policy,
13871                 .flags = GENL_UNS_ADMIN_PERM,
13872                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13873                                   NL80211_FLAG_NEED_RTNL,
13874         },
13875         {
13876                 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
13877                 .doit = nl80211_set_multicast_to_unicast,
13878                 .policy = nl80211_policy,
13879                 .flags = GENL_UNS_ADMIN_PERM,
13880                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13881                                   NL80211_FLAG_NEED_RTNL,
13882         },
13883         {
13884                 .cmd = NL80211_CMD_SET_PMK,
13885                 .doit = nl80211_set_pmk,
13886                 .policy = nl80211_policy,
13887                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13888                                   NL80211_FLAG_NEED_RTNL,
13889         },
13890         {
13891                 .cmd = NL80211_CMD_DEL_PMK,
13892                 .doit = nl80211_del_pmk,
13893                 .policy = nl80211_policy,
13894                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13895                                   NL80211_FLAG_NEED_RTNL,
13896         },
13897         {
13898                 .cmd = NL80211_CMD_EXTERNAL_AUTH,
13899                 .doit = nl80211_external_auth,
13900                 .policy = nl80211_policy,
13901                 .flags = GENL_ADMIN_PERM,
13902                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13903                                   NL80211_FLAG_NEED_RTNL,
13904         },
13905         {
13906                 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
13907                 .doit = nl80211_tx_control_port,
13908                 .policy = nl80211_policy,
13909                 .flags = GENL_UNS_ADMIN_PERM,
13910                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13911                                   NL80211_FLAG_NEED_RTNL,
13912         },
13913 };
13914
13915 static struct genl_family nl80211_fam __ro_after_init = {
13916         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
13917         .hdrsize = 0,                   /* no private header */
13918         .version = 1,                   /* no particular meaning now */
13919         .maxattr = NL80211_ATTR_MAX,
13920         .netnsok = true,
13921         .pre_doit = nl80211_pre_doit,
13922         .post_doit = nl80211_post_doit,
13923         .module = THIS_MODULE,
13924         .ops = nl80211_ops,
13925         .n_ops = ARRAY_SIZE(nl80211_ops),
13926         .mcgrps = nl80211_mcgrps,
13927         .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
13928 };
13929
13930 /* notification functions */
13931
13932 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
13933                           enum nl80211_commands cmd)
13934 {
13935         struct sk_buff *msg;
13936         struct nl80211_dump_wiphy_state state = {};
13937
13938         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
13939                 cmd != NL80211_CMD_DEL_WIPHY);
13940
13941         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13942         if (!msg)
13943                 return;
13944
13945         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
13946                 nlmsg_free(msg);
13947                 return;
13948         }
13949
13950         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13951                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
13952 }
13953
13954 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
13955                                 struct wireless_dev *wdev,
13956                                 enum nl80211_commands cmd)
13957 {
13958         struct sk_buff *msg;
13959
13960         WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
13961                 cmd != NL80211_CMD_DEL_INTERFACE);
13962
13963         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13964         if (!msg)
13965                 return;
13966
13967         if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev,
13968                                cmd == NL80211_CMD_DEL_INTERFACE) < 0) {
13969                 nlmsg_free(msg);
13970                 return;
13971         }
13972
13973         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13974                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
13975 }
13976
13977 static int nl80211_add_scan_req(struct sk_buff *msg,
13978                                 struct cfg80211_registered_device *rdev)
13979 {
13980         struct cfg80211_scan_request *req = rdev->scan_req;
13981         struct nlattr *nest;
13982         int i;
13983
13984         if (WARN_ON(!req))
13985                 return 0;
13986
13987         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
13988         if (!nest)
13989                 goto nla_put_failure;
13990         for (i = 0; i < req->n_ssids; i++) {
13991                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
13992                         goto nla_put_failure;
13993         }
13994         nla_nest_end(msg, nest);
13995
13996         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
13997         if (!nest)
13998                 goto nla_put_failure;
13999         for (i = 0; i < req->n_channels; i++) {
14000                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
14001                         goto nla_put_failure;
14002         }
14003         nla_nest_end(msg, nest);
14004
14005         if (req->ie &&
14006             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
14007                 goto nla_put_failure;
14008
14009         if (req->flags &&
14010             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
14011                 goto nla_put_failure;
14012
14013         if (req->info.scan_start_tsf &&
14014             (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
14015                                req->info.scan_start_tsf, NL80211_BSS_PAD) ||
14016              nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
14017                      req->info.tsf_bssid)))
14018                 goto nla_put_failure;
14019
14020         return 0;
14021  nla_put_failure:
14022         return -ENOBUFS;
14023 }
14024
14025 static int nl80211_prep_scan_msg(struct sk_buff *msg,
14026                                  struct cfg80211_registered_device *rdev,
14027                                  struct wireless_dev *wdev,
14028                                  u32 portid, u32 seq, int flags,
14029                                  u32 cmd)
14030 {
14031         void *hdr;
14032
14033         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
14034         if (!hdr)
14035                 return -1;
14036
14037         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14038             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14039                                          wdev->netdev->ifindex)) ||
14040             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14041                               NL80211_ATTR_PAD))
14042                 goto nla_put_failure;
14043
14044         /* ignore errors and send incomplete event anyway */
14045         nl80211_add_scan_req(msg, rdev);
14046
14047         genlmsg_end(msg, hdr);
14048         return 0;
14049
14050  nla_put_failure:
14051         genlmsg_cancel(msg, hdr);
14052         return -EMSGSIZE;
14053 }
14054
14055 static int
14056 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
14057                             struct cfg80211_sched_scan_request *req, u32 cmd)
14058 {
14059         void *hdr;
14060
14061         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14062         if (!hdr)
14063                 return -1;
14064
14065         if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
14066                         wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
14067             nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
14068             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
14069                               NL80211_ATTR_PAD))
14070                 goto nla_put_failure;
14071
14072         genlmsg_end(msg, hdr);
14073         return 0;
14074
14075  nla_put_failure:
14076         genlmsg_cancel(msg, hdr);
14077         return -EMSGSIZE;
14078 }
14079
14080 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
14081                              struct wireless_dev *wdev)
14082 {
14083         struct sk_buff *msg;
14084
14085         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14086         if (!msg)
14087                 return;
14088
14089         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
14090                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
14091                 nlmsg_free(msg);
14092                 return;
14093         }
14094
14095         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14096                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14097 }
14098
14099 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
14100                                        struct wireless_dev *wdev, bool aborted)
14101 {
14102         struct sk_buff *msg;
14103
14104         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14105         if (!msg)
14106                 return NULL;
14107
14108         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
14109                                   aborted ? NL80211_CMD_SCAN_ABORTED :
14110                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
14111                 nlmsg_free(msg);
14112                 return NULL;
14113         }
14114
14115         return msg;
14116 }
14117
14118 /* send message created by nl80211_build_scan_msg() */
14119 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
14120                            struct sk_buff *msg)
14121 {
14122         if (!msg)
14123                 return;
14124
14125         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14126                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14127 }
14128
14129 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
14130 {
14131         struct sk_buff *msg;
14132
14133         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14134         if (!msg)
14135                 return;
14136
14137         if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
14138                 nlmsg_free(msg);
14139                 return;
14140         }
14141
14142         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
14143                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14144 }
14145
14146 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
14147                                           struct regulatory_request *request)
14148 {
14149         /* Userspace can always count this one always being set */
14150         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
14151                 goto nla_put_failure;
14152
14153         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
14154                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14155                                NL80211_REGDOM_TYPE_WORLD))
14156                         goto nla_put_failure;
14157         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
14158                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14159                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
14160                         goto nla_put_failure;
14161         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
14162                    request->intersect) {
14163                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14164                                NL80211_REGDOM_TYPE_INTERSECTION))
14165                         goto nla_put_failure;
14166         } else {
14167                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14168                                NL80211_REGDOM_TYPE_COUNTRY) ||
14169                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
14170                                    request->alpha2))
14171                         goto nla_put_failure;
14172         }
14173
14174         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
14175                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
14176
14177                 if (wiphy &&
14178                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
14179                         goto nla_put_failure;
14180
14181                 if (wiphy &&
14182                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
14183                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
14184                         goto nla_put_failure;
14185         }
14186
14187         return true;
14188
14189 nla_put_failure:
14190         return false;
14191 }
14192
14193 /*
14194  * This can happen on global regulatory changes or device specific settings
14195  * based on custom regulatory domains.
14196  */
14197 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
14198                                      struct regulatory_request *request)
14199 {
14200         struct sk_buff *msg;
14201         void *hdr;
14202
14203         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14204         if (!msg)
14205                 return;
14206
14207         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
14208         if (!hdr) {
14209                 nlmsg_free(msg);
14210                 return;
14211         }
14212
14213         if (nl80211_reg_change_event_fill(msg, request) == false)
14214                 goto nla_put_failure;
14215
14216         genlmsg_end(msg, hdr);
14217
14218         rcu_read_lock();
14219         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
14220                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
14221         rcu_read_unlock();
14222
14223         return;
14224
14225 nla_put_failure:
14226         nlmsg_free(msg);
14227 }
14228
14229 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
14230                                     struct net_device *netdev,
14231                                     const u8 *buf, size_t len,
14232                                     enum nl80211_commands cmd, gfp_t gfp,
14233                                     int uapsd_queues)
14234 {
14235         struct sk_buff *msg;
14236         void *hdr;
14237
14238         msg = nlmsg_new(100 + len, gfp);
14239         if (!msg)
14240                 return;
14241
14242         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14243         if (!hdr) {
14244                 nlmsg_free(msg);
14245                 return;
14246         }
14247
14248         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14249             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14250             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
14251                 goto nla_put_failure;
14252
14253         if (uapsd_queues >= 0) {
14254                 struct nlattr *nla_wmm =
14255                         nla_nest_start(msg, NL80211_ATTR_STA_WME);
14256                 if (!nla_wmm)
14257                         goto nla_put_failure;
14258
14259                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
14260                                uapsd_queues))
14261                         goto nla_put_failure;
14262
14263                 nla_nest_end(msg, nla_wmm);
14264         }
14265
14266         genlmsg_end(msg, hdr);
14267
14268         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14269                                 NL80211_MCGRP_MLME, gfp);
14270         return;
14271
14272  nla_put_failure:
14273         nlmsg_free(msg);
14274 }
14275
14276 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
14277                           struct net_device *netdev, const u8 *buf,
14278                           size_t len, gfp_t gfp)
14279 {
14280         nl80211_send_mlme_event(rdev, netdev, buf, len,
14281                                 NL80211_CMD_AUTHENTICATE, gfp, -1);
14282 }
14283
14284 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
14285                            struct net_device *netdev, const u8 *buf,
14286                            size_t len, gfp_t gfp, int uapsd_queues)
14287 {
14288         nl80211_send_mlme_event(rdev, netdev, buf, len,
14289                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues);
14290 }
14291
14292 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
14293                          struct net_device *netdev, const u8 *buf,
14294                          size_t len, gfp_t gfp)
14295 {
14296         nl80211_send_mlme_event(rdev, netdev, buf, len,
14297                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1);
14298 }
14299
14300 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
14301                            struct net_device *netdev, const u8 *buf,
14302                            size_t len, gfp_t gfp)
14303 {
14304         nl80211_send_mlme_event(rdev, netdev, buf, len,
14305                                 NL80211_CMD_DISASSOCIATE, gfp, -1);
14306 }
14307
14308 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
14309                                   size_t len)
14310 {
14311         struct wireless_dev *wdev = dev->ieee80211_ptr;
14312         struct wiphy *wiphy = wdev->wiphy;
14313         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14314         const struct ieee80211_mgmt *mgmt = (void *)buf;
14315         u32 cmd;
14316
14317         if (WARN_ON(len < 2))
14318                 return;
14319
14320         if (ieee80211_is_deauth(mgmt->frame_control))
14321                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
14322         else
14323                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
14324
14325         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
14326         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1);
14327 }
14328 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
14329
14330 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
14331                                       struct net_device *netdev, int cmd,
14332                                       const u8 *addr, gfp_t gfp)
14333 {
14334         struct sk_buff *msg;
14335         void *hdr;
14336
14337         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14338         if (!msg)
14339                 return;
14340
14341         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14342         if (!hdr) {
14343                 nlmsg_free(msg);
14344                 return;
14345         }
14346
14347         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14348             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14349             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
14350             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
14351                 goto nla_put_failure;
14352
14353         genlmsg_end(msg, hdr);
14354
14355         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14356                                 NL80211_MCGRP_MLME, gfp);
14357         return;
14358
14359  nla_put_failure:
14360         nlmsg_free(msg);
14361 }
14362
14363 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
14364                                struct net_device *netdev, const u8 *addr,
14365                                gfp_t gfp)
14366 {
14367         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
14368                                   addr, gfp);
14369 }
14370
14371 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
14372                                 struct net_device *netdev, const u8 *addr,
14373                                 gfp_t gfp)
14374 {
14375         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
14376                                   addr, gfp);
14377 }
14378
14379 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
14380                                  struct net_device *netdev,
14381                                  struct cfg80211_connect_resp_params *cr,
14382                                  gfp_t gfp)
14383 {
14384         struct sk_buff *msg;
14385         void *hdr;
14386
14387         msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
14388                         cr->fils.kek_len + cr->fils.pmk_len +
14389                         (cr->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
14390         if (!msg)
14391                 return;
14392
14393         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
14394         if (!hdr) {
14395                 nlmsg_free(msg);
14396                 return;
14397         }
14398
14399         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14400             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14401             (cr->bssid &&
14402              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) ||
14403             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
14404                         cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
14405                         cr->status) ||
14406             (cr->status < 0 &&
14407              (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
14408               nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
14409                           cr->timeout_reason))) ||
14410             (cr->req_ie &&
14411              nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
14412             (cr->resp_ie &&
14413              nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
14414                      cr->resp_ie)) ||
14415             (cr->fils.update_erp_next_seq_num &&
14416              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
14417                          cr->fils.erp_next_seq_num)) ||
14418             (cr->status == WLAN_STATUS_SUCCESS &&
14419              ((cr->fils.kek &&
14420                nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
14421                        cr->fils.kek)) ||
14422               (cr->fils.pmk &&
14423                nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
14424               (cr->fils.pmkid &&
14425                nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
14426                 goto nla_put_failure;
14427
14428         genlmsg_end(msg, hdr);
14429
14430         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14431                                 NL80211_MCGRP_MLME, gfp);
14432         return;
14433
14434  nla_put_failure:
14435         nlmsg_free(msg);
14436 }
14437
14438 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
14439                          struct net_device *netdev,
14440                          struct cfg80211_roam_info *info, gfp_t gfp)
14441 {
14442         struct sk_buff *msg;
14443         void *hdr;
14444         const u8 *bssid = info->bss ? info->bss->bssid : info->bssid;
14445
14446         msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
14447                         info->fils.kek_len + info->fils.pmk_len +
14448                         (info->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
14449         if (!msg)
14450                 return;
14451
14452         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
14453         if (!hdr) {
14454                 nlmsg_free(msg);
14455                 return;
14456         }
14457
14458         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14459             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14460             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
14461             (info->req_ie &&
14462              nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
14463                      info->req_ie)) ||
14464             (info->resp_ie &&
14465              nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
14466                      info->resp_ie)) ||
14467             (info->fils.update_erp_next_seq_num &&
14468              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
14469                          info->fils.erp_next_seq_num)) ||
14470             (info->fils.kek &&
14471              nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
14472                      info->fils.kek)) ||
14473             (info->fils.pmk &&
14474              nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
14475             (info->fils.pmkid &&
14476              nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
14477                 goto nla_put_failure;
14478
14479         genlmsg_end(msg, hdr);
14480
14481         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14482                                 NL80211_MCGRP_MLME, gfp);
14483         return;
14484
14485  nla_put_failure:
14486         nlmsg_free(msg);
14487 }
14488
14489 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
14490                                   struct net_device *netdev, const u8 *bssid)
14491 {
14492         struct sk_buff *msg;
14493         void *hdr;
14494
14495         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14496         if (!msg)
14497                 return;
14498
14499         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
14500         if (!hdr) {
14501                 nlmsg_free(msg);
14502                 return;
14503         }
14504
14505         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
14506                 goto nla_put_failure;
14507
14508         genlmsg_end(msg, hdr);
14509
14510         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14511                                 NL80211_MCGRP_MLME, GFP_KERNEL);
14512         return;
14513
14514  nla_put_failure:
14515         nlmsg_free(msg);
14516 }
14517
14518 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
14519                                struct net_device *netdev, u16 reason,
14520                                const u8 *ie, size_t ie_len, bool from_ap)
14521 {
14522         struct sk_buff *msg;
14523         void *hdr;
14524
14525         msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
14526         if (!msg)
14527                 return;
14528
14529         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
14530         if (!hdr) {
14531                 nlmsg_free(msg);
14532                 return;
14533         }
14534
14535         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14536             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14537             (reason &&
14538              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
14539             (from_ap &&
14540              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
14541             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
14542                 goto nla_put_failure;
14543
14544         genlmsg_end(msg, hdr);
14545
14546         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14547                                 NL80211_MCGRP_MLME, GFP_KERNEL);
14548         return;
14549
14550  nla_put_failure:
14551         nlmsg_free(msg);
14552 }
14553
14554 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
14555                              struct net_device *netdev, const u8 *bssid,
14556                              gfp_t gfp)
14557 {
14558         struct sk_buff *msg;
14559         void *hdr;
14560
14561         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14562         if (!msg)
14563                 return;
14564
14565         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
14566         if (!hdr) {
14567                 nlmsg_free(msg);
14568                 return;
14569         }
14570
14571         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14572             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14573             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
14574                 goto nla_put_failure;
14575
14576         genlmsg_end(msg, hdr);
14577
14578         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14579                                 NL80211_MCGRP_MLME, gfp);
14580         return;
14581
14582  nla_put_failure:
14583         nlmsg_free(msg);
14584 }
14585
14586 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
14587                                         const u8* ie, u8 ie_len, gfp_t gfp)
14588 {
14589         struct wireless_dev *wdev = dev->ieee80211_ptr;
14590         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14591         struct sk_buff *msg;
14592         void *hdr;
14593
14594         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
14595                 return;
14596
14597         trace_cfg80211_notify_new_peer_candidate(dev, addr);
14598
14599         msg = nlmsg_new(100 + ie_len, gfp);
14600         if (!msg)
14601                 return;
14602
14603         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
14604         if (!hdr) {
14605                 nlmsg_free(msg);
14606                 return;
14607         }
14608
14609         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14610             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14611             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
14612             (ie_len && ie &&
14613              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
14614                 goto nla_put_failure;
14615
14616         genlmsg_end(msg, hdr);
14617
14618         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14619                                 NL80211_MCGRP_MLME, gfp);
14620         return;
14621
14622  nla_put_failure:
14623         nlmsg_free(msg);
14624 }
14625 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
14626
14627 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
14628                                  struct net_device *netdev, const u8 *addr,
14629                                  enum nl80211_key_type key_type, int key_id,
14630                                  const u8 *tsc, gfp_t gfp)
14631 {
14632         struct sk_buff *msg;
14633         void *hdr;
14634
14635         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14636         if (!msg)
14637                 return;
14638
14639         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
14640         if (!hdr) {
14641                 nlmsg_free(msg);
14642                 return;
14643         }
14644
14645         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14646             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14647             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
14648             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
14649             (key_id != -1 &&
14650              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
14651             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
14652                 goto nla_put_failure;
14653
14654         genlmsg_end(msg, hdr);
14655
14656         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14657                                 NL80211_MCGRP_MLME, gfp);
14658         return;
14659
14660  nla_put_failure:
14661         nlmsg_free(msg);
14662 }
14663
14664 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
14665                                     struct ieee80211_channel *channel_before,
14666                                     struct ieee80211_channel *channel_after)
14667 {
14668         struct sk_buff *msg;
14669         void *hdr;
14670         struct nlattr *nl_freq;
14671
14672         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
14673         if (!msg)
14674                 return;
14675
14676         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
14677         if (!hdr) {
14678                 nlmsg_free(msg);
14679                 return;
14680         }
14681
14682         /*
14683          * Since we are applying the beacon hint to a wiphy we know its
14684          * wiphy_idx is valid
14685          */
14686         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
14687                 goto nla_put_failure;
14688
14689         /* Before */
14690         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
14691         if (!nl_freq)
14692                 goto nla_put_failure;
14693
14694         if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
14695                 goto nla_put_failure;
14696         nla_nest_end(msg, nl_freq);
14697
14698         /* After */
14699         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
14700         if (!nl_freq)
14701                 goto nla_put_failure;
14702
14703         if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
14704                 goto nla_put_failure;
14705         nla_nest_end(msg, nl_freq);
14706
14707         genlmsg_end(msg, hdr);
14708
14709         rcu_read_lock();
14710         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
14711                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
14712         rcu_read_unlock();
14713
14714         return;
14715
14716 nla_put_failure:
14717         nlmsg_free(msg);
14718 }
14719
14720 static void nl80211_send_remain_on_chan_event(
14721         int cmd, struct cfg80211_registered_device *rdev,
14722         struct wireless_dev *wdev, u64 cookie,
14723         struct ieee80211_channel *chan,
14724         unsigned int duration, gfp_t gfp)
14725 {
14726         struct sk_buff *msg;
14727         void *hdr;
14728
14729         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14730         if (!msg)
14731                 return;
14732
14733         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14734         if (!hdr) {
14735                 nlmsg_free(msg);
14736                 return;
14737         }
14738
14739         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14740             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14741                                          wdev->netdev->ifindex)) ||
14742             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14743                               NL80211_ATTR_PAD) ||
14744             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
14745             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
14746                         NL80211_CHAN_NO_HT) ||
14747             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14748                               NL80211_ATTR_PAD))
14749                 goto nla_put_failure;
14750
14751         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
14752             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
14753                 goto nla_put_failure;
14754
14755         genlmsg_end(msg, hdr);
14756
14757         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14758                                 NL80211_MCGRP_MLME, gfp);
14759         return;
14760
14761  nla_put_failure:
14762         nlmsg_free(msg);
14763 }
14764
14765 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
14766                                struct ieee80211_channel *chan,
14767                                unsigned int duration, gfp_t gfp)
14768 {
14769         struct wiphy *wiphy = wdev->wiphy;
14770         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14771
14772         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
14773         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
14774                                           rdev, wdev, cookie, chan,
14775                                           duration, gfp);
14776 }
14777 EXPORT_SYMBOL(cfg80211_ready_on_channel);
14778
14779 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
14780                                         struct ieee80211_channel *chan,
14781                                         gfp_t gfp)
14782 {
14783         struct wiphy *wiphy = wdev->wiphy;
14784         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14785
14786         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
14787         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
14788                                           rdev, wdev, cookie, chan, 0, gfp);
14789 }
14790 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
14791
14792 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
14793                       struct station_info *sinfo, gfp_t gfp)
14794 {
14795         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14796         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14797         struct sk_buff *msg;
14798
14799         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
14800
14801         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14802         if (!msg)
14803                 return;
14804
14805         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
14806                                  rdev, dev, mac_addr, sinfo) < 0) {
14807                 nlmsg_free(msg);
14808                 return;
14809         }
14810
14811         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14812                                 NL80211_MCGRP_MLME, gfp);
14813 }
14814 EXPORT_SYMBOL(cfg80211_new_sta);
14815
14816 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
14817                             struct station_info *sinfo, gfp_t gfp)
14818 {
14819         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14820         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14821         struct sk_buff *msg;
14822         struct station_info empty_sinfo = {};
14823
14824         if (!sinfo)
14825                 sinfo = &empty_sinfo;
14826
14827         trace_cfg80211_del_sta(dev, mac_addr);
14828
14829         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14830         if (!msg) {
14831                 cfg80211_sinfo_release_content(sinfo);
14832                 return;
14833         }
14834
14835         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
14836                                  rdev, dev, mac_addr, sinfo) < 0) {
14837                 nlmsg_free(msg);
14838                 return;
14839         }
14840
14841         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14842                                 NL80211_MCGRP_MLME, gfp);
14843 }
14844 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
14845
14846 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
14847                           enum nl80211_connect_failed_reason reason,
14848                           gfp_t gfp)
14849 {
14850         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14851         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14852         struct sk_buff *msg;
14853         void *hdr;
14854
14855         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
14856         if (!msg)
14857                 return;
14858
14859         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
14860         if (!hdr) {
14861                 nlmsg_free(msg);
14862                 return;
14863         }
14864
14865         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14866             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
14867             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
14868                 goto nla_put_failure;
14869
14870         genlmsg_end(msg, hdr);
14871
14872         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14873                                 NL80211_MCGRP_MLME, gfp);
14874         return;
14875
14876  nla_put_failure:
14877         nlmsg_free(msg);
14878 }
14879 EXPORT_SYMBOL(cfg80211_conn_failed);
14880
14881 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
14882                                        const u8 *addr, gfp_t gfp)
14883 {
14884         struct wireless_dev *wdev = dev->ieee80211_ptr;
14885         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14886         struct sk_buff *msg;
14887         void *hdr;
14888         u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
14889
14890         if (!nlportid)
14891                 return false;
14892
14893         msg = nlmsg_new(100, gfp);
14894         if (!msg)
14895                 return true;
14896
14897         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14898         if (!hdr) {
14899                 nlmsg_free(msg);
14900                 return true;
14901         }
14902
14903         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14904             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14905             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
14906                 goto nla_put_failure;
14907
14908         genlmsg_end(msg, hdr);
14909         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
14910         return true;
14911
14912  nla_put_failure:
14913         nlmsg_free(msg);
14914         return true;
14915 }
14916
14917 bool cfg80211_rx_spurious_frame(struct net_device *dev,
14918                                 const u8 *addr, gfp_t gfp)
14919 {
14920         struct wireless_dev *wdev = dev->ieee80211_ptr;
14921         bool ret;
14922
14923         trace_cfg80211_rx_spurious_frame(dev, addr);
14924
14925         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
14926                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
14927                 trace_cfg80211_return_bool(false);
14928                 return false;
14929         }
14930         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
14931                                          addr, gfp);
14932         trace_cfg80211_return_bool(ret);
14933         return ret;
14934 }
14935 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
14936
14937 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
14938                                         const u8 *addr, gfp_t gfp)
14939 {
14940         struct wireless_dev *wdev = dev->ieee80211_ptr;
14941         bool ret;
14942
14943         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
14944
14945         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
14946                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
14947                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
14948                 trace_cfg80211_return_bool(false);
14949                 return false;
14950         }
14951         ret = __nl80211_unexpected_frame(dev,
14952                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
14953                                          addr, gfp);
14954         trace_cfg80211_return_bool(ret);
14955         return ret;
14956 }
14957 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
14958
14959 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
14960                       struct wireless_dev *wdev, u32 nlportid,
14961                       int freq, int sig_dbm,
14962                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
14963 {
14964         struct net_device *netdev = wdev->netdev;
14965         struct sk_buff *msg;
14966         void *hdr;
14967
14968         msg = nlmsg_new(100 + len, gfp);
14969         if (!msg)
14970                 return -ENOMEM;
14971
14972         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
14973         if (!hdr) {
14974                 nlmsg_free(msg);
14975                 return -ENOMEM;
14976         }
14977
14978         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14979             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14980                                         netdev->ifindex)) ||
14981             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14982                               NL80211_ATTR_PAD) ||
14983             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
14984             (sig_dbm &&
14985              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
14986             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
14987             (flags &&
14988              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
14989                 goto nla_put_failure;
14990
14991         genlmsg_end(msg, hdr);
14992
14993         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
14994
14995  nla_put_failure:
14996         nlmsg_free(msg);
14997         return -ENOBUFS;
14998 }
14999
15000 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
15001                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
15002 {
15003         struct wiphy *wiphy = wdev->wiphy;
15004         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15005         struct net_device *netdev = wdev->netdev;
15006         struct sk_buff *msg;
15007         void *hdr;
15008
15009         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
15010
15011         msg = nlmsg_new(100 + len, gfp);
15012         if (!msg)
15013                 return;
15014
15015         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
15016         if (!hdr) {
15017                 nlmsg_free(msg);
15018                 return;
15019         }
15020
15021         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15022             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15023                                    netdev->ifindex)) ||
15024             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15025                               NL80211_ATTR_PAD) ||
15026             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
15027             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15028                               NL80211_ATTR_PAD) ||
15029             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
15030                 goto nla_put_failure;
15031
15032         genlmsg_end(msg, hdr);
15033
15034         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15035                                 NL80211_MCGRP_MLME, gfp);
15036         return;
15037
15038  nla_put_failure:
15039         nlmsg_free(msg);
15040 }
15041 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
15042
15043 static int __nl80211_rx_control_port(struct net_device *dev,
15044                                      struct sk_buff *skb,
15045                                      bool unencrypted, gfp_t gfp)
15046 {
15047         struct wireless_dev *wdev = dev->ieee80211_ptr;
15048         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15049         struct ethhdr *ehdr = eth_hdr(skb);
15050         const u8 *addr = ehdr->h_source;
15051         u16 proto = be16_to_cpu(skb->protocol);
15052         struct sk_buff *msg;
15053         void *hdr;
15054         struct nlattr *frame;
15055
15056         u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
15057
15058         if (!nlportid)
15059                 return -ENOENT;
15060
15061         msg = nlmsg_new(100 + skb->len, gfp);
15062         if (!msg)
15063                 return -ENOMEM;
15064
15065         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
15066         if (!hdr) {
15067                 nlmsg_free(msg);
15068                 return -ENOBUFS;
15069         }
15070
15071         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15072             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15073             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15074                               NL80211_ATTR_PAD) ||
15075             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
15076             nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
15077             (unencrypted && nla_put_flag(msg,
15078                                          NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
15079                 goto nla_put_failure;
15080
15081         frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
15082         if (!frame)
15083                 goto nla_put_failure;
15084
15085         skb_copy_bits(skb, 0, nla_data(frame), skb->len);
15086         genlmsg_end(msg, hdr);
15087
15088         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15089
15090  nla_put_failure:
15091         nlmsg_free(msg);
15092         return -ENOBUFS;
15093 }
15094
15095 bool cfg80211_rx_control_port(struct net_device *dev,
15096                               struct sk_buff *skb, bool unencrypted)
15097 {
15098         int ret;
15099
15100         trace_cfg80211_rx_control_port(dev, skb, unencrypted);
15101         ret = __nl80211_rx_control_port(dev, skb, unencrypted, GFP_ATOMIC);
15102         trace_cfg80211_return_bool(ret == 0);
15103         return ret == 0;
15104 }
15105 EXPORT_SYMBOL(cfg80211_rx_control_port);
15106
15107 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
15108                                             const char *mac, gfp_t gfp)
15109 {
15110         struct wireless_dev *wdev = dev->ieee80211_ptr;
15111         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15112         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15113         void **cb;
15114
15115         if (!msg)
15116                 return NULL;
15117
15118         cb = (void **)msg->cb;
15119
15120         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
15121         if (!cb[0]) {
15122                 nlmsg_free(msg);
15123                 return NULL;
15124         }
15125
15126         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15127             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15128                 goto nla_put_failure;
15129
15130         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
15131                 goto nla_put_failure;
15132
15133         cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM);
15134         if (!cb[1])
15135                 goto nla_put_failure;
15136
15137         cb[2] = rdev;
15138
15139         return msg;
15140  nla_put_failure:
15141         nlmsg_free(msg);
15142         return NULL;
15143 }
15144
15145 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
15146 {
15147         void **cb = (void **)msg->cb;
15148         struct cfg80211_registered_device *rdev = cb[2];
15149
15150         nla_nest_end(msg, cb[1]);
15151         genlmsg_end(msg, cb[0]);
15152
15153         memset(msg->cb, 0, sizeof(msg->cb));
15154
15155         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15156                                 NL80211_MCGRP_MLME, gfp);
15157 }
15158
15159 void cfg80211_cqm_rssi_notify(struct net_device *dev,
15160                               enum nl80211_cqm_rssi_threshold_event rssi_event,
15161                               s32 rssi_level, gfp_t gfp)
15162 {
15163         struct sk_buff *msg;
15164         struct wireless_dev *wdev = dev->ieee80211_ptr;
15165         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15166
15167         trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
15168
15169         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
15170                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
15171                 return;
15172
15173         if (wdev->cqm_config) {
15174                 wdev->cqm_config->last_rssi_event_value = rssi_level;
15175
15176                 cfg80211_cqm_rssi_update(rdev, dev);
15177
15178                 if (rssi_level == 0)
15179                         rssi_level = wdev->cqm_config->last_rssi_event_value;
15180         }
15181
15182         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
15183         if (!msg)
15184                 return;
15185
15186         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
15187                         rssi_event))
15188                 goto nla_put_failure;
15189
15190         if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
15191                                       rssi_level))
15192                 goto nla_put_failure;
15193
15194         cfg80211_send_cqm(msg, gfp);
15195
15196         return;
15197
15198  nla_put_failure:
15199         nlmsg_free(msg);
15200 }
15201 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
15202
15203 void cfg80211_cqm_txe_notify(struct net_device *dev,
15204                              const u8 *peer, u32 num_packets,
15205                              u32 rate, u32 intvl, gfp_t gfp)
15206 {
15207         struct sk_buff *msg;
15208
15209         msg = cfg80211_prepare_cqm(dev, peer, gfp);
15210         if (!msg)
15211                 return;
15212
15213         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
15214                 goto nla_put_failure;
15215
15216         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
15217                 goto nla_put_failure;
15218
15219         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
15220                 goto nla_put_failure;
15221
15222         cfg80211_send_cqm(msg, gfp);
15223         return;
15224
15225  nla_put_failure:
15226         nlmsg_free(msg);
15227 }
15228 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
15229
15230 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
15231                                  const u8 *peer, u32 num_packets, gfp_t gfp)
15232 {
15233         struct sk_buff *msg;
15234
15235         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
15236
15237         msg = cfg80211_prepare_cqm(dev, peer, gfp);
15238         if (!msg)
15239                 return;
15240
15241         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
15242                 goto nla_put_failure;
15243
15244         cfg80211_send_cqm(msg, gfp);
15245         return;
15246
15247  nla_put_failure:
15248         nlmsg_free(msg);
15249 }
15250 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
15251
15252 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
15253 {
15254         struct sk_buff *msg;
15255
15256         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
15257         if (!msg)
15258                 return;
15259
15260         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
15261                 goto nla_put_failure;
15262
15263         cfg80211_send_cqm(msg, gfp);
15264         return;
15265
15266  nla_put_failure:
15267         nlmsg_free(msg);
15268 }
15269 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
15270
15271 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
15272                                      struct net_device *netdev, const u8 *bssid,
15273                                      const u8 *replay_ctr, gfp_t gfp)
15274 {
15275         struct sk_buff *msg;
15276         struct nlattr *rekey_attr;
15277         void *hdr;
15278
15279         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15280         if (!msg)
15281                 return;
15282
15283         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
15284         if (!hdr) {
15285                 nlmsg_free(msg);
15286                 return;
15287         }
15288
15289         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15290             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15291             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
15292                 goto nla_put_failure;
15293
15294         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
15295         if (!rekey_attr)
15296                 goto nla_put_failure;
15297
15298         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
15299                     NL80211_REPLAY_CTR_LEN, replay_ctr))
15300                 goto nla_put_failure;
15301
15302         nla_nest_end(msg, rekey_attr);
15303
15304         genlmsg_end(msg, hdr);
15305
15306         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15307                                 NL80211_MCGRP_MLME, gfp);
15308         return;
15309
15310  nla_put_failure:
15311         nlmsg_free(msg);
15312 }
15313
15314 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
15315                                const u8 *replay_ctr, gfp_t gfp)
15316 {
15317         struct wireless_dev *wdev = dev->ieee80211_ptr;
15318         struct wiphy *wiphy = wdev->wiphy;
15319         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15320
15321         trace_cfg80211_gtk_rekey_notify(dev, bssid);
15322         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
15323 }
15324 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
15325
15326 static void
15327 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
15328                                struct net_device *netdev, int index,
15329                                const u8 *bssid, bool preauth, gfp_t gfp)
15330 {
15331         struct sk_buff *msg;
15332         struct nlattr *attr;
15333         void *hdr;
15334
15335         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15336         if (!msg)
15337                 return;
15338
15339         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
15340         if (!hdr) {
15341                 nlmsg_free(msg);
15342                 return;
15343         }
15344
15345         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15346             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
15347                 goto nla_put_failure;
15348
15349         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
15350         if (!attr)
15351                 goto nla_put_failure;
15352
15353         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
15354             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
15355             (preauth &&
15356              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
15357                 goto nla_put_failure;
15358
15359         nla_nest_end(msg, attr);
15360
15361         genlmsg_end(msg, hdr);
15362
15363         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15364                                 NL80211_MCGRP_MLME, gfp);
15365         return;
15366
15367  nla_put_failure:
15368         nlmsg_free(msg);
15369 }
15370
15371 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
15372                                      const u8 *bssid, bool preauth, gfp_t gfp)
15373 {
15374         struct wireless_dev *wdev = dev->ieee80211_ptr;
15375         struct wiphy *wiphy = wdev->wiphy;
15376         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15377
15378         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
15379         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
15380 }
15381 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
15382
15383 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
15384                                      struct net_device *netdev,
15385                                      struct cfg80211_chan_def *chandef,
15386                                      gfp_t gfp,
15387                                      enum nl80211_commands notif,
15388                                      u8 count)
15389 {
15390         struct sk_buff *msg;
15391         void *hdr;
15392
15393         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15394         if (!msg)
15395                 return;
15396
15397         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
15398         if (!hdr) {
15399                 nlmsg_free(msg);
15400                 return;
15401         }
15402
15403         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
15404                 goto nla_put_failure;
15405
15406         if (nl80211_send_chandef(msg, chandef))
15407                 goto nla_put_failure;
15408
15409         if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
15410             (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
15411                         goto nla_put_failure;
15412
15413         genlmsg_end(msg, hdr);
15414
15415         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15416                                 NL80211_MCGRP_MLME, gfp);
15417         return;
15418
15419  nla_put_failure:
15420         nlmsg_free(msg);
15421 }
15422
15423 void cfg80211_ch_switch_notify(struct net_device *dev,
15424                                struct cfg80211_chan_def *chandef)
15425 {
15426         struct wireless_dev *wdev = dev->ieee80211_ptr;
15427         struct wiphy *wiphy = wdev->wiphy;
15428         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15429
15430         ASSERT_WDEV_LOCK(wdev);
15431
15432         trace_cfg80211_ch_switch_notify(dev, chandef);
15433
15434         wdev->chandef = *chandef;
15435         wdev->preset_chandef = *chandef;
15436         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
15437                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0);
15438 }
15439 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
15440
15441 void cfg80211_ch_switch_started_notify(struct net_device *dev,
15442                                        struct cfg80211_chan_def *chandef,
15443                                        u8 count)
15444 {
15445         struct wireless_dev *wdev = dev->ieee80211_ptr;
15446         struct wiphy *wiphy = wdev->wiphy;
15447         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15448
15449         trace_cfg80211_ch_switch_started_notify(dev, chandef);
15450
15451         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
15452                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
15453 }
15454 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
15455
15456 void
15457 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
15458                      const struct cfg80211_chan_def *chandef,
15459                      enum nl80211_radar_event event,
15460                      struct net_device *netdev, gfp_t gfp)
15461 {
15462         struct sk_buff *msg;
15463         void *hdr;
15464
15465         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15466         if (!msg)
15467                 return;
15468
15469         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
15470         if (!hdr) {
15471                 nlmsg_free(msg);
15472                 return;
15473         }
15474
15475         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
15476                 goto nla_put_failure;
15477
15478         /* NOP and radar events don't need a netdev parameter */
15479         if (netdev) {
15480                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
15481
15482                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15483                     nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15484                                       NL80211_ATTR_PAD))
15485                         goto nla_put_failure;
15486         }
15487
15488         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
15489                 goto nla_put_failure;
15490
15491         if (nl80211_send_chandef(msg, chandef))
15492                 goto nla_put_failure;
15493
15494         genlmsg_end(msg, hdr);
15495
15496         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15497                                 NL80211_MCGRP_MLME, gfp);
15498         return;
15499
15500  nla_put_failure:
15501         nlmsg_free(msg);
15502 }
15503
15504 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
15505                                        struct sta_opmode_info *sta_opmode,
15506                                        gfp_t gfp)
15507 {
15508         struct sk_buff *msg;
15509         struct wireless_dev *wdev = dev->ieee80211_ptr;
15510         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15511         void *hdr;
15512
15513         if (WARN_ON(!mac))
15514                 return;
15515
15516         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15517         if (!msg)
15518                 return;
15519
15520         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
15521         if (!hdr) {
15522                 nlmsg_free(msg);
15523                 return;
15524         }
15525
15526         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
15527                 goto nla_put_failure;
15528
15529         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15530                 goto nla_put_failure;
15531
15532         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
15533                 goto nla_put_failure;
15534
15535         if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
15536             nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
15537                 goto nla_put_failure;
15538
15539         if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
15540             nla_put_u8(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
15541                 goto nla_put_failure;
15542
15543         if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
15544             nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
15545                 goto nla_put_failure;
15546
15547         genlmsg_end(msg, hdr);
15548
15549         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15550                                 NL80211_MCGRP_MLME, gfp);
15551
15552         return;
15553
15554 nla_put_failure:
15555         nlmsg_free(msg);
15556 }
15557 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
15558
15559 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
15560                            u64 cookie, bool acked, s32 ack_signal,
15561                            bool is_valid_ack_signal, gfp_t gfp)
15562 {
15563         struct wireless_dev *wdev = dev->ieee80211_ptr;
15564         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15565         struct sk_buff *msg;
15566         void *hdr;
15567
15568         trace_cfg80211_probe_status(dev, addr, cookie, acked);
15569
15570         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15571
15572         if (!msg)
15573                 return;
15574
15575         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
15576         if (!hdr) {
15577                 nlmsg_free(msg);
15578                 return;
15579         }
15580
15581         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15582             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15583             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
15584             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15585                               NL80211_ATTR_PAD) ||
15586             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
15587             (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
15588                                                 ack_signal)))
15589                 goto nla_put_failure;
15590
15591         genlmsg_end(msg, hdr);
15592
15593         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15594                                 NL80211_MCGRP_MLME, gfp);
15595         return;
15596
15597  nla_put_failure:
15598         nlmsg_free(msg);
15599 }
15600 EXPORT_SYMBOL(cfg80211_probe_status);
15601
15602 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
15603                                  const u8 *frame, size_t len,
15604                                  int freq, int sig_dbm)
15605 {
15606         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15607         struct sk_buff *msg;
15608         void *hdr;
15609         struct cfg80211_beacon_registration *reg;
15610
15611         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
15612
15613         spin_lock_bh(&rdev->beacon_registrations_lock);
15614         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
15615                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
15616                 if (!msg) {
15617                         spin_unlock_bh(&rdev->beacon_registrations_lock);
15618                         return;
15619                 }
15620
15621                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
15622                 if (!hdr)
15623                         goto nla_put_failure;
15624
15625                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15626                     (freq &&
15627                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
15628                     (sig_dbm &&
15629                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
15630                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
15631                         goto nla_put_failure;
15632
15633                 genlmsg_end(msg, hdr);
15634
15635                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
15636         }
15637         spin_unlock_bh(&rdev->beacon_registrations_lock);
15638         return;
15639
15640  nla_put_failure:
15641         spin_unlock_bh(&rdev->beacon_registrations_lock);
15642         nlmsg_free(msg);
15643 }
15644 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
15645
15646 #ifdef CONFIG_PM
15647 static int cfg80211_net_detect_results(struct sk_buff *msg,
15648                                        struct cfg80211_wowlan_wakeup *wakeup)
15649 {
15650         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
15651         struct nlattr *nl_results, *nl_match, *nl_freqs;
15652         int i, j;
15653
15654         nl_results = nla_nest_start(
15655                 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
15656         if (!nl_results)
15657                 return -EMSGSIZE;
15658
15659         for (i = 0; i < nd->n_matches; i++) {
15660                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
15661
15662                 nl_match = nla_nest_start(msg, i);
15663                 if (!nl_match)
15664                         break;
15665
15666                 /* The SSID attribute is optional in nl80211, but for
15667                  * simplicity reasons it's always present in the
15668                  * cfg80211 structure.  If a driver can't pass the
15669                  * SSID, that needs to be changed.  A zero length SSID
15670                  * is still a valid SSID (wildcard), so it cannot be
15671                  * used for this purpose.
15672                  */
15673                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
15674                             match->ssid.ssid)) {
15675                         nla_nest_cancel(msg, nl_match);
15676                         goto out;
15677                 }
15678
15679                 if (match->n_channels) {
15680                         nl_freqs = nla_nest_start(
15681                                 msg, NL80211_ATTR_SCAN_FREQUENCIES);
15682                         if (!nl_freqs) {
15683                                 nla_nest_cancel(msg, nl_match);
15684                                 goto out;
15685                         }
15686
15687                         for (j = 0; j < match->n_channels; j++) {
15688                                 if (nla_put_u32(msg, j, match->channels[j])) {
15689                                         nla_nest_cancel(msg, nl_freqs);
15690                                         nla_nest_cancel(msg, nl_match);
15691                                         goto out;
15692                                 }
15693                         }
15694
15695                         nla_nest_end(msg, nl_freqs);
15696                 }
15697
15698                 nla_nest_end(msg, nl_match);
15699         }
15700
15701 out:
15702         nla_nest_end(msg, nl_results);
15703         return 0;
15704 }
15705
15706 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
15707                                    struct cfg80211_wowlan_wakeup *wakeup,
15708                                    gfp_t gfp)
15709 {
15710         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15711         struct sk_buff *msg;
15712         void *hdr;
15713         int size = 200;
15714
15715         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
15716
15717         if (wakeup)
15718                 size += wakeup->packet_present_len;
15719
15720         msg = nlmsg_new(size, gfp);
15721         if (!msg)
15722                 return;
15723
15724         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
15725         if (!hdr)
15726                 goto free_msg;
15727
15728         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15729             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15730                               NL80211_ATTR_PAD))
15731                 goto free_msg;
15732
15733         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15734                                         wdev->netdev->ifindex))
15735                 goto free_msg;
15736
15737         if (wakeup) {
15738                 struct nlattr *reasons;
15739
15740                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
15741                 if (!reasons)
15742                         goto free_msg;
15743
15744                 if (wakeup->disconnect &&
15745                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
15746                         goto free_msg;
15747                 if (wakeup->magic_pkt &&
15748                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
15749                         goto free_msg;
15750                 if (wakeup->gtk_rekey_failure &&
15751                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
15752                         goto free_msg;
15753                 if (wakeup->eap_identity_req &&
15754                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
15755                         goto free_msg;
15756                 if (wakeup->four_way_handshake &&
15757                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
15758                         goto free_msg;
15759                 if (wakeup->rfkill_release &&
15760                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
15761                         goto free_msg;
15762
15763                 if (wakeup->pattern_idx >= 0 &&
15764                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
15765                                 wakeup->pattern_idx))
15766                         goto free_msg;
15767
15768                 if (wakeup->tcp_match &&
15769                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
15770                         goto free_msg;
15771
15772                 if (wakeup->tcp_connlost &&
15773                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
15774                         goto free_msg;
15775
15776                 if (wakeup->tcp_nomoretokens &&
15777                     nla_put_flag(msg,
15778                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
15779                         goto free_msg;
15780
15781                 if (wakeup->packet) {
15782                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
15783                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
15784
15785                         if (!wakeup->packet_80211) {
15786                                 pkt_attr =
15787                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
15788                                 len_attr =
15789                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
15790                         }
15791
15792                         if (wakeup->packet_len &&
15793                             nla_put_u32(msg, len_attr, wakeup->packet_len))
15794                                 goto free_msg;
15795
15796                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
15797                                     wakeup->packet))
15798                                 goto free_msg;
15799                 }
15800
15801                 if (wakeup->net_detect &&
15802                     cfg80211_net_detect_results(msg, wakeup))
15803                                 goto free_msg;
15804
15805                 nla_nest_end(msg, reasons);
15806         }
15807
15808         genlmsg_end(msg, hdr);
15809
15810         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15811                                 NL80211_MCGRP_MLME, gfp);
15812         return;
15813
15814  free_msg:
15815         nlmsg_free(msg);
15816 }
15817 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
15818 #endif
15819
15820 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
15821                                 enum nl80211_tdls_operation oper,
15822                                 u16 reason_code, gfp_t gfp)
15823 {
15824         struct wireless_dev *wdev = dev->ieee80211_ptr;
15825         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15826         struct sk_buff *msg;
15827         void *hdr;
15828
15829         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
15830                                          reason_code);
15831
15832         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15833         if (!msg)
15834                 return;
15835
15836         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
15837         if (!hdr) {
15838                 nlmsg_free(msg);
15839                 return;
15840         }
15841
15842         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15843             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15844             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
15845             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
15846             (reason_code > 0 &&
15847              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
15848                 goto nla_put_failure;
15849
15850         genlmsg_end(msg, hdr);
15851
15852         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15853                                 NL80211_MCGRP_MLME, gfp);
15854         return;
15855
15856  nla_put_failure:
15857         nlmsg_free(msg);
15858 }
15859 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
15860
15861 static int nl80211_netlink_notify(struct notifier_block * nb,
15862                                   unsigned long state,
15863                                   void *_notify)
15864 {
15865         struct netlink_notify *notify = _notify;
15866         struct cfg80211_registered_device *rdev;
15867         struct wireless_dev *wdev;
15868         struct cfg80211_beacon_registration *reg, *tmp;
15869
15870         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
15871                 return NOTIFY_DONE;
15872
15873         rcu_read_lock();
15874
15875         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
15876                 struct cfg80211_sched_scan_request *sched_scan_req;
15877
15878                 list_for_each_entry_rcu(sched_scan_req,
15879                                         &rdev->sched_scan_req_list,
15880                                         list) {
15881                         if (sched_scan_req->owner_nlportid == notify->portid) {
15882                                 sched_scan_req->nl_owner_dead = true;
15883                                 schedule_work(&rdev->sched_scan_stop_wk);
15884                         }
15885                 }
15886
15887                 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
15888                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
15889
15890                         if (wdev->owner_nlportid == notify->portid) {
15891                                 wdev->nl_owner_dead = true;
15892                                 schedule_work(&rdev->destroy_work);
15893                         } else if (wdev->conn_owner_nlportid == notify->portid) {
15894                                 schedule_work(&wdev->disconnect_wk);
15895                         }
15896                 }
15897
15898                 spin_lock_bh(&rdev->beacon_registrations_lock);
15899                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
15900                                          list) {
15901                         if (reg->nlportid == notify->portid) {
15902                                 list_del(&reg->list);
15903                                 kfree(reg);
15904                                 break;
15905                         }
15906                 }
15907                 spin_unlock_bh(&rdev->beacon_registrations_lock);
15908         }
15909
15910         rcu_read_unlock();
15911
15912         /*
15913          * It is possible that the user space process that is controlling the
15914          * indoor setting disappeared, so notify the regulatory core.
15915          */
15916         regulatory_netlink_notify(notify->portid);
15917         return NOTIFY_OK;
15918 }
15919
15920 static struct notifier_block nl80211_netlink_notifier = {
15921         .notifier_call = nl80211_netlink_notify,
15922 };
15923
15924 void cfg80211_ft_event(struct net_device *netdev,
15925                        struct cfg80211_ft_event_params *ft_event)
15926 {
15927         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
15928         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15929         struct sk_buff *msg;
15930         void *hdr;
15931
15932         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
15933
15934         if (!ft_event->target_ap)
15935                 return;
15936
15937         msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
15938                         GFP_KERNEL);
15939         if (!msg)
15940                 return;
15941
15942         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
15943         if (!hdr)
15944                 goto out;
15945
15946         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15947             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15948             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
15949                 goto out;
15950
15951         if (ft_event->ies &&
15952             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
15953                 goto out;
15954         if (ft_event->ric_ies &&
15955             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
15956                     ft_event->ric_ies))
15957                 goto out;
15958
15959         genlmsg_end(msg, hdr);
15960
15961         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15962                                 NL80211_MCGRP_MLME, GFP_KERNEL);
15963         return;
15964  out:
15965         nlmsg_free(msg);
15966 }
15967 EXPORT_SYMBOL(cfg80211_ft_event);
15968
15969 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
15970 {
15971         struct cfg80211_registered_device *rdev;
15972         struct sk_buff *msg;
15973         void *hdr;
15974         u32 nlportid;
15975
15976         rdev = wiphy_to_rdev(wdev->wiphy);
15977         if (!rdev->crit_proto_nlportid)
15978                 return;
15979
15980         nlportid = rdev->crit_proto_nlportid;
15981         rdev->crit_proto_nlportid = 0;
15982
15983         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15984         if (!msg)
15985                 return;
15986
15987         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
15988         if (!hdr)
15989                 goto nla_put_failure;
15990
15991         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15992             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15993                               NL80211_ATTR_PAD))
15994                 goto nla_put_failure;
15995
15996         genlmsg_end(msg, hdr);
15997
15998         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15999         return;
16000
16001  nla_put_failure:
16002         nlmsg_free(msg);
16003 }
16004 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
16005
16006 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
16007 {
16008         struct wiphy *wiphy = wdev->wiphy;
16009         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16010         struct sk_buff *msg;
16011         void *hdr;
16012
16013         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16014         if (!msg)
16015                 return;
16016
16017         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
16018         if (!hdr)
16019                 goto out;
16020
16021         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16022             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
16023             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16024                               NL80211_ATTR_PAD))
16025                 goto out;
16026
16027         genlmsg_end(msg, hdr);
16028
16029         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
16030                                 NL80211_MCGRP_MLME, GFP_KERNEL);
16031         return;
16032  out:
16033         nlmsg_free(msg);
16034 }
16035
16036 int cfg80211_external_auth_request(struct net_device *dev,
16037                                    struct cfg80211_external_auth_params *params,
16038                                    gfp_t gfp)
16039 {
16040         struct wireless_dev *wdev = dev->ieee80211_ptr;
16041         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16042         struct sk_buff *msg;
16043         void *hdr;
16044
16045         if (!wdev->conn_owner_nlportid)
16046                 return -EINVAL;
16047
16048         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16049         if (!msg)
16050                 return -ENOMEM;
16051
16052         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
16053         if (!hdr)
16054                 goto nla_put_failure;
16055
16056         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16057             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16058             nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) ||
16059             nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
16060                         params->action) ||
16061             nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
16062             nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
16063                     params->ssid.ssid))
16064                 goto nla_put_failure;
16065
16066         genlmsg_end(msg, hdr);
16067         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
16068                         wdev->conn_owner_nlportid);
16069         return 0;
16070
16071  nla_put_failure:
16072         nlmsg_free(msg);
16073         return -ENOBUFS;
16074 }
16075 EXPORT_SYMBOL(cfg80211_external_auth_request);
16076
16077 /* initialisation/exit functions */
16078
16079 int __init nl80211_init(void)
16080 {
16081         int err;
16082
16083         err = genl_register_family(&nl80211_fam);
16084         if (err)
16085                 return err;
16086
16087         err = netlink_register_notifier(&nl80211_netlink_notifier);
16088         if (err)
16089                 goto err_out;
16090
16091         return 0;
16092  err_out:
16093         genl_unregister_family(&nl80211_fam);
16094         return err;
16095 }
16096
16097 void nl80211_exit(void)
16098 {
16099         netlink_unregister_notifier(&nl80211_netlink_notifier);
16100         genl_unregister_family(&nl80211_fam);
16101 }